Export risks as CSV
const url = 'https://api.adversarial.com/api/v1/risks/export';const options = { method: 'POST', headers: {'Content-Type': 'application/json'}, body: '{"columns":["id"],"filename":"example","filter":{"assigned_to":null,"child_id":null,"closed_after":null,"closed_before":null,"closed_is_null":null,"created_after":null,"created_before":null,"description_contains":null,"discovered_after":null,"discovered_before":null,"due_after":null,"due_before":null,"due_is_null":null,"expected_after":null,"expected_before":null,"expected_is_null":null,"free_text_contains":null,"id":null,"id_contains":null,"impact":null,"in_report_period_after":null,"in_report_period_before":null,"initially_reported_urgency":null,"installation_id":null,"likelihood":null,"mentioned":null,"opened_by":null,"order_by":null,"overdue":null,"overdue_as_of":null,"page":1,"page_size":50,"parent_id":["null"],"source":null,"status":null,"tags":null,"threat_objectives":null,"title_contains":null,"type":null,"updated_after":null,"updated_before":null,"updated_by":null,"urgency":null,"urgency_shift":null},"selected_risks":["example"]}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://api.adversarial.com/api/v1/risks/export \ --header 'Content-Type: application/json' \ --data '{ "columns": [ "id" ], "filename": "example", "filter": { "assigned_to": null, "child_id": null, "closed_after": null, "closed_before": null, "closed_is_null": null, "created_after": null, "created_before": null, "description_contains": null, "discovered_after": null, "discovered_before": null, "due_after": null, "due_before": null, "due_is_null": null, "expected_after": null, "expected_before": null, "expected_is_null": null, "free_text_contains": null, "id": null, "id_contains": null, "impact": null, "in_report_period_after": null, "in_report_period_before": null, "initially_reported_urgency": null, "installation_id": null, "likelihood": null, "mentioned": null, "opened_by": null, "order_by": null, "overdue": null, "overdue_as_of": null, "page": 1, "page_size": 50, "parent_id": [ "null" ], "source": null, "status": null, "tags": null, "threat_objectives": null, "title_contains": null, "type": null, "updated_after": null, "updated_before": null, "updated_by": null, "urgency": null, "urgency_shift": null }, "selected_risks": [ "example" ] }'Request Body
Section titled “Request Body”object
Optional list of column keys to include, in order. If None, exports all columns.
Optional custom filename (without .csv extension)
RSK filter applied in “All in filter” mode. Pagination on the filter is overridden by the streaming defaults.
object
Accepts UUIDs, the literal null (unassigned), and the sentinel
me (the calling user, resolved server-side). Multiple values
union — e.g. assigned_to=me&assigned_to=<uuid> returns rows
assigned to either.
Filter on what is linked under a risk. Accepts the literal any
(risks with at least one non-deleted child — the “Parent Risks Only”
quick filter), the literal null (risks with no children), or a child
id as RSK-<n> or a bare number (that child’s parent). Repeat to union.
Omit to leave the filter off.
Because links are single-layer, every parent is top-level, so this
composes with the default parent_id=null register view.
Match only risks whose closed_date is unset. Mutually exclusive with
closed_after/closed_before.
Match only risks whose due_date is unset. Mutually exclusive with
due_after/due_before.
Match only risks whose expected_date is unset. Mutually exclusive
with expected_after/expected_before.
Return only these risks. Accepts RSK-<n> or a bare number, matching
parent_id / child_id and the incident register’s id.
Start of a report window: restrict to the risks a deck report over the window describes — discovered within it, closed within it, or past a due date falling within it. Not the standing backlog: an open risk with no due date, or one due after the window, is outside it.
Inclusive, like every other date filter, alone or together with
in_report_period_before. A report over Q2 2026 is
in_report_period_after=2026-04-01 through
in_report_period_before=2026-06-30. An RFC 3339 timestamp in any UTC
offset (Z, -05:00) is used as given; a bare YYYY-MM-DD names a
whole UTC day.
Keep only records that the given integration installations imported. Multiple values union.
Risks with at least one live comment that @-mentions the given user.
Accepts UUIDs, the sentinel me (the calling user, resolved
server-side), and the literal null (no comment mentions anyone).
Multiple values union — e.g. mentioned=me&mentioned=null returns
risks that mention you plus risks that mention nobody.
Filter to overdue (true) or non-overdue (false) risks. Overdue
means open and past due_date.
Overdue as of this instant, inclusive: due on or before it and not
closed by it. overdue=true stays “overdue right now”. RFC 3339 in any
UTC offset (Z, -05:00), or a bare YYYY-MM-DD meaning the last
instant of that day in UTC.
1-indexed page number. Defaults to 1 (explicit null reads as the
default); zero is rejected.
Rows per page. Defaults to 50 (explicit null reads as the default);
zero is rejected.
Filter on what a risk is linked under. Accepts the literal null
(top-level risks), the literal any (only risks linked under a parent),
or a parent id as RSK-<n> or a bare number. Repeat the parameter to
union — ?parent_id=null&parent_id=any is every risk.
Defaults to null, so registers and rollups list top-level records
only. An explicit JSON null on the body path reads as that same
default, not as “no filter”.
IDs of selected rows. When non-empty, exports only these and ignores
filter. When empty, falls back to “All in filter”.
Responses
Section titled “Responses”Export all risks with current state as CSV