Skip to content
adversarial

Get an incident by ID

GET
/v1/incidents/{id}
curl --request GET \
  --url https://api.adversarial.com/api/v1/incidents/INC-00001

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
id
required
string

The ID of the incident to retrieve — INC-00001 (case-insensitive) or a bare number

Example
INC-00001

Responses

Section titled “Responses”

200

Section titled “200”

Get the incident

Media typeapplication/json

Register row for an Incident. An Incident plus the relational data shown on the incident register: risk associations, threat objectives, tags, and comment count.

object
attachments
required

Files attached to this incident, newest-first.

Array<object>

A file attached to a risk, an incident, or a comment on either.

Embedded in the attachments list of the record it is attached to, and returned when a file is uploaded to a risk or incident.

object
byte_size

File size in bytes.

integer | null format: int64
content_type
required

MIME content type.

string
created_by

The user who uploaded the file, if known. On a comment’s attachments this can differ from the comment’s author: a comment may reference a file someone else uploaded to the same record.

string | null format: uuid
created_date
required

When the file was uploaded.

string format: date-time
id
required

The attachment’s id; download it with GET /v1/files/{id}.

string format: uuid
name
required

Original file name as uploaded.

string
status
required

The file’s upload status. Attachments are only listed once their upload has finished, so this is always ready.

string
Allowed values: pending ready failed
comment_count
required
integer format: int64
incident
required

Relationship, core incident information

object
assigned_to
One of:

A User as returned by the API.

Profile images are not embedded — clients fetch them from GET /api/v1/{icon} when icon is Some.

object
email
required
string
first_name
required
string
icon

Relative path to the user’s avatar endpoint, e.g. "users/{id}/avatar?v={hash}". None when the user has no avatar.

string | null
id
required
string format: uuid
last_name
required
string
contained_date
string | null format: date-time
created_date
required
string format: date-time
description
required
string
detected_date
required
string format: date-time
id
required
string
occurred_date
string | null format: date-time
opened_by
required

A User as returned by the API.

Profile images are not embedded — clients fetch them from GET /api/v1/{icon} when icon is Some.

object
email
required
string
first_name
required
string
icon

Relative path to the user’s avatar endpoint, e.g. "users/{id}/avatar?v={hash}". None when the user has no avatar.

string | null
id
required
string format: uuid
last_name
required
string
parent_id

When set, this incident is linked under the named parent incident.

string | null
responded_date
string | null format: date-time
severity
One of:
string
Allowed values: SEV-5 SEV-4 SEV-3 SEV-2 SEV-1
severity_reasoning
string | null
source
required

Where the incident was reported from (e.g. “Employee Reported”). Always present.

string
status
required

The status of an incident

string
Allowed values: New In Progress Review Closed
title
required
string
updated_by
required

A User as returned by the API.

Profile images are not embedded — clients fetch them from GET /api/v1/{icon} when icon is Some.

object
email
required
string
first_name
required
string
icon

Relative path to the user’s avatar endpoint, e.g. "users/{id}/avatar?v={hash}". None when the user has no avatar.

string | null
id
required
string format: uuid
last_name
required
string
updated_date
required
string format: date-time
linked_children_count
required

Number of incidents linked under this incident (i.e. children pointing at it). An incident is itself a linked child when incident.parent_id is set.

integer format: int64
risk_associations
required
Array<string>
tags
required
Array<object>
object
content
required
string
creator_id
required
string format: uuid
id
required
string format: uuid
org_id
string | null format: uuid
threat_objectives
required
Array<object>

A threat objective paired with how relevant it is to a risk.

Two relations are considered the same when the objective and its relevance match; created_date records when the relation was last changed and is not part of its identity.

object
created_date

The time that this relation was mutated

string | null format: date-time
relevance
One of:

How relevant the threat objective is. Responses always carry a relevance. In a request, null removes the objective.

string
Allowed values: Moderate Substantial
threat_objective
required

The threat objective type

string
Allowed values: Sabotage Data Disclosure Extortion Customer Targeting Resource Hijacking Fraud
Example
{
  "attachments": [
    {
      "status": "pending"
    }
  ],
  "incident": {
    "id": "INC-00001",
    "parent_id": "INC-00001",
    "severity": "SEV-5",
    "status": "New"
  },
  "threat_objectives": [
    {
      "relevance": "Moderate",
      "threat_objective": "Sabotage"
    }
  ]
}

404

Section titled “404”

Incident not found