Commit a reviewed set of AI-parsed incidents: create them all, tag the batch with the report name, and attach the document they were parsed from, so each incident can be traced back to its source.
const url = 'https://api.adversarial.com/api/v1/incidents/import/ai/commit';const options = { method: 'POST', headers: {'Content-Type': 'application/json'}, body: '{"incidents":[],"source_file_id":null,"tags":[]}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://api.adversarial.com/api/v1/incidents/import/ai/commit \ --header 'Content-Type: application/json' \ --data '{ "incidents": [], "source_file_id": null, "tags": [] }'Request Bodyrequired
Section titled “Request Bodyrequired”Request body for the incident AI import commit step: the (possibly edited) set of incidents the reviewer accepted, plus any tags to apply to the whole batch.
object
The finalized incidents to create.
A single incident the AI extracted from an uploaded narrative document.
The same shape is returned by the preview call and accepted back on commit, so it carries every field a reviewer may edit before import.
object
Full narrative description of the incident, grounded in the source document.
When the incident was detected, as a plain YYYY-MM-DD calendar date
taken from the document. null (or anything unparseable) means the
document carried no usable date, and the incident falls back to the
import time.
When the incident began, as a plain YYYY-MM-DD calendar date, when the
document says. null when it does not.
One- or two-sentence justification tying the proposal back to the source document.
Suggested intake source (how the incident was reported), chosen from the organization’s configured incident sources — usually the same for every incident in a document.
Reduced server-side to a configured name, or to "" when the model
returned something that is not one. Empty means “the AI did not pick a
source”, which the reviewer resolves in the preview; on import an empty
source takes the organization’s default.
A short span copied verbatim from the source document that this
incident was drawn from. The client substring-matches it against
document_text to scroll to and highlight the originating passage.
Concise incident title.
The source_file_id the parse step returned. The document is attached
to every created incident, recording where the batch came from. Optional.
Tags (by content) to apply to every imported incident — e.g. the postmortem or report name — so the whole batch can be traced back to its source. Each is created if it doesn’t already exist. Optional.
Responses
Section titled “Responses”Incidents created and tagged
Response from the incident AI import commit step.
object
The created incidents as register rows, in the order they were imported, so the client can drop them straight into its cached register views.
Each carries the source document among its attachments when it was
attached. It is not when no source_file_id was sent, or when that id
no longer names a document you uploaded for import, such as one already
discarded or claimed; the incidents are imported either way.
Register row for an Incident. An Incident plus the relational data shown on
the incident register: risk associations, threat objectives, tags, and comment count.
object
Files attached to this incident, newest-first.
A file attached to a risk, an incident, or a comment on either.
Embedded in the attachments list of the record it is attached to, and
returned when a file is uploaded to a risk or incident.
object
File size in bytes.
MIME content type.
The user who uploaded the file, if known. On a comment’s attachments this can differ from the comment’s author: a comment may reference a file someone else uploaded to the same record.
When the file was uploaded.
The attachment’s id; download it with GET /v1/files/{id}.
Original file name as uploaded.
The file’s upload status. Attachments are only listed once their upload
has finished, so this is always ready.
Relationship, core incident information
object
A User as returned by the API.
Profile images are not embedded — clients fetch them from
GET /api/v1/{icon} when icon is Some.
object
Relative path to the user’s avatar endpoint, e.g.
"users/{id}/avatar?v={hash}". None when the user has no avatar.
A User as returned by the API.
Profile images are not embedded — clients fetch them from
GET /api/v1/{icon} when icon is Some.
object
Relative path to the user’s avatar endpoint, e.g.
"users/{id}/avatar?v={hash}". None when the user has no avatar.
When set, this incident is linked under the named parent incident.
Where the incident was reported from (e.g. “Employee Reported”). Always present.
The status of an incident
A User as returned by the API.
Profile images are not embedded — clients fetch them from
GET /api/v1/{icon} when icon is Some.
object
Relative path to the user’s avatar endpoint, e.g.
"users/{id}/avatar?v={hash}". None when the user has no avatar.
Number of incidents linked under this incident (i.e. children pointing at it).
An incident is itself a linked child when incident.parent_id is set.
object
A threat objective paired with how relevant it is to a risk.
Two relations are considered the same when the objective and its relevance
match; created_date records when the relation was last changed and is not
part of its identity.
Number of incidents created.
The tags applied to the imported batch.
Example
{ "incidents": [ { "attachments": [ { "status": "pending" } ], "incident": { "id": "INC-00001", "parent_id": "INC-00001", "severity": "SEV-5", "status": "New" }, "threat_objectives": [ { "relevance": "Moderate", "threat_objective": "Sabotage" } ] } ]}No incidents to import, too many, or a source that is not one of the organization’s incident sources
Tags were requested without tags:write