Skip to content
adversarial

Update many incident's editable fields, given a list of incident IDs

PATCH
/v1/incidents
curl --request PATCH \
  --url https://api.adversarial.com/api/v1/incidents \
  --header 'Content-Type: application/json' \
  --data '{ "title": null, "description": null, "severity": null, "severity_reasoning": null, "source": null, "status": null, "detected_date": null, "assigned_to": null, "occurred_date": null, "responded_date": null, "contained_date": null, "threat_objectives": null, "threat_operation": null, "tags": null, "parent_id": null, "ids": [], "tag_operation": null }'

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
object
assigned_to
string | null format: uuid
contained_date
string | null format: date-time
description
string | null
detected_date
string | null format: date-time
occurred_date
string | null format: date-time
parent_id

Mark this incident as linked under another incident. Some(Some(id)) sets the parent; Some(None) clears it; None leaves it untouched.

string | null
Example
INC-00001
responded_date
string | null format: date-time
severity
One of:
string
Allowed values: SEV-5 SEV-4 SEV-3 SEV-2 SEV-1
severity_reasoning
string | null
source
string | null
status
One of:

The status of an incident

string
Allowed values: New In Progress Review Closed
tags
Array<string> | null
threat_objectives
Array<object> | null

A threat objective paired with how relevant it is to a risk.

Two relations are considered the same when the objective and its relevance match; created_date records when the relation was last changed and is not part of its identity.

object
created_date

The time that this relation was mutated

string | null format: date-time
relevance
One of:

How relevant the threat objective is. Responses always carry a relevance. In a request, null removes the objective.

string
Allowed values: Moderate Substantial
threat_objective
required

The threat objective type

string
Allowed values: Sabotage Data Disclosure Extortion Customer Targeting Resource Hijacking Fraud
threat_operation
One of:

How threat_objectives applies to the objectives the item already has. Defaults to merge. Has no effect without threat_objectives.

string
Allowed values: merge replace
title
string | null
ids
Array<string>
default:
Example
INC-00001
tag_operation
One of:
string
Allowed values: no-change add replace find-remove remove-all

Responses

Section titled “Responses”

200

Section titled “200”

Incidents updated

Media typeapplication/json
object
incidents
required
Array<object>

Register row for an Incident. An Incident plus the relational data shown on the incident register: risk associations, threat objectives, tags, and comment count.

object
attachments
required

Files attached to this incident, newest-first.

Array<object>

A file attached to a risk, an incident, or a comment on either.

Embedded in the attachments list of the record it is attached to, and returned when a file is uploaded to a risk or incident.

object
byte_size

File size in bytes.

integer | null format: int64
content_type
required

MIME content type.

string
created_by

The user who uploaded the file, if known. On a comment’s attachments this can differ from the comment’s author: a comment may reference a file someone else uploaded to the same record.

string | null format: uuid
created_date
required

When the file was uploaded.

string format: date-time
id
required

The attachment’s id; download it with GET /v1/files/{id}.

string format: uuid
name
required

Original file name as uploaded.

string
status
required

The file’s upload status. Attachments are only listed once their upload has finished, so this is always ready.

string
Allowed values: pending ready failed
comment_count
required
integer format: int64
incident
required

Relationship, core incident information

object
assigned_to
One of:

A User as returned by the API.

Profile images are not embedded — clients fetch them from GET /api/v1/{icon} when icon is Some.

object
email
required
string
first_name
required
string
icon

Relative path to the user’s avatar endpoint, e.g. "users/{id}/avatar?v={hash}". None when the user has no avatar.

string | null
id
required
string format: uuid
last_name
required
string
contained_date
string | null format: date-time
created_date
required
string format: date-time
description
required
string
detected_date
required
string format: date-time
id
required
string
occurred_date
string | null format: date-time
opened_by
required

A User as returned by the API.

Profile images are not embedded — clients fetch them from GET /api/v1/{icon} when icon is Some.

object
email
required
string
first_name
required
string
icon

Relative path to the user’s avatar endpoint, e.g. "users/{id}/avatar?v={hash}". None when the user has no avatar.

string | null
id
required
string format: uuid
last_name
required
string
parent_id

When set, this incident is linked under the named parent incident.

string | null
responded_date
string | null format: date-time
severity
One of:
string
Allowed values: SEV-5 SEV-4 SEV-3 SEV-2 SEV-1
severity_reasoning
string | null
source
required

Where the incident was reported from (e.g. “Employee Reported”). Always present.

string
status
required

The status of an incident

string
Allowed values: New In Progress Review Closed
title
required
string
updated_by
required

A User as returned by the API.

Profile images are not embedded — clients fetch them from GET /api/v1/{icon} when icon is Some.

object
email
required
string
first_name
required
string
icon

Relative path to the user’s avatar endpoint, e.g. "users/{id}/avatar?v={hash}". None when the user has no avatar.

string | null
id
required
string format: uuid
last_name
required
string
updated_date
required
string format: date-time
linked_children_count
required

Number of incidents linked under this incident (i.e. children pointing at it). An incident is itself a linked child when incident.parent_id is set.

integer format: int64
risk_associations
required
Array<string>
tags
required
Array<object>
object
content
required
string
creator_id
required
string format: uuid
id
required
string format: uuid
org_id
string | null format: uuid
threat_objectives
required
Array<object>

A threat objective paired with how relevant it is to a risk.

Two relations are considered the same when the objective and its relevance match; created_date records when the relation was last changed and is not part of its identity.

object
created_date

The time that this relation was mutated

string | null format: date-time
relevance
One of:

How relevant the threat objective is. Responses always carry a relevance. In a request, null removes the objective.

string
Allowed values: Moderate Substantial
threat_objective
required

The threat objective type

string
Allowed values: Sabotage Data Disclosure Extortion Customer Targeting Resource Hijacking Fraud
Example
{
  "incidents": [
    {
      "attachments": [
        {
          "status": "pending"
        }
      ],
      "incident": {
        "id": "INC-00001",
        "parent_id": "INC-00001",
        "severity": "SEV-5",
        "status": "New"
      },
      "threat_objectives": [
        {
          "relevance": "Moderate",
          "threat_objective": "Sabotage"
        }
      ]
    }
  ]
}

400

Section titled “400”

Validation failed (e.g. empty payload, unknown source, inactive assignee)

404

Section titled “404”

Not found

422

Section titled “422”

Invalid parent link (self-link, cycle, multi-layer nesting, or deleted parent)