Build project report
const url = 'https://example.com/api/v1/org/example/ws/example/airt/projects/example/reports/build';const options = { method: 'POST', headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'}, body: '{"preset":{"branding":{"company_name":"example","confidentiality_footer":"example","logo_oid":"example","report_title":"example"},"compliance_frameworks":["owasp_llm_top_10"],"filters":{"assessment_ids":["2489E9AD-2EE2-8E00-8EC9-32D5F69181C0"],"attack_name":["example"],"category":["example"],"finding_type":["jailbreak"],"include_undated_assessments":false,"min_score":1,"severity":["critical"],"started_after":"2026-04-15T12:00:00Z","started_before":"2026-04-15T12:00:00Z"},"format":"pdf","include_adversarial":false,"sections":["risk_score_metrics"],"style":{"font":"Helvetica","font_size":11}},"template_id":"2489E9AD-2EE2-8E00-8EC9-32D5F69181C0"}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://example.com/api/v1/org/example/ws/example/airt/projects/example/reports/build \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: application/json' \ --data '{ "preset": { "branding": { "company_name": "example", "confidentiality_footer": "example", "logo_oid": "example", "report_title": "example" }, "compliance_frameworks": [ "owasp_llm_top_10" ], "filters": { "assessment_ids": [ "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0" ], "attack_name": [ "example" ], "category": [ "example" ], "finding_type": [ "jailbreak" ], "include_undated_assessments": false, "min_score": 1, "severity": [ "critical" ], "started_after": "2026-04-15T12:00:00Z", "started_before": "2026-04-15T12:00:00Z" }, "format": "pdf", "include_adversarial": false, "sections": [ "risk_score_metrics" ], "style": { "font": "Helvetica", "font_size": 11 } }, "template_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0" }'Start an async report-build job. Returns 202 with a job id to poll until the rendered artifact’s signed URL is available. Returns 422 synchronously when any selected section resolves to zero rows — preflight the request via the preflight endpoint to avoid the round-trip.
Authorizations
Section titled “Authorizations”Parameters
Section titled “ Parameters ”Path Parameters
Section titled “Path Parameters”Organization slug
Organization slug
Workspace slug
Workspace slug
Project slug or UUID
Project slug or UUID
Request Bodyrequired
Section titled “Request Bodyrequired”Payload for the (future) POST /airt/projects/{project}/reports/build.
Exactly one of preset (inline) or template_id (stored template).
object
Simple AIRT-report request — what the frontend POSTs for template create
or inline build. Server expands to ReportTemplateSchema via
build_airt_components.
object
Optional branding slots. Expanded into Header/Footer/Title by the preset builder. Frontend-facing only — no direct DreadReport equivalent, but the expansion produces DreadReport-valid components.
Filter over findings rows. All strings untrusted.
Scope: these fields narrow the findings table rows only. Report-wide assessment scoping (narrow ASR / severity / metrics sections by the same assessment subset) is a follow-up — see ENG-6432 PR description. For Phase 1 the UI-surfaced assessment/date filters apply only to the findings table component.
object
Document-wide style. Mirrors DreadReport.style() — font, font_size.
Fonts locked to the ReportLab built-in set (no file I/O at render time).
object
Responses
Section titled “ Responses ”Successful Response
Shape returned by POST .../reports/build and GET .../reports/build/{id}.
presigned_url / url_expires_at / file_size_bytes populate only after
status == COMPLETED. error_message populates only on FAILED. The
empty_sections error is a separate 422 response — those never transit
through this model.
object
Lifecycle states for an async report-build job.
Example
{ "file_size_bytes": 0, "status": "queued"}Invalid request
Canonical API error envelope returned by the API.
object
HTTP status code
Human-readable error message
object
Where the validation error occurred
Human-readable validation message
Machine-readable validation error type
Stable machine-readable error type
Example
{ "code": 401, "detail": "Authentication failed", "type": "authentication_error"}Authentication failed
Canonical API error envelope returned by the API.
object
HTTP status code
Human-readable error message
object
Where the validation error occurred
Human-readable validation message
Machine-readable validation error type
Stable machine-readable error type
Example
{ "code": 401, "detail": "Authentication failed", "type": "authentication_error"}Access forbidden
Canonical API error envelope returned by the API.
object
HTTP status code
Human-readable error message
object
Where the validation error occurred
Human-readable validation message
Machine-readable validation error type
Stable machine-readable error type
Example
{ "code": 401, "detail": "Authentication failed", "type": "authentication_error"}Not found
Canonical API error envelope returned by the API.
object
HTTP status code
Human-readable error message
object
Where the validation error occurred
Human-readable validation message
Machine-readable validation error type
Stable machine-readable error type
Example
{ "code": 401, "detail": "Authentication failed", "type": "authentication_error"}Already exists
Canonical API error envelope returned by the API.
object
HTTP status code
Human-readable error message
object
Where the validation error occurred
Human-readable validation message
Machine-readable validation error type
Stable machine-readable error type
Example
{ "code": 401, "detail": "Authentication failed", "type": "authentication_error"}One or more selected report sections have no data.
Shared shape for both the Build 422 body and the Preflight 200 body.
One schema, two paths: the UI consumes the same structure whether the empty-check fires synchronously at build time or proactively via preflight before the user clicks Build.
object
One offending section in an empty-sections response.
key is the AirtSectionPreset checkbox identifier when the section came
from a preset request. Template-authored sections have no preset origin;
key is None there and the frontend falls back to title.
Example
{ "detail": "One or more selected report sections have no data.", "empty_sections": [ { "key": "risk_score_metrics" } ]}Upgrade required
Canonical API error envelope returned by the API.
object
HTTP status code
Human-readable error message
object
Where the validation error occurred
Human-readable validation message
Machine-readable validation error type
Stable machine-readable error type
Example
{ "code": 401, "detail": "Authentication failed", "type": "authentication_error"}Rate limited
Canonical API error envelope returned by the API.
object
HTTP status code
Human-readable error message
object
Where the validation error occurred
Human-readable validation message
Machine-readable validation error type
Stable machine-readable error type
Example
{ "code": 401, "detail": "Authentication failed", "type": "authentication_error"}Internal server error
Canonical API error envelope returned by the API.
object
HTTP status code
Human-readable error message
object
Where the validation error occurred
Human-readable validation message
Machine-readable validation error type
Stable machine-readable error type
Example
{ "code": 401, "detail": "Authentication failed", "type": "authentication_error"}Bad gateway
Canonical API error envelope returned by the API.
object
HTTP status code
Human-readable error message
object
Where the validation error occurred
Human-readable validation message
Machine-readable validation error type
Stable machine-readable error type
Example
{ "code": 401, "detail": "Authentication failed", "type": "authentication_error"}Gateway timeout
Canonical API error envelope returned by the API.
object
HTTP status code
Human-readable error message
object
Where the validation error occurred
Human-readable validation message
Machine-readable validation error type
Stable machine-readable error type
Example
{ "code": 401, "detail": "Authentication failed", "type": "authentication_error"}