Get the risk flow breakdown for an organization.

GET

/v1/organizations/{id}/risk-flow

curl --request GET \
  --url 'https://api.adversarial.com/api/v1/organizations/123e4567-e89b-12d3-a456-426614174000/risk-flow?start_date=2026-01-01&end_date=2026-12-31'

• Production
• Staging
• Local

Describes how risks discovered in the look-back window flow from their source, class, and opener to their final urgency. Requires both risk read access and integration read access, since the breakdown exposes per-integration-source performance.

Parameters

Path Parameters

id

required

string format: uuid

The UUID of the organization

Example

123e4567-e89b-12d3-a456-426614174000

Query Parameters

start_date

string | null format: date-time

Inclusive lower bound on the window. RFC 3339 timestamp or bare YYYY-MM-DD; either way the window starts at 00:00:00Z of the UTC day it falls on. Defaults to 90 days before today.

Example

2026-01-01

end_date

string | null format: date-time

Inclusive upper bound on the window. RFC 3339 timestamp or bare YYYY-MM-DD; either way the window ends at 23:59:59.999999Z of the UTC day it falls on. Defaults to end-of-day today.

Example

2026-12-31

Responses

200

Risk flow breakdown for the organization

Media typeapplication/json

How risks flowed from source to final urgency, grouped by each supported dimension. Covers risks discovered between start_date and end_date inclusive, the same window the risk metrics use.

object

byClass

required

Grouped by risk class / type (untyped risks fall into “Unclassified”).

object

averageTriageShift

Mean signed level change (final_idx − initial_idx, range −4..+4): positive = net downgrade (toward Info), negative = net upgrade (toward Critical). None when there is no scored transition evidence.

number | null format: double

downgradeRate

Share moved to a LOWER urgency than reported (0..1); None when there is no scored transition evidence.

number | null format: double

finalTotals

required

Final-urgency totals across the dimension, in the same index order.

Array<integer>

groups

required

Per-group rows; the highest-volume groups are kept and the long tail is folded into a single “Other” row.

Array<object>

One group row in a risk integration urgency flow dimension.

object

avatarPath

Optional avatar/icon URL (set for opener groups).

string | null

averageTriageShift

Mean signed level change (final_idx − initial_idx, range −4..+4) over scored transitions: positive = net downgrade (toward Info), negative = net upgrade (toward Critical). None when no transition is scored.

number | null format: double

downgradeRate

Share of scored transitions moved to a LOWER urgency than reported; None when scored_transition_count is 0.

number | null format: double

filterValue

Value to filter the register by for this group; None for the synthetic Unknown source / Unclassified / Other groups, which aren’t directly filterable.

string | null

finalUrgencyCounts

required

Final-urgency marginals (column sums), in the same index order.

Array<integer>

initialUrgencyCounts

required

Initially-reported-urgency marginals (row sums of transition_counts). Order [Critical, High, Medium, Low, Info, Unscored] (index 5 = unscored).

Array<integer>

name

required

Display name of the group (a source/class/opener name, or “Other”).

string

reliabilityLevel

Reliability band 1–5 from 1 − downgrade_rate (urgency mostly upheld ⇒ more reliable); None when there is no scored transition evidence to band.

integer | null format: int32

scoredTransitionCount

required

Risks with both initial and final urgency scored; the denominator for the triage rates above.

integer format: int64

transitionCounts

required

Matrix transition_counts[initial][final] = count of risks that arrived at the initial-urgency row and were scored to the final-urgency column. Both axes use the order above (index 5 = unscored).

Array<Array<integer>>

unscoredRate

required

Share of the group’s risks (including unscored) with no final urgency score (0..1).

number format: double

upgradeRate

Share of scored transitions moved to a HIGHER urgency than reported; None when scored_transition_count is 0.

number | null format: double

upheldRate

Share of risks with scored initial and final urgency whose final urgency equals the reported one (0..1); None when scored_transition_count is 0.

number | null format: double

initialUrgencyTotals

required

Initially-reported-urgency totals across the dimension. Order [Critical, High, Medium, Low, Info, Unscored] (index 5 = unscored).

Array<integer>

reliabilityLevel

Reliability band 1–5 derived from 1 − downgrade_rate (fewer downgrades ⇒ more reliable signal); None when there is no scored transition evidence to band.

integer | null format: int32

unscoredRate

required

Share of all risks in the dimension with no final urgency score (0..1).

number format: double

upgradeRate

Share moved to a HIGHER urgency than reported (0..1); None when there is no scored transition evidence.

number | null format: double

upheldRate

Share of risks with scored initial and final urgency whose final urgency equals the reported one, computed from all scored transitions in the dimension (0..1). None when the dimension has no scored transitions (no evidence).

number | null format: double

byOpenedBy

required

Grouped by the user who opened the risk.

object

averageTriageShift

Mean signed level change (final_idx − initial_idx, range −4..+4): positive = net downgrade (toward Info), negative = net upgrade (toward Critical). None when there is no scored transition evidence.

number | null format: double

downgradeRate

Share moved to a LOWER urgency than reported (0..1); None when there is no scored transition evidence.

number | null format: double

finalTotals

required

Final-urgency totals across the dimension, in the same index order.

Array<integer>

groups

required

Per-group rows; the highest-volume groups are kept and the long tail is folded into a single “Other” row.

Array<object>

One group row in a risk integration urgency flow dimension.

object

avatarPath

Optional avatar/icon URL (set for opener groups).

string | null

averageTriageShift

Mean signed level change (final_idx − initial_idx, range −4..+4) over scored transitions: positive = net downgrade (toward Info), negative = net upgrade (toward Critical). None when no transition is scored.

number | null format: double

downgradeRate

Share of scored transitions moved to a LOWER urgency than reported; None when scored_transition_count is 0.

number | null format: double

filterValue

Value to filter the register by for this group; None for the synthetic Unknown source / Unclassified / Other groups, which aren’t directly filterable.

string | null

finalUrgencyCounts

required

Final-urgency marginals (column sums), in the same index order.

Array<integer>

initialUrgencyCounts

required

Initially-reported-urgency marginals (row sums of transition_counts). Order [Critical, High, Medium, Low, Info, Unscored] (index 5 = unscored).

Array<integer>

name

required

Display name of the group (a source/class/opener name, or “Other”).

string

reliabilityLevel

Reliability band 1–5 from 1 − downgrade_rate (urgency mostly upheld ⇒ more reliable); None when there is no scored transition evidence to band.

integer | null format: int32

scoredTransitionCount

required

Risks with both initial and final urgency scored; the denominator for the triage rates above.

integer format: int64

transitionCounts

required

Matrix transition_counts[initial][final] = count of risks that arrived at the initial-urgency row and were scored to the final-urgency column. Both axes use the order above (index 5 = unscored).

Array<Array<integer>>

unscoredRate

required

Share of the group’s risks (including unscored) with no final urgency score (0..1).

number format: double

upgradeRate

Share of scored transitions moved to a HIGHER urgency than reported; None when scored_transition_count is 0.

number | null format: double

upheldRate

Share of risks with scored initial and final urgency whose final urgency equals the reported one (0..1); None when scored_transition_count is 0.

number | null format: double

initialUrgencyTotals

required

Initially-reported-urgency totals across the dimension. Order [Critical, High, Medium, Low, Info, Unscored] (index 5 = unscored).

Array<integer>

reliabilityLevel

Reliability band 1–5 derived from 1 − downgrade_rate (fewer downgrades ⇒ more reliable signal); None when there is no scored transition evidence to band.

integer | null format: int32

unscoredRate

required

Share of all risks in the dimension with no final urgency score (0..1).

number format: double

upgradeRate

Share moved to a HIGHER urgency than reported (0..1); None when there is no scored transition evidence.

number | null format: double

upheldRate

Share of risks with scored initial and final urgency whose final urgency equals the reported one, computed from all scored transitions in the dimension (0..1). None when the dimension has no scored transitions (no evidence).

number | null format: double

bySource

required

Grouped by integration source (sourceless risks fall into an “Unknown source” group).

object

averageTriageShift

Mean signed level change (final_idx − initial_idx, range −4..+4): positive = net downgrade (toward Info), negative = net upgrade (toward Critical). None when there is no scored transition evidence.

number | null format: double

downgradeRate

Share moved to a LOWER urgency than reported (0..1); None when there is no scored transition evidence.

number | null format: double

finalTotals

required

Final-urgency totals across the dimension, in the same index order.

Array<integer>

groups

required

Per-group rows; the highest-volume groups are kept and the long tail is folded into a single “Other” row.

Array<object>

One group row in a risk integration urgency flow dimension.

object

avatarPath

Optional avatar/icon URL (set for opener groups).

string | null

averageTriageShift

Mean signed level change (final_idx − initial_idx, range −4..+4) over scored transitions: positive = net downgrade (toward Info), negative = net upgrade (toward Critical). None when no transition is scored.

number | null format: double

downgradeRate

Share of scored transitions moved to a LOWER urgency than reported; None when scored_transition_count is 0.

number | null format: double

filterValue

Value to filter the register by for this group; None for the synthetic Unknown source / Unclassified / Other groups, which aren’t directly filterable.

string | null

finalUrgencyCounts

required

Final-urgency marginals (column sums), in the same index order.

Array<integer>

initialUrgencyCounts

required

Initially-reported-urgency marginals (row sums of transition_counts). Order [Critical, High, Medium, Low, Info, Unscored] (index 5 = unscored).

Array<integer>

name

required

Display name of the group (a source/class/opener name, or “Other”).

string

reliabilityLevel

Reliability band 1–5 from 1 − downgrade_rate (urgency mostly upheld ⇒ more reliable); None when there is no scored transition evidence to band.

integer | null format: int32

scoredTransitionCount

required

Risks with both initial and final urgency scored; the denominator for the triage rates above.

integer format: int64

transitionCounts

required

Matrix transition_counts[initial][final] = count of risks that arrived at the initial-urgency row and were scored to the final-urgency column. Both axes use the order above (index 5 = unscored).

Array<Array<integer>>

unscoredRate

required

Share of the group’s risks (including unscored) with no final urgency score (0..1).

number format: double

upgradeRate

Share of scored transitions moved to a HIGHER urgency than reported; None when scored_transition_count is 0.

number | null format: double

upheldRate

Share of risks with scored initial and final urgency whose final urgency equals the reported one (0..1); None when scored_transition_count is 0.

number | null format: double

initialUrgencyTotals

required

Initially-reported-urgency totals across the dimension. Order [Critical, High, Medium, Low, Info, Unscored] (index 5 = unscored).

Array<integer>

reliabilityLevel

Reliability band 1–5 derived from 1 − downgrade_rate (fewer downgrades ⇒ more reliable signal); None when there is no scored transition evidence to band.

integer | null format: int32

unscoredRate

required

Share of all risks in the dimension with no final urgency score (0..1).

number format: double

upgradeRate

Share moved to a HIGHER urgency than reported (0..1); None when there is no scored transition evidence.

number | null format: double

upheldRate

Share of risks with scored initial and final urgency whose final urgency equals the reported one, computed from all scored transitions in the dimension (0..1). None when the dimension has no scored transitions (no evidence).

number | null format: double

Example^generated

{
  "byClass": {
    "averageTriageShift": 1,
    "downgradeRate": 1,
    "finalTotals": [
      1
    ],
    "groups": [
      {
        "avatarPath": "example",
        "averageTriageShift": 1,
        "downgradeRate": 1,
        "filterValue": "example",
        "finalUrgencyCounts": [
          1
        ],
        "initialUrgencyCounts": [
          1
        ],
        "name": "example",
        "reliabilityLevel": 1,
        "scoredTransitionCount": 1,
        "transitionCounts": [
          [
            1
          ]
        ],
        "unscoredRate": 1,
        "upgradeRate": 1,
        "upheldRate": 1
      }
    ],
    "initialUrgencyTotals": [
      1
    ],
    "reliabilityLevel": 1,
    "unscoredRate": 1,
    "upgradeRate": 1,
    "upheldRate": 1
  },
  "byOpenedBy": {
    "averageTriageShift": 1,
    "downgradeRate": 1,
    "finalTotals": [
      1
    ],
    "groups": [
      {
        "avatarPath": "example",
        "averageTriageShift": 1,
        "downgradeRate": 1,
        "filterValue": "example",
        "finalUrgencyCounts": [
          1
        ],
        "initialUrgencyCounts": [
          1
        ],
        "name": "example",
        "reliabilityLevel": 1,
        "scoredTransitionCount": 1,
        "transitionCounts": [
          [
            1
          ]
        ],
        "unscoredRate": 1,
        "upgradeRate": 1,
        "upheldRate": 1
      }
    ],
    "initialUrgencyTotals": [
      1
    ],
    "reliabilityLevel": 1,
    "unscoredRate": 1,
    "upgradeRate": 1,
    "upheldRate": 1
  },
  "bySource": {
    "averageTriageShift": 1,
    "downgradeRate": 1,
    "finalTotals": [
      1
    ],
    "groups": [
      {
        "avatarPath": "example",
        "averageTriageShift": 1,
        "downgradeRate": 1,
        "filterValue": "example",
        "finalUrgencyCounts": [
          1
        ],
        "initialUrgencyCounts": [
          1
        ],
        "name": "example",
        "reliabilityLevel": 1,
        "scoredTransitionCount": 1,
        "transitionCounts": [
          [
            1
          ]
        ],
        "unscoredRate": 1,
        "upgradeRate": 1,
        "upheldRate": 1
      }
    ],
    "initialUrgencyTotals": [
      1
    ],
    "reliabilityLevel": 1,
    "unscoredRate": 1,
    "upgradeRate": 1,
    "upheldRate": 1
  }
}

403

Insufficient permissions

404

Organization not found