Skip to main content
GET
/
cases
/
{case_id}
Get Case
curl --request GET \
  --url https://api.example.com/cases/{case_id} \
  --cookie fastapiusersauth=
{
  "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "short_id": "<string>",
  "created_at": "2023-11-07T05:31:56Z",
  "updated_at": "2023-11-07T05:31:56Z",
  "summary": "<string>",
  "status": "unknown",
  "priority": "unknown",
  "severity": "unknown",
  "description": "<string>",
  "fields": [
    {
      "id": "<string>",
      "type": "TEXT",
      "description": "<string>",
      "nullable": true,
      "default": "<string>",
      "reserved": true,
      "value": "<unknown>"
    }
  ]
}

Authorizations

​
fastapiusersauth
string
cookie
required

Path Parameters

​
case_id
string<uuid>
required

Query Parameters

​
workspace_id
string<uuid>
required

Response

Successful Response

​
id
string<uuid>
required
​
short_id
string
required
​
created_at
string<date-time>
required
​
updated_at
string<date-time>
required
​
summary
string
required
​
status
enum<string>
required

Case status values used across Tracecat incident workflows.

Available options:
unknown,
new,
in_progress,
on_hold,
resolved,
closed,
other
​
priority
enum<string>
required

Case priority values aligned with urgency levels.

Values: UNKNOWN (0): No priority is assigned LOW (1): Application or personal procedure is unusable, where a workaround is available or a repair is possible MEDIUM (2): Non-critical function or procedure is unusable or hard to use causing operational disruptions with no direct impact on a service's availability. A workaround is available HIGH (3): Critical functionality or network access is interrupted, degraded or unusable, having a severe impact on services availability. No acceptable alternative is possible CRITICAL (4): Interruption making a critical functionality inaccessible or a complete network interruption causing a severe impact on services availability. There is no possible alternative OTHER (99): The priority is not normalized

Available options:
unknown,
low,
medium,
high,
critical,
other
​
severity
enum<string>
required

Case severity values used across Tracecat workflows.

Values: UNKNOWN (0): The event/finding severity is unknown INFORMATIONAL (1): Informational message. No action required LOW (2): The user decides if action is needed MEDIUM (3): Action is required but the situation is not serious at this time HIGH (4): Action is required immediately CRITICAL (5): Action is required immediately and the scope is broad FATAL (6): An error occurred but it is too late to take remedial action OTHER (99): The event/finding severity is not mapped

Available options:
unknown,
informational,
low,
medium,
high,
critical,
fatal,
other
​
description
string
required
​
fields
CaseCustomFieldRead · object[]
required