Skip to content
Dreadnode Dreadnode Dreadnode

Create report template

POST
/api/v1/org/{org}/ws/{workspace}/airt/projects/{project}/templates
 
curl --request POST \
  --url https://example.com/api/v1/org/example/ws/example/airt/projects/example/templates \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "config": { "components": [ { "content": "example", "id": "example", "instructions": "example", "type": "title" } ], "format": "pdf", "schema_version": 1, "style": { "font": "Helvetica", "font_size": 11 } }, "description": "example", "name": "example", "preset": { "branding": { "company_name": "example", "confidentiality_footer": "example", "logo_oid": "example", "report_title": "example" }, "compliance_frameworks": [ "owasp_llm_top_10" ], "filters": { "assessment_ids": [ "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0" ], "attack_name": [ "example" ], "category": [ "example" ], "finding_type": [ "jailbreak" ], "include_undated_assessments": false, "min_score": 1, "severity": [ "critical" ], "started_after": "2026-04-15T12:00:00Z", "started_before": "2026-04-15T12:00:00Z" }, "format": "pdf", "include_adversarial": false, "sections": [ "risk_score_metrics" ], "style": { "font": "Helvetica", "font_size": 11 } } }'

Create a saved report template. Supply preset (server expands it to a component tree) XOR config (frontend-authored tree). Returns 409 if the project already has the per-project cap of templates or if name is already in use in this project.

Authorizations

Section titled “Authorizations ”

Parameters

Section titled “ Parameters ”

Path Parameters

Section titled “Path Parameters ”
org
required
Org

Organization slug

string

Organization slug

workspace
required
Workspace

Workspace slug

string

Workspace slug

project
required
Project

Project slug or UUID

string

Project slug or UUID

Request Body required

Section titled “Request Body required ”
Media type application/json
CreateTemplateRequest

Request body for POST .../templates.

Exactly one of preset (server expands to component tree) or config (advanced path — caller supplies the component tree directly).

object
config
Any of:
ReportTemplateSchema

Shape stored inside airt_report_templates.config (JSONB).

Directly maps to a DreadReport invocation: DreadReport(*components).style(**style.model_dump()).to_()

object
components
required
Components
Array
>= 1 items <= 200 items
One of: discriminator: type
TextComponent

Text-bearing component. Covers DreadReport Title, Authors, Text.

Exactly one of content (static) or instructions (AI-writer prompt) must be set. MVP renderer ignores instructions and will error on any component that relies on it — full support lands with the DreadReport adapter (see ENG-6485).

object
content
Any of:
string
<= 5000 characters
id
Id
string
instructions
Any of:
string
<= 5000 characters
type
required
Type
string
Allowed values: title authors text
format
Format
string
default: pdf
Allowed values: pdf docx csv
schema_version
Schema Version
integer
default: 1
Allowed value: 1
style
StyleConfig

Document-wide style. Mirrors DreadReport.style() — font, font_size.

Fonts locked to the ReportLab built-in set (no file I/O at render time).

object
font
Font
string
default: Helvetica
Allowed values: Helvetica Times-Roman Courier
font_size
Font Size
integer
default: 11 >= 8 <= 24
description
Any of:
string
<= 2000 characters
name
required
Name
string
>= 1 characters <= 255 characters
preset
Any of:
AirtPresetRequest

Simple AIRT-report request — what the frontend POSTs for template create or inline build. Server expands to ReportTemplateSchema via build_airt_components.

object
branding
Any of:
BrandingOverrides

Optional branding slots. Expanded into Header/Footer/Title by the preset builder. Frontend-facing only — no direct DreadReport equivalent, but the expansion produces DreadReport-valid components.

object
company_name
Any of:
string
>= 1 characters <= 255 characters
confidentiality_footer
Any of:
string
<= 500 characters
logo_oid
Any of:
string
/^[A-Za-z0-9._\-/]{1,256}$/
report_title
Any of:
string
>= 1 characters <= 255 characters
compliance_frameworks
Compliance Frameworks
Array<string>
<= 5 items
Allowed values: owasp_llm_top_10 owasp_agentic_top_10 mitre_atlas nist_ai_rmf google_saif
filters
Any of:
FindingsFilter

Filter over findings rows. All strings untrusted.

Scope: these fields narrow the findings table rows only. Report-wide assessment scoping (narrow ASR / severity / metrics sections by the same assessment subset) is a follow-up — see ENG-6432 PR description. For Phase 1 the UI-surfaced assessment/date filters apply only to the findings table component.

object
assessment_ids
Any of:
Array<string>
<= 100 items
attack_name
Any of:
Array<string>
<= 100 items
category
Any of:
Array<string>
<= 100 items
finding_type
Any of:
Array<string>
<= 7 items
Allowed values: jailbreak partial refusal error evasion degradation robust
include_undated_assessments
Include Undated Assessments
boolean
min_score
Any of:
number
<= 1
severity
Any of:
Array<string>
<= 5 items
Allowed values: critical high medium low info
started_after
Any of:
string format: date-time
started_before
Any of:
string format: date-time
format
Format
string
default: pdf
Allowed values: pdf docx csv
include_adversarial
Include Adversarial
boolean
sections
required
Sections
Array<string>
>= 1 items <= 8 items
Allowed values: risk_score_metrics severity_breakdown findings_table asr_by_attack asr_by_category transform_effectiveness compliance_coverage models_used
style
StyleConfig

Document-wide style. Mirrors DreadReport.style() — font, font_size.

Fonts locked to the ReportLab built-in set (no file I/O at render time).

object
font
Font
string
default: Helvetica
Allowed values: Helvetica Times-Roman Courier
font_size
Font Size
integer
default: 11 >= 8 <= 24

Responses

Section titled “ Responses ”

201

Section titled “201 ”

Successful Response

Media type application/json
ReportTemplateResponse

API response shape for a saved report template.

preset is derived best-effort from config via derive_preset_from_components. It’s None for templates authored via raw config= rather than a preset (no SectionComponent.preset_key tags to read). The Phase 2 frontend uses preset to back-fill the form when a saved template is selected.

object
branding_logo_oid
required
Any of:
string
config
required
ReportTemplateSchema

Shape stored inside airt_report_templates.config (JSONB).

Directly maps to a DreadReport invocation: DreadReport(*components).style(**style.model_dump()).to_()

object
components
required
Components
Array
>= 1 items <= 200 items
One of: discriminator: type
TextComponent

Text-bearing component. Covers DreadReport Title, Authors, Text.

Exactly one of content (static) or instructions (AI-writer prompt) must be set. MVP renderer ignores instructions and will error on any component that relies on it — full support lands with the DreadReport adapter (see ENG-6485).

object
content
Any of:
string
<= 5000 characters
id
Id
string
instructions
Any of:
string
<= 5000 characters
type
required
Type
string
Allowed values: title authors text
format
Format
string
default: pdf
Allowed values: pdf docx csv
schema_version
Schema Version
integer
default: 1
Allowed value: 1
style
StyleConfig

Document-wide style. Mirrors DreadReport.style() — font, font_size.

Fonts locked to the ReportLab built-in set (no file I/O at render time).

object
font
Font
string
default: Helvetica
Allowed values: Helvetica Times-Roman Courier
font_size
Font Size
integer
default: 11 >= 8 <= 24
created_at
required
Created At
string format: date-time
created_by
required
Created By
string format: uuid
description
required
Any of:
string
id
required
Id
string format: uuid
name
required
Name
string
organization_id
required
Organization Id
string format: uuid
preset
Any of:
AirtPresetRequest

Simple AIRT-report request — what the frontend POSTs for template create or inline build. Server expands to ReportTemplateSchema via build_airt_components.

object
branding
Any of:
BrandingOverrides

Optional branding slots. Expanded into Header/Footer/Title by the preset builder. Frontend-facing only — no direct DreadReport equivalent, but the expansion produces DreadReport-valid components.

object
company_name
Any of:
string
>= 1 characters <= 255 characters
confidentiality_footer
Any of:
string
<= 500 characters
logo_oid
Any of:
string
/^[A-Za-z0-9._\-/]{1,256}$/
report_title
Any of:
string
>= 1 characters <= 255 characters
compliance_frameworks
Compliance Frameworks
Array<string>
<= 5 items
Allowed values: owasp_llm_top_10 owasp_agentic_top_10 mitre_atlas nist_ai_rmf google_saif
filters
Any of:
FindingsFilter

Filter over findings rows. All strings untrusted.

Scope: these fields narrow the findings table rows only. Report-wide assessment scoping (narrow ASR / severity / metrics sections by the same assessment subset) is a follow-up — see ENG-6432 PR description. For Phase 1 the UI-surfaced assessment/date filters apply only to the findings table component.

object
assessment_ids
Any of:
Array<string>
<= 100 items
attack_name
Any of:
Array<string>
<= 100 items
category
Any of:
Array<string>
<= 100 items
finding_type
Any of:
Array<string>
<= 7 items
Allowed values: jailbreak partial refusal error evasion degradation robust
include_undated_assessments
Include Undated Assessments
boolean
min_score
Any of:
number
<= 1
severity
Any of:
Array<string>
<= 5 items
Allowed values: critical high medium low info
started_after
Any of:
string format: date-time
started_before
Any of:
string format: date-time
format
Format
string
default: pdf
Allowed values: pdf docx csv
include_adversarial
Include Adversarial
boolean
sections
required
Sections
Array<string>
>= 1 items <= 8 items
Allowed values: risk_score_metrics severity_breakdown findings_table asr_by_attack asr_by_category transform_effectiveness compliance_coverage models_used
style
StyleConfig

Document-wide style. Mirrors DreadReport.style() — font, font_size.

Fonts locked to the ReportLab built-in set (no file I/O at render time).

object
font
Font
string
default: Helvetica
Allowed values: Helvetica Times-Roman Courier
font_size
Font Size
integer
default: 11 >= 8 <= 24
project_id
required
Project Id
string format: uuid
updated_at
required
Updated At
string format: date-time
workspace_id
required
Workspace Id
string format: uuid
Example 
{
  "config": {
    "components": [
      {
        "type": "title"
      }
    ],
    "format": "pdf",
    "schema_version": 1,
    "style": {
      "font": "Helvetica",
      "font_size": 11
    }
  },
  "preset": {
    "compliance_frameworks": [
      "owasp_llm_top_10"
    ],
    "filters": {
      "finding_type": [
        "jailbreak"
      ],
      "include_undated_assessments": false,
      "severity": [
        "critical"
      ]
    },
    "format": "pdf",
    "include_adversarial": false,
    "sections": [
      "risk_score_metrics"
    ],
    "style": {
      "font": "Helvetica",
      "font_size": 11
    }
  }
}

400

Section titled “400 ”

Invalid request

Media type application/json
APIErrorPayload

Canonical API error envelope returned by the API.

object
code
required
Code

HTTP status code

integer
Allowed values: 400 401 403 404 409 422 426 429 500 502 504
detail
required
Detail

Human-readable error message

string
errors
Any of:
Array<object>
ValidationErrorItem
object
loc
required
Loc

Where the validation error occurred

Array
msg
required
Msg

Human-readable validation message

string
type
required
Type

Machine-readable validation error type

string
type
required
Type

Stable machine-readable error type

string
Allowed values: already_exists_error app_error authentication_error conflict_error aws_error configuration_error database_error dynamodb_error e2b_error e2b_rate_limit_error expired_signature_error expired_token_error forbidden_error group_error invalid_error invalid_flag_error invalid_username_error mail_error member_exists_error member_limit_exceeded_error migration_lock_timeout_error not_found_error oauth_config_error org_sandbox_capacity_exceeded_error bad_gateway_error gateway_timeout_error s3_error server_error task_error stripe_error token_error upgrade_required_error usage_limit_exceeded_error user_verification_error validation_error
Example 
{
  "code": 401,
  "detail": "Authentication failed",
  "type": "authentication_error"
}

401

Section titled “401 ”

Authentication failed

Media type application/json
APIErrorPayload

Canonical API error envelope returned by the API.

object
code
required
Code

HTTP status code

integer
Allowed values: 400 401 403 404 409 422 426 429 500 502 504
detail
required
Detail

Human-readable error message

string
errors
Any of:
Array<object>
ValidationErrorItem
object
loc
required
Loc

Where the validation error occurred

Array
msg
required
Msg

Human-readable validation message

string
type
required
Type

Machine-readable validation error type

string
type
required
Type

Stable machine-readable error type

string
Allowed values: already_exists_error app_error authentication_error conflict_error aws_error configuration_error database_error dynamodb_error e2b_error e2b_rate_limit_error expired_signature_error expired_token_error forbidden_error group_error invalid_error invalid_flag_error invalid_username_error mail_error member_exists_error member_limit_exceeded_error migration_lock_timeout_error not_found_error oauth_config_error org_sandbox_capacity_exceeded_error bad_gateway_error gateway_timeout_error s3_error server_error task_error stripe_error token_error upgrade_required_error usage_limit_exceeded_error user_verification_error validation_error
Example 
{
  "code": 401,
  "detail": "Authentication failed",
  "type": "authentication_error"
}

403

Section titled “403 ”

Access forbidden

Media type application/json
APIErrorPayload

Canonical API error envelope returned by the API.

object
code
required
Code

HTTP status code

integer
Allowed values: 400 401 403 404 409 422 426 429 500 502 504
detail
required
Detail

Human-readable error message

string
errors
Any of:
Array<object>
ValidationErrorItem
object
loc
required
Loc

Where the validation error occurred

Array
msg
required
Msg

Human-readable validation message

string
type
required
Type

Machine-readable validation error type

string
type
required
Type

Stable machine-readable error type

string
Allowed values: already_exists_error app_error authentication_error conflict_error aws_error configuration_error database_error dynamodb_error e2b_error e2b_rate_limit_error expired_signature_error expired_token_error forbidden_error group_error invalid_error invalid_flag_error invalid_username_error mail_error member_exists_error member_limit_exceeded_error migration_lock_timeout_error not_found_error oauth_config_error org_sandbox_capacity_exceeded_error bad_gateway_error gateway_timeout_error s3_error server_error task_error stripe_error token_error upgrade_required_error usage_limit_exceeded_error user_verification_error validation_error
Example 
{
  "code": 401,
  "detail": "Authentication failed",
  "type": "authentication_error"
}

404

Section titled “404 ”

Not found

Media type application/json
APIErrorPayload

Canonical API error envelope returned by the API.

object
code
required
Code

HTTP status code

integer
Allowed values: 400 401 403 404 409 422 426 429 500 502 504
detail
required
Detail

Human-readable error message

string
errors
Any of:
Array<object>
ValidationErrorItem
object
loc
required
Loc

Where the validation error occurred

Array
msg
required
Msg

Human-readable validation message

string
type
required
Type

Machine-readable validation error type

string
type
required
Type

Stable machine-readable error type

string
Allowed values: already_exists_error app_error authentication_error conflict_error aws_error configuration_error database_error dynamodb_error e2b_error e2b_rate_limit_error expired_signature_error expired_token_error forbidden_error group_error invalid_error invalid_flag_error invalid_username_error mail_error member_exists_error member_limit_exceeded_error migration_lock_timeout_error not_found_error oauth_config_error org_sandbox_capacity_exceeded_error bad_gateway_error gateway_timeout_error s3_error server_error task_error stripe_error token_error upgrade_required_error usage_limit_exceeded_error user_verification_error validation_error
Example 
{
  "code": 401,
  "detail": "Authentication failed",
  "type": "authentication_error"
}

409

Section titled “409 ”

Already exists

Media type application/json
APIErrorPayload

Canonical API error envelope returned by the API.

object
code
required
Code

HTTP status code

integer
Allowed values: 400 401 403 404 409 422 426 429 500 502 504
detail
required
Detail

Human-readable error message

string
errors
Any of:
Array<object>
ValidationErrorItem
object
loc
required
Loc

Where the validation error occurred

Array
msg
required
Msg

Human-readable validation message

string
type
required
Type

Machine-readable validation error type

string
type
required
Type

Stable machine-readable error type

string
Allowed values: already_exists_error app_error authentication_error conflict_error aws_error configuration_error database_error dynamodb_error e2b_error e2b_rate_limit_error expired_signature_error expired_token_error forbidden_error group_error invalid_error invalid_flag_error invalid_username_error mail_error member_exists_error member_limit_exceeded_error migration_lock_timeout_error not_found_error oauth_config_error org_sandbox_capacity_exceeded_error bad_gateway_error gateway_timeout_error s3_error server_error task_error stripe_error token_error upgrade_required_error usage_limit_exceeded_error user_verification_error validation_error
Example 
{
  "code": 401,
  "detail": "Authentication failed",
  "type": "authentication_error"
}

422

Section titled “422 ”

Validation error

Media type application/json
APIErrorPayload

Canonical API error envelope returned by the API.

object
code
required
Code

HTTP status code

integer
Allowed values: 400 401 403 404 409 422 426 429 500 502 504
detail
required
Detail

Human-readable error message

string
errors
Any of:
Array<object>
ValidationErrorItem
object
loc
required
Loc

Where the validation error occurred

Array
msg
required
Msg

Human-readable validation message

string
type
required
Type

Machine-readable validation error type

string
type
required
Type

Stable machine-readable error type

string
Allowed values: already_exists_error app_error authentication_error conflict_error aws_error configuration_error database_error dynamodb_error e2b_error e2b_rate_limit_error expired_signature_error expired_token_error forbidden_error group_error invalid_error invalid_flag_error invalid_username_error mail_error member_exists_error member_limit_exceeded_error migration_lock_timeout_error not_found_error oauth_config_error org_sandbox_capacity_exceeded_error bad_gateway_error gateway_timeout_error s3_error server_error task_error stripe_error token_error upgrade_required_error usage_limit_exceeded_error user_verification_error validation_error
Example 
{
  "code": 401,
  "detail": "Authentication failed",
  "type": "authentication_error"
}

426

Section titled “426 ”

Upgrade required

Media type application/json
APIErrorPayload

Canonical API error envelope returned by the API.

object
code
required
Code

HTTP status code

integer
Allowed values: 400 401 403 404 409 422 426 429 500 502 504
detail
required
Detail

Human-readable error message

string
errors
Any of:
Array<object>
ValidationErrorItem
object
loc
required
Loc

Where the validation error occurred

Array
msg
required
Msg

Human-readable validation message

string
type
required
Type

Machine-readable validation error type

string
type
required
Type

Stable machine-readable error type

string
Allowed values: already_exists_error app_error authentication_error conflict_error aws_error configuration_error database_error dynamodb_error e2b_error e2b_rate_limit_error expired_signature_error expired_token_error forbidden_error group_error invalid_error invalid_flag_error invalid_username_error mail_error member_exists_error member_limit_exceeded_error migration_lock_timeout_error not_found_error oauth_config_error org_sandbox_capacity_exceeded_error bad_gateway_error gateway_timeout_error s3_error server_error task_error stripe_error token_error upgrade_required_error usage_limit_exceeded_error user_verification_error validation_error
Example 
{
  "code": 401,
  "detail": "Authentication failed",
  "type": "authentication_error"
}

429

Section titled “429 ”

Rate limited

Media type application/json
APIErrorPayload

Canonical API error envelope returned by the API.

object
code
required
Code

HTTP status code

integer
Allowed values: 400 401 403 404 409 422 426 429 500 502 504
detail
required
Detail

Human-readable error message

string
errors
Any of:
Array<object>
ValidationErrorItem
object
loc
required
Loc

Where the validation error occurred

Array
msg
required
Msg

Human-readable validation message

string
type
required
Type

Machine-readable validation error type

string
type
required
Type

Stable machine-readable error type

string
Allowed values: already_exists_error app_error authentication_error conflict_error aws_error configuration_error database_error dynamodb_error e2b_error e2b_rate_limit_error expired_signature_error expired_token_error forbidden_error group_error invalid_error invalid_flag_error invalid_username_error mail_error member_exists_error member_limit_exceeded_error migration_lock_timeout_error not_found_error oauth_config_error org_sandbox_capacity_exceeded_error bad_gateway_error gateway_timeout_error s3_error server_error task_error stripe_error token_error upgrade_required_error usage_limit_exceeded_error user_verification_error validation_error
Example 
{
  "code": 401,
  "detail": "Authentication failed",
  "type": "authentication_error"
}

500

Section titled “500 ”

Internal server error

Media type application/json
APIErrorPayload

Canonical API error envelope returned by the API.

object
code
required
Code

HTTP status code

integer
Allowed values: 400 401 403 404 409 422 426 429 500 502 504
detail
required
Detail

Human-readable error message

string
errors
Any of:
Array<object>
ValidationErrorItem
object
loc
required
Loc

Where the validation error occurred

Array
msg
required
Msg

Human-readable validation message

string
type
required
Type

Machine-readable validation error type

string
type
required
Type

Stable machine-readable error type

string
Allowed values: already_exists_error app_error authentication_error conflict_error aws_error configuration_error database_error dynamodb_error e2b_error e2b_rate_limit_error expired_signature_error expired_token_error forbidden_error group_error invalid_error invalid_flag_error invalid_username_error mail_error member_exists_error member_limit_exceeded_error migration_lock_timeout_error not_found_error oauth_config_error org_sandbox_capacity_exceeded_error bad_gateway_error gateway_timeout_error s3_error server_error task_error stripe_error token_error upgrade_required_error usage_limit_exceeded_error user_verification_error validation_error
Example 
{
  "code": 401,
  "detail": "Authentication failed",
  "type": "authentication_error"
}

502

Section titled “502 ”

Bad gateway

Media type application/json
APIErrorPayload

Canonical API error envelope returned by the API.

object
code
required
Code

HTTP status code

integer
Allowed values: 400 401 403 404 409 422 426 429 500 502 504
detail
required
Detail

Human-readable error message

string
errors
Any of:
Array<object>
ValidationErrorItem
object
loc
required
Loc

Where the validation error occurred

Array
msg
required
Msg

Human-readable validation message

string
type
required
Type

Machine-readable validation error type

string
type
required
Type

Stable machine-readable error type

string
Allowed values: already_exists_error app_error authentication_error conflict_error aws_error configuration_error database_error dynamodb_error e2b_error e2b_rate_limit_error expired_signature_error expired_token_error forbidden_error group_error invalid_error invalid_flag_error invalid_username_error mail_error member_exists_error member_limit_exceeded_error migration_lock_timeout_error not_found_error oauth_config_error org_sandbox_capacity_exceeded_error bad_gateway_error gateway_timeout_error s3_error server_error task_error stripe_error token_error upgrade_required_error usage_limit_exceeded_error user_verification_error validation_error
Example 
{
  "code": 401,
  "detail": "Authentication failed",
  "type": "authentication_error"
}

504

Section titled “504 ”

Gateway timeout

Media type application/json
APIErrorPayload

Canonical API error envelope returned by the API.

object
code
required
Code

HTTP status code

integer
Allowed values: 400 401 403 404 409 422 426 429 500 502 504
detail
required
Detail

Human-readable error message

string
errors
Any of:
Array<object>
ValidationErrorItem
object
loc
required
Loc

Where the validation error occurred

Array
msg
required
Msg

Human-readable validation message

string
type
required
Type

Machine-readable validation error type

string
type
required
Type

Stable machine-readable error type

string
Allowed values: already_exists_error app_error authentication_error conflict_error aws_error configuration_error database_error dynamodb_error e2b_error e2b_rate_limit_error expired_signature_error expired_token_error forbidden_error group_error invalid_error invalid_flag_error invalid_username_error mail_error member_exists_error member_limit_exceeded_error migration_lock_timeout_error not_found_error oauth_config_error org_sandbox_capacity_exceeded_error bad_gateway_error gateway_timeout_error s3_error server_error task_error stripe_error token_error upgrade_required_error usage_limit_exceeded_error user_verification_error validation_error
Example 
{
  "code": 401,
  "detail": "Authentication failed",
  "type": "authentication_error"
}