> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tracecat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# List Cases

> List cases with default filtering and sorting options.



## OpenAPI

````yaml https://platform.tracecat.com/api/openapi.json get /workspaces/{workspace_id}/cases
openapi: 3.1.0
info:
  title: Tracecat API
  summary: Tracecat API
  description: The open source AI automation platform for security teams and agents.
  termsOfService: >-
    https://docs.google.com/document/d/e/2PACX-1vQvDe3SoVAPoQc51MgfGCP71IqFYX_rMVEde8zC4qmBCec5f8PLKQRdxa6tsUABT8gWAR9J-EVs2CrQ/pub
  contact:
    name: Tracecat Founders
    email: founders@tracecat.com
  license:
    name: AGPL-3.0
    url: https://www.gnu.org/licenses/agpl-3.0.html
  version: '1'
servers:
  - url: /api
security: []
tags:
  - name: public
    description: Public facing endpoints
  - name: workflows
    description: Workflow management
  - name: actions
    description: Action management
  - name: triggers
    description: Workflow triggers
  - name: secrets
    description: Secret management
  - name: variables
    description: Workspace variable management
paths:
  /workspaces/{workspace_id}/cases:
    get:
      tags:
        - cases
      summary: List Cases
      description: List cases with default filtering and sorting options.
      operationId: cases-list_cases
      parameters:
        - name: workspace_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Workspace Id
        - name: limit
          in: query
          required: false
          schema:
            type: integer
            maximum: 200
            minimum: 1
            description: Maximum items per page
            default: 20
            title: Limit
          description: Maximum items per page
        - name: cursor
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            description: Cursor for pagination
            title: Cursor
          description: Cursor for pagination
        - name: reverse
          in: query
          required: false
          schema:
            type: boolean
            description: Reverse pagination direction
            default: false
            title: Reverse
          description: Reverse pagination direction
        - name: order_by
          in: query
          required: false
          schema:
            anyOf:
              - enum:
                  - created_at
                  - updated_at
                  - priority
                  - severity
                  - status
                  - tasks
                type: string
              - type: 'null'
            description: >-
              Column name to order by (e.g. created_at, updated_at, priority,
              severity, status, tasks). Default: created_at
            title: Order By
          description: >-
            Column name to order by (e.g. created_at, updated_at, priority,
            severity, status, tasks). Default: created_at
        - name: sort
          in: query
          required: false
          schema:
            anyOf:
              - enum:
                  - asc
                  - desc
                type: string
              - type: 'null'
            description: Direction to sort (asc or desc)
            title: Sort
          description: Direction to sort (asc or desc)
        - name: include_rows
          in: query
          required: false
          schema:
            type: boolean
            description: Include linked table rows
            default: false
            title: Include Rows
          description: Include linked table rows
        - name: field_ids
          in: query
          required: false
          schema:
            anyOf:
              - items:
                  type: string
                type: array
              - type: 'null'
            description: Include only the requested custom field IDs
            title: Field Ids
          description: Include only the requested custom field IDs
        - name: include_durations
          in: query
          required: false
          schema:
            type: boolean
            description: Include case duration values
            default: false
            title: Include Durations
          description: Include case duration values
        - name: include_payload
          in: query
          required: false
          schema:
            type: boolean
            description: Include case payload
            default: false
            title: Include Payload
          description: Include case payload
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CursorPaginatedResponse_CaseReadMinimal_'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
        - APIKeyCookie: []
        - ServiceAccountApiKeyBearer: []
components:
  schemas:
    CursorPaginatedResponse_CaseReadMinimal_:
      properties:
        items:
          items:
            $ref: '#/components/schemas/CaseReadMinimal'
          type: array
          title: Items
        next_cursor:
          anyOf:
            - type: string
            - type: 'null'
          title: Next Cursor
          description: Cursor for next page
        prev_cursor:
          anyOf:
            - type: string
            - type: 'null'
          title: Prev Cursor
          description: Cursor for previous page
        has_more:
          type: boolean
          title: Has More
          description: Whether more items exist
          default: false
        has_previous:
          type: boolean
          title: Has Previous
          description: Whether previous items exist
          default: false
        total_estimate:
          anyOf:
            - type: integer
            - type: 'null'
          title: Total Estimate
          description: Estimated total count from table statistics
      type: object
      required:
        - items
      title: CursorPaginatedResponse[CaseReadMinimal]
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    CaseReadMinimal:
      properties:
        id:
          type: string
          format: uuid
          title: Id
        short_id:
          type: string
          title: Short Id
        created_at:
          type: string
          format: date-time
          title: Created At
        updated_at:
          type: string
          format: date-time
          title: Updated At
        summary:
          type: string
          title: Summary
        status:
          $ref: '#/components/schemas/CaseStatus'
        priority:
          $ref: '#/components/schemas/CasePriority'
        severity:
          $ref: '#/components/schemas/CaseSeverity'
        assignee:
          anyOf:
            - $ref: '#/components/schemas/UserRead'
            - type: 'null'
        tags:
          items:
            $ref: '#/components/schemas/CaseTagRead'
          type: array
          title: Tags
        dropdown_values:
          items:
            $ref: '#/components/schemas/CaseDropdownValueRead'
          type: array
          title: Dropdown Values
        rows:
          items:
            $ref: '#/components/schemas/CaseTableRowRead'
          type: array
          title: Rows
        durations:
          anyOf:
            - items:
                $ref: '#/components/schemas/CaseDurationRead'
              type: array
            - type: 'null'
          title: Durations
        field_values:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Field Values
        payload:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Payload
        num_tasks_completed:
          type: integer
          title: Num Tasks Completed
          default: 0
        num_tasks_total:
          type: integer
          title: Num Tasks Total
          default: 0
      type: object
      required:
        - id
        - short_id
        - created_at
        - updated_at
        - summary
        - status
        - priority
        - severity
        - dropdown_values
      title: CaseReadMinimal
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
              - type: string
              - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
        input:
          title: Input
        ctx:
          type: object
          title: Context
      type: object
      required:
        - loc
        - msg
        - type
      title: ValidationError
    CaseStatus:
      type: string
      enum:
        - unknown
        - new
        - in_progress
        - on_hold
        - resolved
        - closed
        - other
      title: CaseStatus
      description: Case status values aligned with OCSF Incident Finding status.
    CasePriority:
      type: string
      enum:
        - unknown
        - low
        - medium
        - high
        - critical
        - other
      title: CasePriority
      description: |-
        Case priority values aligned with urgency levels.

        Values:
            UNKNOWN (0): No priority is assigned
            LOW (1): Application or personal procedure is unusable, where a workaround is available or a repair is possible
            MEDIUM (2): Non-critical function or procedure is unusable or hard to use causing operational disruptions with no direct impact on a service's availability. A workaround is available
            HIGH (3): Critical functionality or network access is interrupted, degraded or unusable, having a severe impact on services availability. No acceptable alternative is possible
            CRITICAL (4): Interruption making a critical functionality inaccessible or a complete network interruption causing a severe impact on services availability. There is no possible alternative
            OTHER (99): The priority is not normalized
    CaseSeverity:
      type: string
      enum:
        - unknown
        - informational
        - low
        - medium
        - high
        - critical
        - fatal
        - other
      title: CaseSeverity
      description: |-
        Case severity values aligned with OCSF severity values.

        Values:
            UNKNOWN (0): The event/finding severity is unknown
            INFORMATIONAL (1): Informational message. No action required
            LOW (2): The user decides if action is needed
            MEDIUM (3): Action is required but the situation is not serious at this time
            HIGH (4): Action is required immediately
            CRITICAL (5): Action is required immediately and the scope is broad
            FATAL (6): An error occurred but it is too late to take remedial action
            OTHER (99): The event/finding severity is not mapped
    UserRead:
      properties:
        id:
          type: string
          format: uuid
          title: Id
        email:
          type: string
          format: email
          title: Email
        is_active:
          type: boolean
          title: Is Active
          default: true
        is_superuser:
          type: boolean
          title: Is Superuser
          default: false
        is_verified:
          type: boolean
          title: Is Verified
          default: false
        role:
          $ref: '#/components/schemas/UserRole'
        first_name:
          anyOf:
            - type: string
            - type: 'null'
          title: First Name
        last_name:
          anyOf:
            - type: string
            - type: 'null'
          title: Last Name
        settings:
          additionalProperties: true
          type: object
          title: Settings
      type: object
      required:
        - id
        - email
        - role
        - settings
      title: UserRead
    CaseTagRead:
      properties:
        id:
          type: string
          format: uuid
          title: Id
        name:
          type: string
          title: Name
        ref:
          type: string
          title: Ref
        color:
          anyOf:
            - type: string
            - type: 'null'
          title: Color
      type: object
      required:
        - id
        - name
        - ref
        - color
      title: CaseTagRead
      description: Tag data.
    CaseDropdownValueRead:
      properties:
        id:
          type: string
          format: uuid
          title: Id
        definition_id:
          type: string
          format: uuid
          title: Definition Id
        definition_ref:
          type: string
          title: Definition Ref
        definition_name:
          type: string
          title: Definition Name
        option_id:
          anyOf:
            - type: string
              format: uuid
            - type: 'null'
          title: Option Id
        option_label:
          anyOf:
            - type: string
            - type: 'null'
          title: Option Label
        option_ref:
          anyOf:
            - type: string
            - type: 'null'
          title: Option Ref
        option_icon_name:
          anyOf:
            - type: string
            - type: 'null'
          title: Option Icon Name
        option_color:
          anyOf:
            - type: string
            - type: 'null'
          title: Option Color
      type: object
      required:
        - id
        - definition_id
        - definition_ref
        - definition_name
      title: CaseDropdownValueRead
      description: Per-case dropdown value with full definition/option info.
    CaseTableRowRead:
      properties:
        id:
          type: string
          format: uuid
          title: Id
        case_id:
          type: string
          format: uuid
          title: Case Id
        table_id:
          type: string
          format: uuid
          title: Table Id
        table_name:
          anyOf:
            - type: string
            - type: 'null'
          title: Table Name
        row_id:
          type: string
          format: uuid
          title: Row Id
        row_data:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Row Data
        is_row_available:
          type: boolean
          title: Is Row Available
          default: true
        created_at:
          type: string
          format: date-time
          title: Created At
        updated_at:
          type: string
          format: date-time
          title: Updated At
      type: object
      required:
        - id
        - case_id
        - table_id
        - row_id
        - created_at
        - updated_at
      title: CaseTableRowRead
    CaseDurationRead:
      properties:
        definition_id:
          type: string
          format: uuid
          title: Definition Id
          description: Identifier of the case duration definition generating this duration.
        start_event_id:
          anyOf:
            - type: string
              format: uuid
            - type: 'null'
          title: Start Event Id
          description: Case event that started the duration, if available.
        end_event_id:
          anyOf:
            - type: string
              format: uuid
            - type: 'null'
          title: End Event Id
          description: Case event that ended the duration, if available.
        started_at:
          anyOf:
            - type: string
              format: date-time
            - type: 'null'
          title: Started At
          description: Timestamp when the duration began.
        ended_at:
          anyOf:
            - type: string
              format: date-time
            - type: 'null'
          title: Ended At
          description: Timestamp when the duration ended.
        duration:
          anyOf:
            - type: string
              format: duration
            - type: 'null'
          title: Duration
          description: Total elapsed time between start and end timestamps.
        id:
          type: string
          format: uuid
          title: Id
        case_id:
          type: string
          format: uuid
          title: Case Id
      type: object
      required:
        - definition_id
        - id
        - case_id
      title: CaseDurationRead
      description: Read model for case duration records.
    UserRole:
      type: string
      enum:
        - basic
        - admin
      title: UserRole
  securitySchemes:
    APIKeyCookie:
      type: apiKey
      in: cookie
      name: fastapiusersauth
    ServiceAccountApiKeyBearer:
      type: http
      description: Tracecat service account API key.
      scheme: bearer

````