List incidents with associated components for the incident register

GET

/v1/incidents

const url = 'https://api.adversarial.com/api/v1/incidents?created_after=2026-01-01T00%3A00%3A00Z&created_before=2026-12-31T23%3A59%3A59Z&updated_after=2026-01-01T00%3A00%3A00Z&updated_before=2026-12-31T23%3A59%3A59Z&detected_after=2026-01-01T00%3A00%3A00Z&detected_before=2026-12-31T23%3A59%3A59Z&occurred_after=2026-01-01T00%3A00%3A00Z&occurred_before=2026-12-31T23%3A59%3A59Z&responded_after=2026-01-01T00%3A00%3A00Z&responded_before=2026-12-31T23%3A59%3A59Z&contained_after=2026-01-01T00%3A00%3A00Z&contained_before=2026-12-31T23%3A59%3A59Z&page=1&page_size=50';
const options = {method: 'GET'};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url 'https://api.adversarial.com/api/v1/incidents?created_after=2026-01-01T00%3A00%3A00Z&created_before=2026-12-31T23%3A59%3A59Z&updated_after=2026-01-01T00%3A00%3A00Z&updated_before=2026-12-31T23%3A59%3A59Z&detected_after=2026-01-01T00%3A00%3A00Z&detected_before=2026-12-31T23%3A59%3A59Z&occurred_after=2026-01-01T00%3A00%3A00Z&occurred_before=2026-12-31T23%3A59%3A59Z&responded_after=2026-01-01T00%3A00%3A00Z&responded_before=2026-12-31T23%3A59%3A59Z&contained_after=2026-01-01T00%3A00%3A00Z&contained_before=2026-12-31T23%3A59%3A59Z&page=1&page_size=50'

Parameters

Query Parameters

Array<string> | null

Return only these incidents. Accepts INC-<n> or a bare number, matching parent_id / child_id and the risk register’s id.

title_contains

string | null

description_contains

string | null

free_text

string | null

id_contains

string | null

severity

Array | null

status

Array<string> | null

Allowed values: New In Progress Review Closed

source

Array<string> | null

assigned_to

Array | null

Accepts UUIDs, the literal null (unassigned), and the sentinel me (the calling user, resolved server-side). Multiple values union.

mentioned

Array | null

Incidents with at least one live comment that @-mentions the given user. Accepts UUIDs, the sentinel me (the calling user, resolved server-side), and the literal null (no comment mentions anyone). Multiple values union — e.g. mentioned=me&mentioned=null returns incidents that mention you plus incidents that mention nobody.

threat_objectives

Array | null

created_after

string | null format: date-time

Inclusive lower bound on created_date. RFC 3339 or bare YYYY-MM-DD.

Example

2026-01-01T00:00:00Z

created_before

string | null format: date-time

Inclusive upper bound on created_date. RFC 3339 or bare YYYY-MM-DD.

Example

2026-12-31T23:59:59Z

updated_after

string | null format: date-time

Inclusive lower bound on updated_date. RFC 3339 or bare YYYY-MM-DD.

Example

2026-01-01T00:00:00Z

updated_before

string | null format: date-time

Inclusive upper bound on updated_date. RFC 3339 or bare YYYY-MM-DD.

Example

2026-12-31T23:59:59Z

detected_after

string | null format: date-time

Inclusive lower bound on detected_date. RFC 3339 or bare YYYY-MM-DD.

Example

2026-01-01T00:00:00Z

detected_before

string | null format: date-time

Inclusive upper bound on detected_date. RFC 3339 or bare YYYY-MM-DD.

Example

2026-12-31T23:59:59Z

occurred_after

string | null format: date-time

Inclusive lower bound on occurred_date. RFC 3339 or bare YYYY-MM-DD.

Example

2026-01-01T00:00:00Z

occurred_before

string | null format: date-time

Inclusive upper bound on occurred_date. RFC 3339 or bare YYYY-MM-DD.

Example

2026-12-31T23:59:59Z

occurred_is_null

boolean | null

Match only incidents whose occurred_date is unset. Mutually exclusive with occurred_after/occurred_before.

responded_after

string | null format: date-time

Inclusive lower bound on responded_date. RFC 3339 or bare YYYY-MM-DD.

Example

2026-01-01T00:00:00Z

responded_before

string | null format: date-time

Inclusive upper bound on responded_date. RFC 3339 or bare YYYY-MM-DD.

Example

2026-12-31T23:59:59Z

responded_is_null

boolean | null

Match only incidents whose responded_date is unset. Mutually exclusive with responded_after/responded_before.

contained_after

string | null format: date-time

Inclusive lower bound on contained_date. RFC 3339 or bare YYYY-MM-DD.

Example

2026-01-01T00:00:00Z

contained_before

string | null format: date-time

Inclusive upper bound on contained_date. RFC 3339 or bare YYYY-MM-DD.

Example

2026-12-31T23:59:59Z

contained_is_null

boolean | null

Match only incidents whose contained_date is unset. Mutually exclusive with contained_after/contained_before.

opened_by

Array | null

updated_by

Array | null

tags

Array | null

parent_id

Array | null

Filter on what an incident is linked under. Accepts the literal null (top-level incidents), the literal any (only incidents linked under a parent), or a parent id as INC-<n> or a bare number. Repeat the parameter to union — ?parent_id=null&parent_id=any is every incident.

Defaults to null, so registers and rollups list top-level records only. An explicit JSON null on the body path reads as that same default, not as “no filter”.

child_id

Array | null

Filter on what is linked under an incident. Accepts the literal any (incidents with at least one non-deleted child — the “Parent Incidents Only” quick filter), the literal null (incidents with no children), or a child id as INC-<n> or a bare number (that child’s parent). Repeat to union. Omit to leave the filter off.

Because links are single-layer, every parent is top-level, so this composes with the default parent_id=null register view.

page

integer format: int64

default: 1 >= 1 <= 1000000

1-indexed page number. Defaults to 1 (explicit null reads as the default); zero is rejected.

page_size

integer format: int64

default: 50 >= 1 <= 500

Rows per page. Defaults to 50 (explicit null reads as the default); zero is rejected.

order_by

string | null

Responses

200

List incidents

application/json

Paginated list envelope: { "results": [...], "pagination": {...} }.

object

pagination

required

Pagination metadata describing the slice.

object

page

required

1-indexed page number of this result slice.

integer format: int64

page_size

required

Number of items requested per page.

integer format: int64

total_items

required

Total number of matching items across all pages.

integer format: int64

total_pages

required

Total number of pages at this page size.

integer format: int64

results

required

The items on this page.

Array<object>

Register row for an Incident. An Incident plus the relational data shown on the incident register: risk associations, threat objectives, tags, and comment count.

object

comment_count

required

integer format: int64

incident

required

Relationship, core incident information

object

assigned_to

One of:

null
object

null

A User as returned by the API.

Profile images are not embedded — clients fetch them from GET /api/v1/{icon} when icon is Some.

object

email

required

string

first_name

required

string

icon

Relative path to the user’s avatar endpoint, e.g. "users/{id}/avatar?v={hash}". None when the user has no avatar.

string | null

required

string format: uuid

last_name

required

string

contained_date

string | null format: date-time

created_date

required

string format: date-time

description

required

string

detected_date

required

string format: date-time

required

string

occurred_date

string | null format: date-time

opened_by

required

A User as returned by the API.

Profile images are not embedded — clients fetch them from GET /api/v1/{icon} when icon is Some.

object

email

required

string

first_name

required

string

icon

Relative path to the user’s avatar endpoint, e.g. "users/{id}/avatar?v={hash}". None when the user has no avatar.

string | null

required

string format: uuid

last_name

required

string

parent_id

When set, this incident is linked under the named parent incident.

string | null

responded_date

string | null format: date-time

severity

One of:

null
string

null

severity_reasoning

string | null

source

required

Where the incident was reported from (e.g. “Employee Reported”). Always present.

string

status

required

The status of an incident

string

Allowed values: New In Progress Review Closed

title

required

string

updated_by

required

A User as returned by the API.

Profile images are not embedded — clients fetch them from GET /api/v1/{icon} when icon is Some.

object

email

required

string

first_name

required

string

icon

Relative path to the user’s avatar endpoint, e.g. "users/{id}/avatar?v={hash}". None when the user has no avatar.

string | null

required

string format: uuid

last_name

required

string

updated_date

required

string format: date-time

linked_children_count

required

Number of incidents linked under this incident (i.e. children pointing at it). An incident is itself a linked child when incident.parent_id is set.

integer format: int64

risk_associations

required

Array<string>

tags

required

Array<object>

object

content

required

string

creator_id

required

string format: uuid

required

string format: uuid

org_id

string | null format: uuid

threat_objectives

required

Array<object>

A threat objective paired with how relevant it is to a risk.

Two relations are considered the same when the objective and its relevance match; created_date records when the relation was last changed and is not part of its identity.

object

created_date

The time that this relation was mutated

string | null format: date-time

relevance

One of:

null
string

null

threat_objective

required

The threat objective type

string

Allowed values: Sabotage Data Disclosure Extortion Customer Targeting Resource Hijacking Fraud

Example

{
  "results": [
    {
      "incident": {
        "id": "INC-00001",
        "parent_id": "INC-00001",
        "severity": "SEV-5",
        "status": "New"
      },
      "threat_objectives": [
        {
          "relevance": "Moderate",
          "threat_objective": "Sabotage"
        }
      ]
    }
  ]
}