Update many incident's editable fields, given a list of incident IDs
const url = 'https://api.adversarial.com/api/v1/incidents';const options = { method: 'PATCH', headers: {'Content-Type': 'application/json'}, body: '{"title":null,"description":null,"severity":null,"severity_reasoning":null,"source":null,"status":null,"detected_date":null,"assigned_to":null,"occurred_date":null,"responded_date":null,"contained_date":null,"threat_objectives":null,"tags":null,"parent_id":null,"ids":[],"tag_operation":null}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request PATCH \ --url https://api.adversarial.com/api/v1/incidents \ --header 'Content-Type: application/json' \ --data '{ "title": null, "description": null, "severity": null, "severity_reasoning": null, "source": null, "status": null, "detected_date": null, "assigned_to": null, "occurred_date": null, "responded_date": null, "contained_date": null, "threat_objectives": null, "tags": null, "parent_id": null, "ids": [], "tag_operation": null }'Request Bodyrequired
Section titled “Request Bodyrequired”object
The incident fields to change. Omitted fields are left as they are.
object
Mark this incident as linked under another incident. Some(Some(id))
sets the parent; Some(None) clears it; None leaves it untouched.
Example
INC-00001A threat objective paired with how relevant it is to a risk.
Two relations are considered the same when the objective and its relevance
match; created_date records when the relation was last changed and is not
part of its identity.
object
The time that this relation was mutated
The threat objective type
Example
INC-00001Responses
Section titled “Responses”Incidents updated
object
Register row for an Incident. An Incident plus the relational data shown on
the incident register: risk associations, threat objectives, tags, and comment count.
object
Relationship, core incident information
object
A User as returned by the API.
Profile images are not embedded — clients fetch them from
GET /api/v1/{icon} when icon is Some.
object
Relative path to the user’s avatar endpoint, e.g.
"users/{id}/avatar?v={hash}". None when the user has no avatar.
A User as returned by the API.
Profile images are not embedded — clients fetch them from
GET /api/v1/{icon} when icon is Some.
object
Relative path to the user’s avatar endpoint, e.g.
"users/{id}/avatar?v={hash}". None when the user has no avatar.
When set, this incident is linked under the named parent incident.
Where the incident was reported from (e.g. “Employee Reported”). Always present.
The status of an incident
A User as returned by the API.
Profile images are not embedded — clients fetch them from
GET /api/v1/{icon} when icon is Some.
object
Relative path to the user’s avatar endpoint, e.g.
"users/{id}/avatar?v={hash}". None when the user has no avatar.
Number of incidents linked under this incident (i.e. children pointing at it).
An incident is itself a linked child when incident.parent_id is set.
object
A threat objective paired with how relevant it is to a risk.
Two relations are considered the same when the objective and its relevance
match; created_date records when the relation was last changed and is not
part of its identity.
object
The time that this relation was mutated
The threat objective type
Example
{ "incidents": [ { "incident": { "id": "INC-00001", "parent_id": "INC-00001", "severity": "SEV-5", "status": "New" }, "threat_objectives": [ { "relevance": "Moderate", "threat_objective": "Sabotage" } ] } ]}Validation failed (e.g. empty payload, unknown source, inactive assignee)
Not found
Invalid parent link (self-link, cycle, multi-layer nesting, or deleted parent)