Get the incident flow breakdown for an organization.

GET

/v1/organizations/{id}/incident-flow

const url = 'https://api.adversarial.com/api/v1/organizations/123e4567-e89b-12d3-a456-426614174000/incident-flow?start_date=2026-01-01&end_date=2026-12-31';
const options = {method: 'GET'};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url 'https://api.adversarial.com/api/v1/organizations/123e4567-e89b-12d3-a456-426614174000/incident-flow?start_date=2026-01-01&end_date=2026-12-31'

Describes how incidents detected in the look-back window flow from their source and opener to their final severity. Requires both incident read access and integration read access, since the breakdown exposes per-integration-source performance.

Parameters

Path Parameters

required

string format: uuid

The UUID of the organization

Example

123e4567-e89b-12d3-a456-426614174000

Query Parameters

start_date

string | null format: date-time

Inclusive lower bound on the window. RFC 3339 timestamp or bare YYYY-MM-DD; either way the window starts at 00:00:00Z of the UTC day it falls on. Defaults to 90 days before today.

Example

2026-01-01

end_date

string | null format: date-time

Inclusive upper bound on the window. RFC 3339 timestamp or bare YYYY-MM-DD; either way the window ends at 23:59:59.999999Z of the UTC day it falls on. Defaults to end-of-day today.

Example

2026-12-31

Responses

200

Incident flow breakdown for the organization

application/json

How incidents flowed from source to final severity, grouped by each supported dimension. Covers incidents detected between start_date and end_date inclusive, the same window the incident metrics use.

object

byOpenedBy

required

Grouped by the user who opened the incident (null opener → “Unknown”).

object

groups

required

Per-group rows; top groups kept, the long tail folded into “Other”.

Array<object>

One group row in an incident integration urgency flow dimension.

object

avatarPath

Optional avatar/icon URL (set for opener groups).

string | null

filterValue

Value to filter the register by; None for the synthetic Unknown / Other groups, which aren’t directly filterable.

string | null

lowSeverityRate

Share of SCORED incidents at SEV-5 (0..1), same denominator as serious_rate; None when the group has no scored incidents.

number | null format: double

meanResponseMinutes

Mean response time (minutes) for this group; None if none responded.

number | null format: double

name

required

Display name of the group (a source/opener name, or “Other”).

string

reliabilityLevel

Reliability band 1–5 from serious_rate (more serious share ⇒ stronger signal); None when the group has no scored incidents.

integer | null format: int32

seriousRate

Share of SCORED incidents at SEV-1/2/3 (0..1). Denominator is the group’s scored count (total − unscored), so unscored volume doesn’t dilute it; None when the group has no scored incidents.

number | null format: double

severityCounts

required

Severity histogram. Order [SEV-1, SEV-2, SEV-3, SEV-4, SEV-5, Unscored] (index 5 = unscored).

Array<integer>

unscoredRate

required

Share of the group’s incidents (including unscored) with no severity score (0..1).

number format: double

lowSeverityRate

Share of scored incidents at SEV-5 (0..1); None when the dimension has no scored incidents.

number | null format: double

meanResponseMinutes

Mean response time (minutes) across the whole dimension; None if none responded.

number | null format: double

reliabilityLevel

Reliability band 1–5 from serious_rate (a source surfacing mostly serious incidents is the stronger signal); None when the dimension has no scored incidents. Note: the asymmetry with risk reliability — incidents band UP with serious share, risks band DOWN with downgrade share.

integer | null format: int32

seriousRate

Share of SCORED incidents at SEV-1/2/3 (0..1), computed from the raw dimension totals. Denominator excludes unscored. None when the dimension has no scored incidents.

number | null format: double

severityTotals

required

Severity totals across the dimension. Order [SEV-1, SEV-2, SEV-3, SEV-4, SEV-5, Unscored] (index 5 = unscored).

Array<integer>

unscoredRate

required

Share of all incidents in the dimension with no severity (0..1).

number format: double

bySource

required

Grouped by integration source (sourceless incidents → “Unknown source”).

object

groups

required

Per-group rows; top groups kept, the long tail folded into “Other”.

Array<object>

One group row in an incident integration urgency flow dimension.

object

avatarPath

Optional avatar/icon URL (set for opener groups).

string | null

filterValue

Value to filter the register by; None for the synthetic Unknown / Other groups, which aren’t directly filterable.

string | null

lowSeverityRate

Share of SCORED incidents at SEV-5 (0..1), same denominator as serious_rate; None when the group has no scored incidents.

number | null format: double

meanResponseMinutes

Mean response time (minutes) for this group; None if none responded.

number | null format: double

name

required

Display name of the group (a source/opener name, or “Other”).

string

reliabilityLevel

Reliability band 1–5 from serious_rate (more serious share ⇒ stronger signal); None when the group has no scored incidents.

integer | null format: int32

seriousRate

Share of SCORED incidents at SEV-1/2/3 (0..1). Denominator is the group’s scored count (total − unscored), so unscored volume doesn’t dilute it; None when the group has no scored incidents.

number | null format: double

severityCounts

required

Severity histogram. Order [SEV-1, SEV-2, SEV-3, SEV-4, SEV-5, Unscored] (index 5 = unscored).

Array<integer>

unscoredRate

required

Share of the group’s incidents (including unscored) with no severity score (0..1).

number format: double

lowSeverityRate

Share of scored incidents at SEV-5 (0..1); None when the dimension has no scored incidents.

number | null format: double

meanResponseMinutes

Mean response time (minutes) across the whole dimension; None if none responded.

number | null format: double

reliabilityLevel

integer | null format: int32

seriousRate

Share of SCORED incidents at SEV-1/2/3 (0..1), computed from the raw dimension totals. Denominator excludes unscored. None when the dimension has no scored incidents.

number | null format: double

severityTotals

required

Severity totals across the dimension. Order [SEV-1, SEV-2, SEV-3, SEV-4, SEV-5, Unscored] (index 5 = unscored).

Array<integer>

unscoredRate

required

Share of all incidents in the dimension with no severity (0..1).

number format: double

Example^generated

{
  "byOpenedBy": {
    "groups": [
      {
        "avatarPath": "example",
        "filterValue": "example",
        "lowSeverityRate": 1,
        "meanResponseMinutes": 1,
        "name": "example",
        "reliabilityLevel": 1,
        "seriousRate": 1,
        "severityCounts": [
          1
        ],
        "unscoredRate": 1
      }
    ],
    "lowSeverityRate": 1,
    "meanResponseMinutes": 1,
    "reliabilityLevel": 1,
    "seriousRate": 1,
    "severityTotals": [
      1
    ],
    "unscoredRate": 1
  },
  "bySource": {
    "groups": [
      {
        "avatarPath": "example",
        "filterValue": "example",
        "lowSeverityRate": 1,
        "meanResponseMinutes": 1,
        "name": "example",
        "reliabilityLevel": 1,
        "seriousRate": 1,
        "severityCounts": [
          1
        ],
        "unscoredRate": 1
      }
    ],
    "lowSeverityRate": 1,
    "meanResponseMinutes": 1,
    "reliabilityLevel": 1,
    "seriousRate": 1,
    "severityTotals": [
      1
    ],
    "unscoredRate": 1
  }
}

403

Insufficient permissions

404

Organization not found

Get the incident flow breakdown for an organization.

Parameters

Path Parameters

Example

Query Parameters

Example

Example

Responses

200

Examplegenerated

403

404

Example^generated