Export risks as CSV

POST

/v1/risks/export

const url = 'https://api.adversarial.com/api/v1/risks/export';
const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: '{"columns":["id"],"filename":"example","filter":{"assigned_to":null,"child_id":null,"closed_after":null,"closed_before":null,"closed_is_null":null,"created_after":null,"created_before":null,"description_contains":null,"discovered_after":null,"discovered_before":null,"due_after":null,"due_before":null,"due_is_null":null,"expected_after":null,"expected_before":null,"expected_is_null":null,"free_text_contains":null,"id":null,"id_contains":null,"impact":null,"in_report_period_after":null,"in_report_period_before":null,"initially_reported_urgency":null,"likelihood":null,"mentioned":null,"opened_by":null,"order_by":null,"overdue":null,"overdue_as_of":null,"page":1,"page_size":50,"parent_id":["null"],"source":null,"status":null,"tags":null,"threat_objectives":null,"title_contains":null,"type":null,"updated_after":null,"updated_before":null,"updated_by":null,"urgency":null,"urgency_shift":null},"selected_risks":["example"]}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request POST \
  --url https://api.adversarial.com/api/v1/risks/export \
  --header 'Content-Type: application/json' \
  --data '{ "columns": [ "id" ], "filename": "example", "filter": { "assigned_to": null, "child_id": null, "closed_after": null, "closed_before": null, "closed_is_null": null, "created_after": null, "created_before": null, "description_contains": null, "discovered_after": null, "discovered_before": null, "due_after": null, "due_before": null, "due_is_null": null, "expected_after": null, "expected_before": null, "expected_is_null": null, "free_text_contains": null, "id": null, "id_contains": null, "impact": null, "in_report_period_after": null, "in_report_period_before": null, "initially_reported_urgency": null, "likelihood": null, "mentioned": null, "opened_by": null, "order_by": null, "overdue": null, "overdue_as_of": null, "page": 1, "page_size": 50, "parent_id": [ "null" ], "source": null, "status": null, "tags": null, "threat_objectives": null, "title_contains": null, "type": null, "updated_after": null, "updated_before": null, "updated_by": null, "urgency": null, "urgency_shift": null }, "selected_risks": [ "example" ] }'

Request Body

application/json

One of:

null
object

null

object

columns

Optional list of column keys to include, in order. If None, exports all columns.

Array<string> | null

Allowed values: id title description status likelihood impact urgency source type created_date updated_date discovered_date due_date expected_date closed_date assigned_to opened_by initially_reported_urgency remediation_task control_statement likelihood_reasoning impact_reasoning threat_objectives tags

filename

Optional custom filename (without .csv extension)

string | null

filter

One of:

null
object

null

RSK filter applied in “All in filter” mode. Pagination on the filter is overridden by the streaming defaults.

object

assigned_to

Accepts UUIDs, the literal null (unassigned), and the sentinel me (the calling user, resolved server-side). Multiple values union — e.g. assigned_to=me&assigned_to=<uuid> returns rows assigned to either.

Array | null

unique items

child_id

Filter on what is linked under a risk. Accepts the literal any (risks with at least one non-deleted child — the “Parent Risks Only” quick filter), the literal null (risks with no children), or a child id as RSK-<n> or a bare number (that child’s parent). Repeat to union. Omit to leave the filter off.

Because links are single-layer, every parent is top-level, so this composes with the default parent_id=null register view.

Array | null

closed_after

Inclusive lower bound on closed_date. RFC 3339 or bare YYYY-MM-DD.

string | null format: date-time

closed_before

Inclusive upper bound on closed_date. RFC 3339 or bare YYYY-MM-DD.

string | null format: date-time

closed_is_null

Match only risks whose closed_date is unset. Mutually exclusive with closed_after/closed_before.

boolean | null

created_after

Inclusive lower bound on created_date. RFC 3339 or bare YYYY-MM-DD.

string | null format: date-time

created_before

Inclusive upper bound on created_date. RFC 3339 or bare YYYY-MM-DD.

string | null format: date-time

description_contains

string | null

discovered_after

Inclusive lower bound on discovered_date. RFC 3339 or bare YYYY-MM-DD.

string | null format: date-time

discovered_before

Inclusive upper bound on discovered_date. RFC 3339 or bare YYYY-MM-DD.

string | null format: date-time

due_after

Inclusive lower bound on due_date. RFC 3339 or bare YYYY-MM-DD.

string | null format: date-time

due_before

Inclusive upper bound on due_date. RFC 3339 or bare YYYY-MM-DD.

string | null format: date-time

due_is_null

Match only risks whose due_date is unset. Mutually exclusive with due_after/due_before.

boolean | null

expected_after

Inclusive lower bound on expected_date. RFC 3339 or bare YYYY-MM-DD.

string | null format: date-time

expected_before

Inclusive upper bound on expected_date. RFC 3339 or bare YYYY-MM-DD.

string | null format: date-time

expected_is_null

Match only risks whose expected_date is unset. Mutually exclusive with expected_after/expected_before.

boolean | null

free_text_contains

string | null

Return only these risks. Accepts RSK-<n> or a bare number, matching parent_id / child_id and the incident register’s id.

Array<string> | null

id_contains

string | null

impact

Array | null

unique items

in_report_period_after

Start of a report window: with in_report_period_before, restrict to the risks a deck report over that window describes — discovered within it, closed within it, or past a due date falling within it. Not the standing backlog: an open risk with no due date, or one due after the window, is outside it. Supply both bounds or neither. RFC 3339 or bare YYYY-MM-DD.

string | null format: date-time

in_report_period_before

End of a report window. See in_report_period_after.

string | null format: date-time

initially_reported_urgency

Array | null

unique items

likelihood

Array | null

unique items

mentioned

Risks with at least one live comment that @-mentions the given user. Accepts UUIDs, the sentinel me (the calling user, resolved server-side), and the literal null (no comment mentions anyone). Multiple values union — e.g. mentioned=me&mentioned=null returns risks that mention you plus risks that mention nobody.

Array | null

unique items

opened_by

Array | null

unique items

order_by

string | null

overdue

Filter to overdue (true) or non-overdue (false) risks. Overdue means open and past due_date.

boolean | null

overdue_as_of

Overdue as of this instant: due on or before it and not closed by it. overdue=true stays “overdue right now”. RFC 3339 or bare YYYY-MM-DD.

string | null format: date-time

page

1-indexed page number. Defaults to 1 (explicit null reads as the default); zero is rejected.

integer format: int64

default: 1 >= 1 <= 1000000

page_size

Rows per page. Defaults to 50 (explicit null reads as the default); zero is rejected.

integer format: int64

default: 50 >= 1 <= 500

parent_id

Filter on what a risk is linked under. Accepts the literal null (top-level risks), the literal any (only risks linked under a parent), or a parent id as RSK-<n> or a bare number. Repeat the parameter to union — ?parent_id=null&parent_id=any is every risk.

Defaults to null, so registers and rollups list top-level records only. An explicit JSON null on the body path reads as that same default, not as “no filter”.

Array | null

default: null

source

Array<string> | null

unique items

status

Array<string> | null

unique items

Allowed values: New Urgency Proposed Remediation Closure Proposed Closed

tags

Array | null

unique items

threat_objectives

Array | null

unique items

title_contains

string | null

type

Array<string> | null

unique items

Allowed values: Code Configuration Control Deficiency Policy Procedural Vulnerability Third-party

updated_after

Inclusive lower bound on updated_date. RFC 3339 or bare YYYY-MM-DD.

string | null format: date-time

updated_before

Inclusive upper bound on updated_date. RFC 3339 or bare YYYY-MM-DD.

string | null format: date-time

updated_by

Array | null

unique items

urgency

Array | null

unique items

urgency_shift

One of:

null
string

null

Return only risks whose current urgency has shifted from the urgency they were first reported at. Upgrade matches risks now at least one level more severe; Downgrade matches those now at least one level less severe. Omit to leave the filter off.

string

Allowed values: Upgrade Downgrade

selected_risks

required

IDs of selected rows. When non-empty, exports only these and ignores filter. When empty, falls back to “All in filter”.

Array<string>

Responses

200

Export all risks with current state as CSV

application/octet-stream

Array<integer>