Upload a branding logo for a report template
Attach a PNG logo to a saved report template. Max 2MB, PNG only. The logo replaces any existing branding_logo_oid and is spliced into the template config’s Header.left slot so subsequent renders pick it up without additional configuration.
Authorizations
Section titled “Authorizations ”Parameters
Section titled “ Parameters ”Path Parameters
Section titled “Path Parameters ”Organization slug
Organization slug
Workspace slug
Workspace slug
Project slug or UUID
Project slug or UUID
Request Body required
Section titled “Request Body required ”object
PNG branding logo, max 2MB.
Responses
Section titled “ Responses ”Successful Response
API response shape for a saved report template.
preset is derived best-effort from config via
derive_preset_from_components. It’s None for templates authored via
raw config= rather than a preset (no SectionComponent.preset_key
tags to read). The Phase 2 frontend uses preset to back-fill the form
when a saved template is selected.
object
Shape stored inside airt_report_templates.config (JSONB).
Directly maps to a DreadReport invocation:
DreadReport(*components).style(**style.model_dump()).to_
object
Text-bearing component. Covers DreadReport Title, Authors, Text.
Exactly one of content (static) or instructions (AI-writer prompt)
must be set. MVP renderer ignores instructions and will error on any
component that relies on it — full support lands with the DreadReport
adapter (see ENG-6485).
Mirrors dreadreport.report.components.Image. fp is an S3 OID.
Mirrors dreadreport.report.components.Table.
DreadReport accepts inline data (dict/list/DataFrame); we add AIRT query
sources via the discriminated union TableDataSource. StaticTableSource
is the DreadReport-equivalent inline path.
object
AIRT findings — filtered rows.
object
Filter over findings rows. All strings untrusted.
Scope: these fields narrow the findings table rows only. Report-wide assessment scoping (narrow ASR / severity / metrics sections by the same assessment subset) is a follow-up — see ENG-6432 PR description. For Phase 1 the UI-surfaced assessment/date filters apply only to the findings table component.
object
object
object
asr_by_transform from analytics_snapshot — PRD ‘Transform Effectiveness’.
object
severity_breakdown from analytics_snapshot — PRD ‘Severity Breakdown’.
object
Scalar risk metrics (risk_score, overall_asr, totals) as metric/value rows. PRD ‘Risk Score & ASR Metrics’.
object
Distinct target/attacker/judge models across selected assessments.
PRD ‘Models Used’. include picks which model roles to surface; default
covers all three.
object
object
Inline rows — DreadReport-native data: list[dict] shape.
Security: row / key / cell caps guard against payload DoS. Strings are
length-capped at MAX_STATIC_CELL_LEN. Numeric types are unbounded but
JSONB encoding caps practical size.
Mirrors dreadreport.report.components.PageNumber.
object
Mirrors dreadreport.report.components.Header and Footer.
object
Mirrors dreadreport.report.components.Image. fp is an S3 OID.
Mirrors dreadreport.report.components.PageNumber.
object
Mirrors dreadreport.report.components.Image. fp is an S3 OID.
Mirrors dreadreport.report.components.PageNumber.
object
Mirrors dreadreport.report.components.Image. fp is an S3 OID.
Mirrors dreadreport.report.components.PageNumber.
object
Mirrors dreadreport.report.containers.Section / References / Appendix.
preset_key is an optional tag set by build_airt_components when the
section was generated from an AirtPresetRequest checkbox. The renderer’s
EmptyReportSectionError echoes this back so the frontend can re-enable
the exact checkbox the user toggled. Template-authored sections (arbitrary
trees, no preset origin) leave it None — the frontend falls back to
title-only messaging for those.
object
Text-bearing component. Covers DreadReport Title, Authors, Text.
Exactly one of content (static) or instructions (AI-writer prompt)
must be set. MVP renderer ignores instructions and will error on any
component that relies on it — full support lands with the DreadReport
adapter (see ENG-6485).
Mirrors dreadreport.report.components.Image. fp is an S3 OID.
Mirrors dreadreport.report.components.Table.
DreadReport accepts inline data (dict/list/DataFrame); we add AIRT query
sources via the discriminated union TableDataSource. StaticTableSource
is the DreadReport-equivalent inline path.
object
AIRT findings — filtered rows.
object
Filter over findings rows. All strings untrusted.
Scope: these fields narrow the findings table rows only. Report-wide assessment scoping (narrow ASR / severity / metrics sections by the same assessment subset) is a follow-up — see ENG-6432 PR description. For Phase 1 the UI-surfaced assessment/date filters apply only to the findings table component.
object
object
object
asr_by_transform from analytics_snapshot — PRD ‘Transform Effectiveness’.
object
severity_breakdown from analytics_snapshot — PRD ‘Severity Breakdown’.
object
Scalar risk metrics (risk_score, overall_asr, totals) as metric/value rows. PRD ‘Risk Score & ASR Metrics’.
object
Distinct target/attacker/judge models across selected assessments.
PRD ‘Models Used’. include picks which model roles to surface; default
covers all three.
object
object
Inline rows — DreadReport-native data: list[dict] shape.
Security: row / key / cell caps guard against payload DoS. Strings are
length-capped at MAX_STATIC_CELL_LEN. Numeric types are unbounded but
JSONB encoding caps practical size.
Mirrors dreadreport.report.components.PageNumber.
object
Mirrors dreadreport.report.components.Header and Footer.
object
Mirrors dreadreport.report.components.Image. fp is an S3 OID.
Mirrors dreadreport.report.components.PageNumber.
object
Mirrors dreadreport.report.components.Image. fp is an S3 OID.
Mirrors dreadreport.report.components.PageNumber.
object
Mirrors dreadreport.report.components.Image. fp is an S3 OID.
Mirrors dreadreport.report.components.PageNumber.
object
Recursive reference to SectionComponent-Output.
object
Document-wide style. Mirrors DreadReport.style() — font, font_size.
Fonts locked to the ReportLab built-in set (no file I/O at render time).
object
Simple AIRT-report request — what the frontend POSTs for template create
or inline build. Server expands to ReportTemplateSchema via
build_airt_components.
object
Optional branding slots. Expanded into Header/Footer/Title by the preset builder. Frontend-facing only — no direct DreadReport equivalent, but the expansion produces DreadReport-valid components.
Filter over findings rows. All strings untrusted.
Scope: these fields narrow the findings table rows only. Report-wide assessment scoping (narrow ASR / severity / metrics sections by the same assessment subset) is a follow-up — see ENG-6432 PR description. For Phase 1 the UI-surfaced assessment/date filters apply only to the findings table component.
object
Document-wide style. Mirrors DreadReport.style() — font, font_size.
Fonts locked to the ReportLab built-in set (no file I/O at render time).
object
Invalid request
Canonical API error envelope returned by the API.
object
HTTP status code
Human-readable error message
object
Where the validation error occurred
Human-readable validation message
Machine-readable validation error type
Stable machine-readable error type
Authentication failed
Canonical API error envelope returned by the API.
object
HTTP status code
Human-readable error message
object
Where the validation error occurred
Human-readable validation message
Machine-readable validation error type
Stable machine-readable error type
Access forbidden
Canonical API error envelope returned by the API.
object
HTTP status code
Human-readable error message
object
Where the validation error occurred
Human-readable validation message
Machine-readable validation error type
Stable machine-readable error type
Not found
Canonical API error envelope returned by the API.
object
HTTP status code
Human-readable error message
object
Where the validation error occurred
Human-readable validation message
Machine-readable validation error type
Stable machine-readable error type
Already exists
Canonical API error envelope returned by the API.
object
HTTP status code
Human-readable error message
object
Where the validation error occurred
Human-readable validation message
Machine-readable validation error type
Stable machine-readable error type
Validation error
Canonical API error envelope returned by the API.
object
HTTP status code
Human-readable error message
object
Where the validation error occurred
Human-readable validation message
Machine-readable validation error type
Stable machine-readable error type
Upgrade required
Canonical API error envelope returned by the API.
object
HTTP status code
Human-readable error message
object
Where the validation error occurred
Human-readable validation message
Machine-readable validation error type
Stable machine-readable error type
Rate limited
Canonical API error envelope returned by the API.
object
HTTP status code
Human-readable error message
object
Where the validation error occurred
Human-readable validation message
Machine-readable validation error type
Stable machine-readable error type
Internal server error
Canonical API error envelope returned by the API.
object
HTTP status code
Human-readable error message
object
Where the validation error occurred
Human-readable validation message
Machine-readable validation error type
Stable machine-readable error type
Bad gateway
Canonical API error envelope returned by the API.
object
HTTP status code
Human-readable error message
object
Where the validation error occurred
Human-readable validation message
Machine-readable validation error type
Stable machine-readable error type
Gateway timeout
Canonical API error envelope returned by the API.
object
HTTP status code
Human-readable error message
object
Where the validation error occurred
Human-readable validation message
Machine-readable validation error type
Stable machine-readable error type