Skip to content
adversarial

Get an incident by ID

GET
/v1/incidents/{id}
curl --request GET \
  --url https://api.adversarial.com/api/v1/incidents/INC-00001

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
id
required
string

The ID of the incident to retrieve — INC-00001 (case-insensitive) or a bare number

Example
INC-00001

Responses

Section titled “Responses”

200

Section titled “200”

Get the incident

Media typeapplication/json

Register row for an Incident. An Incident plus the relational data shown on the incident register: risk associations, threat objectives, tags, and comment count.

object
comment_count
required
integer format: int64
incident
required

Relationship, core incident information

object
assigned_to
One of:
null
contained_date
string | null format: date-time
created_date
required
string format: date-time
description
required
string
detected_date
required
string format: date-time
id
required
string
occurred_date
string | null format: date-time
opened_by
required

A User as returned by the API.

Profile images are not embedded — clients fetch them from GET /api/v1/{icon} when icon is Some.

object
email
required
string
first_name
required
string
icon

Relative path to the user’s avatar endpoint, e.g. "users/{id}/avatar?v={hash}". None when the user has no avatar.

string | null
id
required
string format: uuid
last_name
required
string
parent_id

When set, this incident is linked under the named parent incident.

string | null
responded_date
string | null format: date-time
severity
One of:
null
severity_reasoning
string | null
source
required

Where the incident was reported from (e.g. “Employee Reported”). Always present.

string
status
required

The status of an incident

string
Allowed values: New In Progress Review Closed
title
required
string
updated_by
required

A User as returned by the API.

Profile images are not embedded — clients fetch them from GET /api/v1/{icon} when icon is Some.

object
email
required
string
first_name
required
string
icon

Relative path to the user’s avatar endpoint, e.g. "users/{id}/avatar?v={hash}". None when the user has no avatar.

string | null
id
required
string format: uuid
last_name
required
string
updated_date
required
string format: date-time
linked_children_count
required

Number of incidents linked under this incident (i.e. children pointing at it). An incident is itself a linked child when incident.parent_id is set.

integer format: int64
risk_associations
required
Array<string>
tags
required
Array<object>
object
content
required
string
creator_id
required
string format: uuid
id
required
string format: uuid
org_id
string | null format: uuid
threat_objectives
required
Array<object>

A threat objective paired with how relevant it is to a risk.

Two relations are considered the same when the objective and its relevance match; created_date records when the relation was last changed and is not part of its identity.

object
created_date

The time that this relation was mutated

string | null format: date-time
relevance
One of:
null
threat_objective
required

The threat objective type

string
Allowed values: Sabotage Data Disclosure Extortion Customer Targeting Resource Hijacking Fraud
Example
{
  "incident": {
    "id": "INC-00001",
    "parent_id": "INC-00001",
    "severity": "SEV-5",
    "status": "New"
  },
  "threat_objectives": [
    {
      "relevance": "Moderate",
      "threat_objective": "Sabotage"
    }
  ]
}

404

Section titled “404”

Incident not found