Skip to content

Parse an uploaded narrative document into proposed risks (preview only).

POST
/v1/risks/import/ai/parse
curl --request POST \
--url https://api.adversarial.com/api/v1/risks/import/ai/parse \
--header 'Content-Type: multipart/form-data' \
--form file=@file

This does NOT persist anything: the reviewer edits the returned proposals client-side and posts the accepted set to /v1/risks/import/ai/commit.

Media typemultipart/form-data
object
file
required

The narrative document to parse: plain text, Markdown, PDF, or Word (.docx).

string format: binary

Proposed risks parsed from the document

Media typeapplication/json

Response from the AI parse (preview) step. Nothing is persisted yet — the client renders these for review/editing and posts the final set to commit.

object
document_text
required

The document text extracted server-side (from PDF/DOCX/plain text). The client renders this in the review pane and locates each proposal’s source_excerpt within it. May be truncated for very large documents.

string
risks
required

The proposed risks for the reviewer to accept, edit, or drop.

Array<object>

A single risk the AI extracted from an uploaded narrative document.

The same shape is returned by the preview call and accepted back on commit, so it carries every field a reviewer may edit before import.

object
description
required

Full narrative description of the risk, grounded in the source document.

string
discovered_date

When the risk was discovered, as a plain YYYY-MM-DD calendar date, taken from the document — normally its report date, or a date the document ties specifically to the activity that surfaced this finding.

A bare date string rather than a timestamp on purpose: it is what the model can reliably lift out of a narrative, and what the CSV import template already uses. None (or anything unparseable) means the document carried no usable date, and the risk falls back to the creation time on import.

string | null
initially_reported_urgency
required

Initially reported urgency (IRU) inferred from how the source framed the finding.

string
Allowed values: Critical High Medium Low Info
rationale
required

One- or two-sentence justification tying the proposal back to the source document.

string
source
required

Suggested intake source (how the risk was identified), chosen from the organization’s configured risk_source list — usually the same for every finding in a document.

Reduced server-side to a configured name, or to "" when the model returned something that is not one. Empty means “the AI did not pick a source”, which the reviewer resolves in the preview; it must not be quietly swapped for a default, because an intake nobody chose is indistinguishable from one somebody did.

string
source_excerpt
required

A short span copied verbatim from the source document that this risk was drawn from. The client substring-matches it against document_text to scroll to and highlight the originating passage.

string
title
required

Concise risk title.

string
type
required

Best-fit risk category, presented as the risk’s class.

string
Allowed values: Code Configuration Control Deficiency Policy Procedural Vulnerability Third-party
Example
{
"risks": [
{
"initially_reported_urgency": "Critical",
"type": "Code"
}
]
}

Empty, oversized, or unsupported/unreadable document

AI parsing is unconfigured, timed out, or the provider failed