Update parts of an RSK by numeric ID.

PATCH

/v1/risks/{id}

const url = 'https://api.adversarial.com/api/v1/risks/RSK-00001';
const options = {
  method: 'PATCH',
  headers: {'Content-Type': 'application/json'},
  body: '{"assigned_to":null,"closed_date":null,"control_statement":null,"description":null,"discovered_date":null,"expected_date":null,"impact":null,"impact_reasoning":null,"initially_reported_urgency":null,"likelihood":null,"likelihood_reasoning":null,"parent_id":null,"remediation_task":null,"source":null,"status":null,"tags":null,"threat_objectives":null,"threat_operation":null,"title":null,"type":null}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request PATCH \
  --url https://api.adversarial.com/api/v1/risks/RSK-00001 \
  --header 'Content-Type: application/json' \
  --data '{ "assigned_to": null, "closed_date": null, "control_statement": null, "description": null, "discovered_date": null, "expected_date": null, "impact": null, "impact_reasoning": null, "initially_reported_urgency": null, "likelihood": null, "likelihood_reasoning": null, "parent_id": null, "remediation_task": null, "source": null, "status": null, "tags": null, "threat_objectives": null, "threat_operation": null, "title": null, "type": null }'

Parameters

Path Parameters

required

string

The ID of the risk — RSK-00001 (case-insensitive) or a bare number

Example

RSK-00001

Request Body^required

application/json

The risk fields to change. Omitted fields are left as they are.

object

assigned_to

string | null format: uuid

closed_date

string | null format: date-time

control_statement

string | null

description

string | null

discovered_date

string | null format: date-time

expected_date

string | null format: date-time

impact

One of:

string
null

string

Allowed values: Very Low Low Medium High Severe

impact_reasoning

string | null

initially_reported_urgency

One of:

string
null

string

Allowed values: Critical High Medium Low Info

likelihood

One of:

string
null

string

Allowed values: Remote Unlikely Possible Probable Imminent

likelihood_reasoning

string | null

parent_id

Mark this risk as linked under another risk. Some(Some(id)) sets the parent; Some(None) clears it; None leaves the field untouched.

string | null

Example

RSK-00001

remediation_task

string | null

source

string | null

status

One of:

string
null

The status of a risk

string

Allowed values: New Urgency Proposed Remediation Closure Proposed Closed

tags

Array<string> | null

threat_objectives

Array<object> | null

A threat objective paired with how relevant it is to a risk.

Two relations are considered the same when the objective and its relevance match; created_date records when the relation was last changed and is not part of its identity.

object

created_date

The time that this relation was mutated

string | null format: date-time

relevance

One of:

string
null

How relevant the threat objective is. Responses always carry a relevance. In a request, null removes the objective.

string

Allowed values: Moderate Substantial

threat_objective

required

The threat objective type

string

Allowed values: Sabotage Data Disclosure Extortion Customer Targeting Resource Hijacking Fraud

threat_operation

One of:

string
null

How threat_objectives applies to the objectives the item already has. Defaults to merge. Has no effect without threat_objectives.

string

Allowed values: merge replace

title

string | null

type

One of:

string
null

string

Allowed values: Code Configuration Control Deficiency Policy Procedural Vulnerability Third-party

Responses

200

Risk updated successfully

application/json

Register row for Organization Risks (RSKs). A Risk plus the relational data shown on the risk register: threat objectives, incident associations, tags, and comment count.

object

attachments

required

Files attached to this risk, newest-first.

Array<object>

A file attached to a risk, an incident, or a comment on either.

Embedded in the attachments list of the record it is attached to, and returned when a file is uploaded to a risk or incident.

object

byte_size

File size in bytes.

integer | null format: int64

content_type

required

MIME content type.

string

created_by

The user who uploaded the file, if known. On a comment’s attachments this can differ from the comment’s author: a comment may reference a file someone else uploaded to the same record.

string | null format: uuid

created_date

required

When the file was uploaded.

string format: date-time

required

The attachment’s id; download it with GET /v1/files/{id}.

string format: uuid

name

required

Original file name as uploaded.

string

status

required

The file’s upload status. Attachments are only listed once their upload has finished, so this is always ready.

string

Allowed values: pending ready failed

comments

required

Count of comments on this risk (not the comments themselves).

integer format: int64

incident_associations

required

Array<string>

linked_children_count

required

Number of risks linked under this risk (i.e. children pointing at it). A risk is itself a linked child when risk.parent_id is set.

integer format: int64

risk

required

The core view of an Organization Risk (RSK).

Relational data — threat objectives, comments, incident associations, and tags — is exposed on RiskRegisterEntry, not here.

object

assigned_to

One of:

object
null

A User as returned by the API.

Profile images are not embedded — clients fetch them from GET /api/v1/{icon} when icon is Some.

object

email

required

string

first_name

required

string

icon

Relative path to the user’s avatar endpoint, e.g. "users/{id}/avatar?v={hash}". None when the user has no avatar.

string | null

required

string format: uuid

last_name

required

string

closed_date

string | null format: date-time

control_statement

string | null

created_date

required

string format: date-time

deleted_date

string | null format: date-time

description

required

string

discovered_date

required

string format: date-time

due_date

string | null format: date-time

expected_date

string | null format: date-time

required

string

impact

One of:

string
null

string

Allowed values: Very Low Low Medium High Severe

impact_reasoning

string | null

initially_reported_urgency

One of:

string
null

string

Allowed values: Critical High Medium Low Info

likelihood

One of:

string
null

string

Allowed values: Remote Unlikely Possible Probable Imminent

likelihood_reasoning

string | null

opened_by

required

A User as returned by the API.

Profile images are not embedded — clients fetch them from GET /api/v1/{icon} when icon is Some.

object

email

required

string

first_name

required

string

icon

Relative path to the user’s avatar endpoint, e.g. "users/{id}/avatar?v={hash}". None when the user has no avatar.

string | null

required

string format: uuid

last_name

required

string

parent_id

When set, this risk is linked under the named parent risk.

string | null

remediation_task

string | null

source

string | null

status

required

The status of a risk

string

Allowed values: New Urgency Proposed Remediation Closure Proposed Closed

title

required

string

type

required

string

Allowed values: Code Configuration Control Deficiency Policy Procedural Vulnerability Third-party

updated_by

required

A User as returned by the API.

Profile images are not embedded — clients fetch them from GET /api/v1/{icon} when icon is Some.

object

email

required

string

first_name

required

string

icon

Relative path to the user’s avatar endpoint, e.g. "users/{id}/avatar?v={hash}". None when the user has no avatar.

string | null

required

string format: uuid

last_name

required

string

updated_date

required

string format: date-time

urgency

One of:

string
null

Derived from likelihood and impact. Null when either is missing.

string

Allowed values: Info Low Medium High Critical

tags

required

Array<object>

object

content

required

string

creator_id

required

string format: uuid

required

string format: uuid

org_id

string | null format: uuid

threat_objectives

required

Array<object>

A threat objective paired with how relevant it is to a risk.

Two relations are considered the same when the objective and its relevance match; created_date records when the relation was last changed and is not part of its identity.

object

created_date

The time that this relation was mutated

string | null format: date-time

relevance

One of:

string
null

How relevant the threat objective is. Responses always carry a relevance. In a request, null removes the objective.

string

Allowed values: Moderate Substantial

threat_objective

required

The threat objective type

string

Allowed values: Sabotage Data Disclosure Extortion Customer Targeting Resource Hijacking Fraud

Example

{
  "attachments": [
    {
      "status": "pending"
    }
  ],
  "incident_associations": "INC-00001",
  "risk": {
    "id": "RSK-00001",
    "impact": "Very Low",
    "initially_reported_urgency": "Critical",
    "likelihood": "Remote",
    "parent_id": "RSK-00001",
    "status": "New",
    "type": "Code",
    "urgency": "Info"
  },
  "threat_objectives": [
    {
      "relevance": "Moderate",
      "threat_objective": "Sabotage"
    }
  ]
}

400

Validation failed (e.g. empty payload, unknown source, inactive assignee)

404

Risk not found

422

Invalid parent link (self-link, cycle, multi-layer nesting, or deleted parent)

Update parts of an RSK by numeric ID.

Parameters

Path Parameters

Example

Request Bodyrequired

Example

Responses

200

Example

400

404

422

Request Body^required