Skip to content
adversarial

List incidents with associated components for the incident register

GET
/v1/incidents
curl --request GET \
  --url 'https://api.adversarial.com/api/v1/incidents?created_after=2026-01-01&created_before=2026-12-31&updated_after=2026-01-01&updated_before=2026-12-31&detected_after=2026-01-01&detected_before=2026-12-31&occurred_after=2026-01-01&occurred_before=2026-12-31&responded_after=2026-01-01&responded_before=2026-12-31&contained_after=2026-01-01&contained_before=2026-12-31&page=1&page_size=50'

Parameters

Section titled “Parameters”

Query Parameters

Section titled “Query Parameters”
id
Array<string> | null

Return only these incidents. Accepts INC-<n> or a bare number, matching parent_id / child_id and the risk register’s id.

title_contains
string | null
description_contains
string | null
free_text
string | null
id_contains
string | null
severity
Array | null
status
Array<string> | null
Allowed values: New In Progress Review Closed
source
Array<string> | null
installation_id
Array<string> | null

Keep only records that the given integration installations imported. Multiple values union.

assigned_to
Array | null

Accepts UUIDs, the literal null (unassigned), and the sentinel me (the calling user, resolved server-side). Multiple values union.

mentioned
Array | null

Incidents with at least one live comment that @-mentions the given user. Accepts UUIDs, the sentinel me (the calling user, resolved server-side), and the literal null (no comment mentions anyone). Multiple values union — e.g. mentioned=me&mentioned=null returns incidents that mention you plus incidents that mention nobody.

threat_objectives
Array | null
created_after
One of:

One side of a date range: an RFC 3339 timestamp in any UTC offset, used as given, or a bare YYYY-MM-DD naming a whole UTC day.

string

Inclusive lower bound on created_date (>=). A bare YYYY-MM-DD covers its whole UTC day, so created_after=2026-04-01 includes April 1.

Example
2026-01-01
created_before
One of:

One side of a date range: an RFC 3339 timestamp in any UTC offset, used as given, or a bare YYYY-MM-DD naming a whole UTC day.

string

Inclusive upper bound on created_date (<=). A bare YYYY-MM-DD covers its whole UTC day, so created_before=2026-04-30 includes April 30.

Example
2026-12-31
updated_after
One of:

One side of a date range: an RFC 3339 timestamp in any UTC offset, used as given, or a bare YYYY-MM-DD naming a whole UTC day.

string

Inclusive lower bound on updated_date (>=). A bare YYYY-MM-DD covers its whole UTC day, so updated_after=2026-04-01 includes April 1.

Example
2026-01-01
updated_before
One of:

One side of a date range: an RFC 3339 timestamp in any UTC offset, used as given, or a bare YYYY-MM-DD naming a whole UTC day.

string

Inclusive upper bound on updated_date (<=). A bare YYYY-MM-DD covers its whole UTC day, so updated_before=2026-04-30 includes April 30.

Example
2026-12-31
detected_after
One of:

One side of a date range: an RFC 3339 timestamp in any UTC offset, used as given, or a bare YYYY-MM-DD naming a whole UTC day.

string

Inclusive lower bound on detected_date (>=). A bare YYYY-MM-DD covers its whole UTC day, so detected_after=2026-04-01 includes April 1.

Example
2026-01-01
detected_before
One of:

One side of a date range: an RFC 3339 timestamp in any UTC offset, used as given, or a bare YYYY-MM-DD naming a whole UTC day.

string

Inclusive upper bound on detected_date (<=). A bare YYYY-MM-DD covers its whole UTC day, so detected_before=2026-04-30 includes April 30.

Example
2026-12-31
occurred_after
One of:

One side of a date range: an RFC 3339 timestamp in any UTC offset, used as given, or a bare YYYY-MM-DD naming a whole UTC day.

string

Inclusive lower bound on occurred_date (>=). A bare YYYY-MM-DD covers its whole UTC day, so occurred_after=2026-04-01 includes April 1.

Example
2026-01-01
occurred_before
One of:

One side of a date range: an RFC 3339 timestamp in any UTC offset, used as given, or a bare YYYY-MM-DD naming a whole UTC day.

string

Inclusive upper bound on occurred_date (<=). A bare YYYY-MM-DD covers its whole UTC day, so occurred_before=2026-04-30 includes April 30.

Example
2026-12-31
occurred_is_null
boolean | null

Match only incidents whose occurred_date is unset. Mutually exclusive with occurred_after/occurred_before.

responded_after
One of:

One side of a date range: an RFC 3339 timestamp in any UTC offset, used as given, or a bare YYYY-MM-DD naming a whole UTC day.

string

Inclusive lower bound on responded_date (>=). A bare YYYY-MM-DD covers its whole UTC day, so responded_after=2026-04-01 includes April 1.

Example
2026-01-01
responded_before
One of:

One side of a date range: an RFC 3339 timestamp in any UTC offset, used as given, or a bare YYYY-MM-DD naming a whole UTC day.

string

Inclusive upper bound on responded_date (<=). A bare YYYY-MM-DD covers its whole UTC day, so responded_before=2026-04-30 includes April 30.

Example
2026-12-31
responded_is_null
boolean | null

Match only incidents whose responded_date is unset. Mutually exclusive with responded_after/responded_before.

contained_after
One of:

One side of a date range: an RFC 3339 timestamp in any UTC offset, used as given, or a bare YYYY-MM-DD naming a whole UTC day.

string

Inclusive lower bound on contained_date (>=). A bare YYYY-MM-DD covers its whole UTC day, so contained_after=2026-04-01 includes April 1.

Example
2026-01-01
contained_before
One of:

One side of a date range: an RFC 3339 timestamp in any UTC offset, used as given, or a bare YYYY-MM-DD naming a whole UTC day.

string

Inclusive upper bound on contained_date (<=). A bare YYYY-MM-DD covers its whole UTC day, so contained_before=2026-04-30 includes April 30.

Example
2026-12-31
contained_is_null
boolean | null

Match only incidents whose contained_date is unset. Mutually exclusive with contained_after/contained_before.

opened_by
Array | null
updated_by
Array | null
tags
Array | null
parent_id
Array | null

Filter on what an incident is linked under. Accepts the literal null (top-level incidents), the literal any (only incidents linked under a parent), or a parent id as INC-<n> or a bare number. Repeat the parameter to union — ?parent_id=null&parent_id=any is every incident.

Defaults to null, so registers and rollups list top-level records only. An explicit JSON null on the body path reads as that same default, not as “no filter”.

child_id
Array | null

Filter on what is linked under an incident. Accepts the literal any (incidents with at least one non-deleted child — the “Parent Incidents Only” quick filter), the literal null (incidents with no children), or a child id as INC-<n> or a bare number (that child’s parent). Repeat to union. Omit to leave the filter off.

Because links are single-layer, every parent is top-level, so this composes with the default parent_id=null register view.

page
integer format: int64
default: 1 >= 1 <= 1000000

1-indexed page number. Defaults to 1 (explicit null reads as the default); zero is rejected.

page_size
integer format: int64
default: 50 >= 1 <= 500

Rows per page. Defaults to 50 (explicit null reads as the default); zero is rejected.

order_by
One of:

Sort order: "<field>, asc|desc", e.g. "id, desc"; the direction defaults to desc. Fields: id, title, description, status, severity, source, opened_by, assigned_to, updated_by, created_date, updated_date, detected_date, occurred_date, responded_date, contained_date, tags.

string

Sort by one field. An unknown field or direction returns 400.

Responses

Section titled “Responses”

200

Section titled “200”

List incidents

Media typeapplication/json

Paginated list envelope: { "results": [...], "pagination": {...} }.

object
pagination
required

Pagination metadata describing the slice.

object
page
required

1-indexed page number of this result slice.

integer format: int64
page_size
required

Number of items requested per page.

integer format: int64
total_items
required

Total number of matching items across all pages.

integer format: int64
total_pages
required

Total number of pages at this page size.

integer format: int64
results
required

The items on this page.

Array<object>

Register row for an Incident. An Incident plus the relational data shown on the incident register: risk associations, threat objectives, tags, and comment count.

object
attachments
required

Files attached to this incident, newest-first.

Array<object>

A file attached to a risk, an incident, or a comment on either.

Embedded in the attachments list of the record it is attached to, and returned when a file is uploaded to a risk or incident.

object
byte_size

File size in bytes.

integer | null format: int64
content_type
required

MIME content type.

string
created_by

The user who uploaded the file, if known. On a comment’s attachments this can differ from the comment’s author: a comment may reference a file someone else uploaded to the same record.

string | null format: uuid
created_date
required

When the file was uploaded.

string format: date-time
id
required

The attachment’s id; download it with GET /v1/files/{id}.

string format: uuid
name
required

Original file name as uploaded.

string
status
required

The file’s upload status. Attachments are only listed once their upload has finished, so this is always ready.

string
Allowed values: pending ready failed
comment_count
required
integer format: int64
incident
required

Relationship, core incident information

object
assigned_to
One of:

A User as returned by the API.

Profile images are not embedded — clients fetch them from GET /api/v1/{icon} when icon is Some.

object
email
required
string
first_name
required
string
icon

Relative path to the user’s avatar endpoint, e.g. "users/{id}/avatar?v={hash}". None when the user has no avatar.

string | null
id
required
string format: uuid
last_name
required
string
contained_date
string | null format: date-time
created_date
required
string format: date-time
description
required
string
detected_date
required
string format: date-time
id
required
string
occurred_date
string | null format: date-time
opened_by
required

A User as returned by the API.

Profile images are not embedded — clients fetch them from GET /api/v1/{icon} when icon is Some.

object
email
required
string
first_name
required
string
icon

Relative path to the user’s avatar endpoint, e.g. "users/{id}/avatar?v={hash}". None when the user has no avatar.

string | null
id
required
string format: uuid
last_name
required
string
parent_id

When set, this incident is linked under the named parent incident.

string | null
responded_date
string | null format: date-time
severity
One of:
string
Allowed values: SEV-5 SEV-4 SEV-3 SEV-2 SEV-1
severity_reasoning
string | null
source
required

Where the incident was reported from (e.g. “Employee Reported”). Always present.

string
status
required

The status of an incident

string
Allowed values: New In Progress Review Closed
title
required
string
updated_by
required

A User as returned by the API.

Profile images are not embedded — clients fetch them from GET /api/v1/{icon} when icon is Some.

object
email
required
string
first_name
required
string
icon

Relative path to the user’s avatar endpoint, e.g. "users/{id}/avatar?v={hash}". None when the user has no avatar.

string | null
id
required
string format: uuid
last_name
required
string
updated_date
required
string format: date-time
linked_children_count
required

Number of incidents linked under this incident (i.e. children pointing at it). An incident is itself a linked child when incident.parent_id is set.

integer format: int64
risk_associations
required
Array<string>
tags
required
Array<object>
object
content
required
string
creator_id
required
string format: uuid
id
required
string format: uuid
org_id
string | null format: uuid
threat_objectives
required
Array<object>

A threat objective paired with how relevant it is to a risk.

Two relations are considered the same when the objective and its relevance match; created_date records when the relation was last changed and is not part of its identity.

object
created_date

The time that this relation was mutated

string | null format: date-time
relevance
One of:

How relevant the threat objective is. Responses always carry a relevance. In a request, null removes the objective.

string
Allowed values: Moderate Substantial
threat_objective
required

The threat objective type

string
Allowed values: Sabotage Data Disclosure Extortion Customer Targeting Resource Hijacking Fraud
Example
{
  "results": [
    {
      "attachments": [
        {
          "status": "pending"
        }
      ],
      "incident": {
        "id": "INC-00001",
        "parent_id": "INC-00001",
        "severity": "SEV-5",
        "status": "New"
      },
      "threat_objectives": [
        {
          "relevance": "Moderate",
          "threat_objective": "Sabotage"
        }
      ]
    }
  ]
}