> ## Documentation Index > Fetch the complete documentation index at: https://docs.tracecat.com/llms.txt > Use this file to discover all available pages before exploring further. # List Events With Users > List all users for a case. ## OpenAPI ````yaml https://platform.tracecat.com/api/openapi.json get /workspaces/{workspace_id}/cases/{case_id}/events openapi: 3.1.0 info: title: Tracecat API summary: Tracecat API description: The open source AI automation platform for security teams and agents. termsOfService: >- https://docs.google.com/document/d/e/2PACX-1vQvDe3SoVAPoQc51MgfGCP71IqFYX_rMVEde8zC4qmBCec5f8PLKQRdxa6tsUABT8gWAR9J-EVs2CrQ/pub contact: name: Tracecat Founders email: founders@tracecat.com license: name: AGPL-3.0 url: https://www.gnu.org/licenses/agpl-3.0.html version: '1' servers: - url: /api security: [] tags: - name: public description: Public facing endpoints - name: workflows description: Workflow management - name: actions description: Action management - name: triggers description: Workflow triggers - name: secrets description: Secret management - name: variables description: Workspace variable management paths: /workspaces/{workspace_id}/cases/{case_id}/events: get: tags: - cases summary: List Events With Users description: List all users for a case. operationId: cases-list_events_with_users parameters: - name: case_id in: path required: true schema: type: string format: uuid title: Case Id - name: workspace_id in: path required: true schema: type: string format: uuid title: Workspace Id responses: '200': description: Successful Response content: application/json: schema: $ref: '#/components/schemas/CaseEventsWithUsers' '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' security: - APIKeyCookie: [] - ServiceAccountApiKeyBearer: [] components: schemas: CaseEventsWithUsers: properties: events: items: $ref: '#/components/schemas/CaseEventRead' type: array title: Events description: The events for the case. users: items: $ref: '#/components/schemas/UserRead' type: array title: Users description: The users for the case. type: object required: - events - users title: CaseEventsWithUsers HTTPValidationError: properties: detail: items: $ref: '#/components/schemas/ValidationError' type: array title: Detail type: object title: HTTPValidationError CaseEventRead: oneOf: - $ref: '#/components/schemas/CreatedEventRead' - $ref: '#/components/schemas/ClosedEventRead' - $ref: '#/components/schemas/ReopenedEventRead' - $ref: '#/components/schemas/CaseViewedEventRead' - $ref: '#/components/schemas/UpdatedEventRead' - $ref: '#/components/schemas/StatusChangedEventRead' - $ref: '#/components/schemas/PriorityChangedEventRead' - $ref: '#/components/schemas/SeverityChangedEventRead' - $ref: '#/components/schemas/FieldChangedEventRead' - $ref: '#/components/schemas/AssigneeChangedEventRead' - $ref: '#/components/schemas/AttachmentCreatedEventRead' - $ref: '#/components/schemas/AttachmentDeletedEventRead' - $ref: '#/components/schemas/TagAddedEventRead' - $ref: '#/components/schemas/TagRemovedEventRead' - $ref: '#/components/schemas/PayloadChangedEventRead' - $ref: '#/components/schemas/CommentCreatedEventRead' - $ref: '#/components/schemas/CommentUpdatedEventRead' - $ref: '#/components/schemas/CommentDeletedEventRead' - $ref: '#/components/schemas/CommentReplyCreatedEventRead' - $ref: '#/components/schemas/CommentReplyUpdatedEventRead' - $ref: '#/components/schemas/CommentReplyDeletedEventRead' - $ref: '#/components/schemas/TaskCreatedEventRead' - $ref: '#/components/schemas/TaskStatusChangedEventRead' - $ref: '#/components/schemas/TaskPriorityChangedEventRead' - $ref: '#/components/schemas/TaskWorkflowChangedEventRead' - $ref: '#/components/schemas/TaskDeletedEventRead' - $ref: '#/components/schemas/TaskAssigneeChangedEventRead' - $ref: '#/components/schemas/DropdownValueChangedEventRead' - $ref: '#/components/schemas/TableRowLinkedEventRead' - $ref: '#/components/schemas/TableRowUnlinkedEventRead' title: CaseEventRead description: Base read model for all event types. discriminator: propertyName: type mapping: assignee_changed: $ref: '#/components/schemas/AssigneeChangedEventRead' attachment_created: $ref: '#/components/schemas/AttachmentCreatedEventRead' attachment_deleted: $ref: '#/components/schemas/AttachmentDeletedEventRead' case_closed: $ref: '#/components/schemas/ClosedEventRead' case_created: $ref: '#/components/schemas/CreatedEventRead' case_reopened: $ref: '#/components/schemas/ReopenedEventRead' case_updated: $ref: '#/components/schemas/UpdatedEventRead' case_viewed: $ref: '#/components/schemas/CaseViewedEventRead' comment_created: $ref: '#/components/schemas/CommentCreatedEventRead' comment_deleted: $ref: '#/components/schemas/CommentDeletedEventRead' comment_reply_created: $ref: '#/components/schemas/CommentReplyCreatedEventRead' comment_reply_deleted: $ref: '#/components/schemas/CommentReplyDeletedEventRead' comment_reply_updated: $ref: '#/components/schemas/CommentReplyUpdatedEventRead' comment_updated: $ref: '#/components/schemas/CommentUpdatedEventRead' dropdown_value_changed: $ref: '#/components/schemas/DropdownValueChangedEventRead' fields_changed: $ref: '#/components/schemas/FieldChangedEventRead' payload_changed: $ref: '#/components/schemas/PayloadChangedEventRead' priority_changed: $ref: '#/components/schemas/PriorityChangedEventRead' severity_changed: $ref: '#/components/schemas/SeverityChangedEventRead' status_changed: $ref: '#/components/schemas/StatusChangedEventRead' table_row_linked: $ref: '#/components/schemas/TableRowLinkedEventRead' table_row_unlinked: $ref: '#/components/schemas/TableRowUnlinkedEventRead' tag_added: $ref: '#/components/schemas/TagAddedEventRead' tag_removed: $ref: '#/components/schemas/TagRemovedEventRead' task_assignee_changed: $ref: '#/components/schemas/TaskAssigneeChangedEventRead' task_created: $ref: '#/components/schemas/TaskCreatedEventRead' task_deleted: $ref: '#/components/schemas/TaskDeletedEventRead' task_priority_changed: $ref: '#/components/schemas/TaskPriorityChangedEventRead' task_status_changed: $ref: '#/components/schemas/TaskStatusChangedEventRead' task_workflow_changed: $ref: '#/components/schemas/TaskWorkflowChangedEventRead' UserRead: properties: id: type: string format: uuid title: Id email: type: string format: email title: Email is_active: type: boolean title: Is Active default: true is_superuser: type: boolean title: Is Superuser default: false is_verified: type: boolean title: Is Verified default: false role: $ref: '#/components/schemas/UserRole' first_name: anyOf: - type: string - type: 'null' title: First Name last_name: anyOf: - type: string - type: 'null' title: Last Name settings: additionalProperties: true type: object title: Settings type: object required: - id - email - role - settings title: UserRead ValidationError: properties: loc: items: anyOf: - type: string - type: integer type: array title: Location msg: type: string title: Message type: type: string title: Error Type input: title: Input ctx: type: object title: Context type: object required: - loc - msg - type title: ValidationError CreatedEventRead: properties: wf_exec_id: anyOf: - type: string - type: 'null' title: Wf Exec Id description: The execution ID of the workflow that triggered the event. type: type: string const: case_created title: Type default: case_created user_id: anyOf: - type: string format: uuid - type: 'null' title: User Id description: The user who performed the action. created_at: type: string format: date-time title: Created At description: The timestamp of the event. type: object required: - created_at title: CreatedEventRead description: Event for when a case is created. ClosedEventRead: properties: wf_exec_id: anyOf: - type: string - type: 'null' title: Wf Exec Id description: The execution ID of the workflow that triggered the event. type: type: string const: case_closed title: Type default: case_closed old: $ref: '#/components/schemas/CaseStatus' new: $ref: '#/components/schemas/CaseStatus' user_id: anyOf: - type: string format: uuid - type: 'null' title: User Id description: The user who performed the action. created_at: type: string format: date-time title: Created At description: The timestamp of the event. type: object required: - old - new - created_at title: ClosedEventRead description: Event for when a case is closed. ReopenedEventRead: properties: wf_exec_id: anyOf: - type: string - type: 'null' title: Wf Exec Id description: The execution ID of the workflow that triggered the event. type: type: string const: case_reopened title: Type default: case_reopened old: $ref: '#/components/schemas/CaseStatus' new: $ref: '#/components/schemas/CaseStatus' user_id: anyOf: - type: string format: uuid - type: 'null' title: User Id description: The user who performed the action. created_at: type: string format: date-time title: Created At description: The timestamp of the event. type: object required: - old - new - created_at title: ReopenedEventRead description: Event for when a case is reopened. CaseViewedEventRead: properties: wf_exec_id: anyOf: - type: string - type: 'null' title: Wf Exec Id description: The execution ID of the workflow that triggered the event. type: type: string const: case_viewed title: Type default: case_viewed user_id: anyOf: - type: string format: uuid - type: 'null' title: User Id description: The user who performed the action. created_at: type: string format: date-time title: Created At description: The timestamp of the event. type: object required: - created_at title: CaseViewedEventRead description: Event for when a case is viewed. UpdatedEventRead: properties: wf_exec_id: anyOf: - type: string - type: 'null' title: Wf Exec Id description: The execution ID of the workflow that triggered the event. type: type: string const: case_updated title: Type default: case_updated field: type: string const: summary title: Field old: anyOf: - type: string - type: 'null' title: Old new: anyOf: - type: string - type: 'null' title: New user_id: anyOf: - type: string format: uuid - type: 'null' title: User Id description: The user who performed the action. created_at: type: string format: date-time title: Created At description: The timestamp of the event. type: object required: - field - old - new - created_at title: UpdatedEventRead description: Event for when a case is updated. StatusChangedEventRead: properties: wf_exec_id: anyOf: - type: string - type: 'null' title: Wf Exec Id description: The execution ID of the workflow that triggered the event. type: type: string const: status_changed title: Type default: status_changed old: $ref: '#/components/schemas/CaseStatus' new: $ref: '#/components/schemas/CaseStatus' user_id: anyOf: - type: string format: uuid - type: 'null' title: User Id description: The user who performed the action. created_at: type: string format: date-time title: Created At description: The timestamp of the event. type: object required: - old - new - created_at title: StatusChangedEventRead description: Event for when a case status is changed. PriorityChangedEventRead: properties: wf_exec_id: anyOf: - type: string - type: 'null' title: Wf Exec Id description: The execution ID of the workflow that triggered the event. type: type: string const: priority_changed title: Type default: priority_changed old: $ref: '#/components/schemas/CasePriority' new: $ref: '#/components/schemas/CasePriority' user_id: anyOf: - type: string format: uuid - type: 'null' title: User Id description: The user who performed the action. created_at: type: string format: date-time title: Created At description: The timestamp of the event. type: object required: - old - new - created_at title: PriorityChangedEventRead description: Event for when a case priority is changed. SeverityChangedEventRead: properties: wf_exec_id: anyOf: - type: string - type: 'null' title: Wf Exec Id description: The execution ID of the workflow that triggered the event. type: type: string const: severity_changed title: Type default: severity_changed old: $ref: '#/components/schemas/CaseSeverity' new: $ref: '#/components/schemas/CaseSeverity' user_id: anyOf: - type: string format: uuid - type: 'null' title: User Id description: The user who performed the action. created_at: type: string format: date-time title: Created At description: The timestamp of the event. type: object required: - old - new - created_at title: SeverityChangedEventRead description: Event for when a case severity is changed. FieldChangedEventRead: properties: wf_exec_id: anyOf: - type: string - type: 'null' title: Wf Exec Id description: The execution ID of the workflow that triggered the event. type: type: string const: fields_changed title: Type default: fields_changed changes: items: $ref: '#/components/schemas/FieldDiff' type: array title: Changes user_id: anyOf: - type: string format: uuid - type: 'null' title: User Id description: The user who performed the action. created_at: type: string format: date-time title: Created At description: The timestamp of the event. type: object required: - changes - created_at title: FieldChangedEventRead description: Event for when a case field is changed. AssigneeChangedEventRead: properties: wf_exec_id: anyOf: - type: string - type: 'null' title: Wf Exec Id description: The execution ID of the workflow that triggered the event. type: type: string const: assignee_changed title: Type default: assignee_changed old: anyOf: - type: string format: uuid - type: 'null' title: Old new: anyOf: - type: string format: uuid - type: 'null' title: New user_id: anyOf: - type: string format: uuid - type: 'null' title: User Id description: The user who performed the action. created_at: type: string format: date-time title: Created At description: The timestamp of the event. type: object required: - old - new - created_at title: AssigneeChangedEventRead description: Event for when a case assignee is changed. AttachmentCreatedEventRead: properties: wf_exec_id: anyOf: - type: string - type: 'null' title: Wf Exec Id description: The execution ID of the workflow that triggered the event. type: type: string const: attachment_created title: Type default: attachment_created attachment_id: type: string format: uuid title: Attachment Id file_name: type: string title: File Name content_type: type: string title: Content Type size: type: integer title: Size user_id: anyOf: - type: string format: uuid - type: 'null' title: User Id description: The user who performed the action. created_at: type: string format: date-time title: Created At description: The timestamp of the event. type: object required: - attachment_id - file_name - content_type - size - created_at title: AttachmentCreatedEventRead description: Event for when an attachment is created for a case. AttachmentDeletedEventRead: properties: wf_exec_id: anyOf: - type: string - type: 'null' title: Wf Exec Id description: The execution ID of the workflow that triggered the event. type: type: string const: attachment_deleted title: Type default: attachment_deleted attachment_id: type: string format: uuid title: Attachment Id file_name: type: string title: File Name user_id: anyOf: - type: string format: uuid - type: 'null' title: User Id description: The user who performed the action. created_at: type: string format: date-time title: Created At description: The timestamp of the event. type: object required: - attachment_id - file_name - created_at title: AttachmentDeletedEventRead description: Event for when an attachment is deleted from a case. TagAddedEventRead: properties: wf_exec_id: anyOf: - type: string - type: 'null' title: Wf Exec Id description: The execution ID of the workflow that triggered the event. type: type: string const: tag_added title: Type default: tag_added tag_id: type: string format: uuid title: Tag Id tag_ref: type: string title: Tag Ref tag_name: type: string title: Tag Name user_id: anyOf: - type: string format: uuid - type: 'null' title: User Id description: The user who performed the action. created_at: type: string format: date-time title: Created At description: The timestamp of the event. type: object required: - tag_id - tag_ref - tag_name - created_at title: TagAddedEventRead description: Event for when a tag is added to a case. TagRemovedEventRead: properties: wf_exec_id: anyOf: - type: string - type: 'null' title: Wf Exec Id description: The execution ID of the workflow that triggered the event. type: type: string const: tag_removed title: Type default: tag_removed tag_id: type: string format: uuid title: Tag Id tag_ref: type: string title: Tag Ref tag_name: type: string title: Tag Name user_id: anyOf: - type: string format: uuid - type: 'null' title: User Id description: The user who performed the action. created_at: type: string format: date-time title: Created At description: The timestamp of the event. type: object required: - tag_id - tag_ref - tag_name - created_at title: TagRemovedEventRead description: Event for when a tag is removed from a case. PayloadChangedEventRead: properties: wf_exec_id: anyOf: - type: string - type: 'null' title: Wf Exec Id description: The execution ID of the workflow that triggered the event. type: type: string const: payload_changed title: Type default: payload_changed user_id: anyOf: - type: string format: uuid - type: 'null' title: User Id description: The user who performed the action. created_at: type: string format: date-time title: Created At description: The timestamp of the event. type: object required: - created_at title: PayloadChangedEventRead description: Event for when a case payload is changed. CommentCreatedEventRead: properties: wf_exec_id: anyOf: - type: string - type: 'null' title: Wf Exec Id description: The execution ID of the workflow that triggered the event. comment_id: type: string format: uuid title: Comment Id parent_id: anyOf: - type: string format: uuid - type: 'null' title: Parent Id thread_root_id: type: string format: uuid title: Thread Root Id type: type: string const: comment_created title: Type default: comment_created user_id: anyOf: - type: string format: uuid - type: 'null' title: User Id description: The user who performed the action. created_at: type: string format: date-time title: Created At description: The timestamp of the event. type: object required: - comment_id - thread_root_id - created_at title: CommentCreatedEventRead description: Event for when a top-level comment is created. CommentUpdatedEventRead: properties: wf_exec_id: anyOf: - type: string - type: 'null' title: Wf Exec Id description: The execution ID of the workflow that triggered the event. comment_id: type: string format: uuid title: Comment Id parent_id: anyOf: - type: string format: uuid - type: 'null' title: Parent Id thread_root_id: type: string format: uuid title: Thread Root Id type: type: string const: comment_updated title: Type default: comment_updated user_id: anyOf: - type: string format: uuid - type: 'null' title: User Id description: The user who performed the action. created_at: type: string format: date-time title: Created At description: The timestamp of the event. type: object required: - comment_id - thread_root_id - created_at title: CommentUpdatedEventRead description: Event for when a top-level comment is updated. CommentDeletedEventRead: properties: wf_exec_id: anyOf: - type: string - type: 'null' title: Wf Exec Id description: The execution ID of the workflow that triggered the event. comment_id: type: string format: uuid title: Comment Id parent_id: anyOf: - type: string format: uuid - type: 'null' title: Parent Id thread_root_id: type: string format: uuid title: Thread Root Id type: type: string const: comment_deleted title: Type default: comment_deleted delete_mode: $ref: '#/components/schemas/CaseCommentDeleteMode' user_id: anyOf: - type: string format: uuid - type: 'null' title: User Id description: The user who performed the action. created_at: type: string format: date-time title: Created At description: The timestamp of the event. type: object required: - comment_id - thread_root_id - delete_mode - created_at title: CommentDeletedEventRead description: Event for when a top-level comment is deleted. CommentReplyCreatedEventRead: properties: wf_exec_id: anyOf: - type: string - type: 'null' title: Wf Exec Id description: The execution ID of the workflow that triggered the event. comment_id: type: string format: uuid title: Comment Id parent_id: anyOf: - type: string format: uuid - type: 'null' title: Parent Id thread_root_id: type: string format: uuid title: Thread Root Id type: type: string const: comment_reply_created title: Type default: comment_reply_created user_id: anyOf: - type: string format: uuid - type: 'null' title: User Id description: The user who performed the action. created_at: type: string format: date-time title: Created At description: The timestamp of the event. type: object required: - comment_id - thread_root_id - created_at title: CommentReplyCreatedEventRead description: Event for when a reply is created. CommentReplyUpdatedEventRead: properties: wf_exec_id: anyOf: - type: string - type: 'null' title: Wf Exec Id description: The execution ID of the workflow that triggered the event. comment_id: type: string format: uuid title: Comment Id parent_id: anyOf: - type: string format: uuid - type: 'null' title: Parent Id thread_root_id: type: string format: uuid title: Thread Root Id type: type: string const: comment_reply_updated title: Type default: comment_reply_updated user_id: anyOf: - type: string format: uuid - type: 'null' title: User Id description: The user who performed the action. created_at: type: string format: date-time title: Created At description: The timestamp of the event. type: object required: - comment_id - thread_root_id - created_at title: CommentReplyUpdatedEventRead description: Event for when a reply is updated. CommentReplyDeletedEventRead: properties: wf_exec_id: anyOf: - type: string - type: 'null' title: Wf Exec Id description: The execution ID of the workflow that triggered the event. comment_id: type: string format: uuid title: Comment Id parent_id: anyOf: - type: string format: uuid - type: 'null' title: Parent Id thread_root_id: type: string format: uuid title: Thread Root Id type: type: string const: comment_reply_deleted title: Type default: comment_reply_deleted delete_mode: $ref: '#/components/schemas/CaseCommentDeleteMode' user_id: anyOf: - type: string format: uuid - type: 'null' title: User Id description: The user who performed the action. created_at: type: string format: date-time title: Created At description: The timestamp of the event. type: object required: - comment_id - thread_root_id - delete_mode - created_at title: CommentReplyDeletedEventRead description: Event for when a reply is deleted. TaskCreatedEventRead: properties: wf_exec_id: anyOf: - type: string - type: 'null' title: Wf Exec Id description: The execution ID of the workflow that triggered the event. type: type: string const: task_created title: Type default: task_created task_id: type: string format: uuid title: Task Id title: type: string title: Title user_id: anyOf: - type: string format: uuid - type: 'null' title: User Id description: The user who performed the action. created_at: type: string format: date-time title: Created At description: The timestamp of the event. type: object required: - task_id - title - created_at title: TaskCreatedEventRead description: Event for when a task is created for a case. TaskStatusChangedEventRead: properties: wf_exec_id: anyOf: - type: string - type: 'null' title: Wf Exec Id description: The execution ID of the workflow that triggered the event. type: type: string const: task_status_changed title: Type default: task_status_changed task_id: type: string format: uuid title: Task Id title: type: string title: Title old: $ref: '#/components/schemas/CaseTaskStatus' new: $ref: '#/components/schemas/CaseTaskStatus' user_id: anyOf: - type: string format: uuid - type: 'null' title: User Id description: The user who performed the action. created_at: type: string format: date-time title: Created At description: The timestamp of the event. type: object required: - task_id - title - old - new - created_at title: TaskStatusChangedEventRead description: Event for when a task status is changed. TaskPriorityChangedEventRead: properties: wf_exec_id: anyOf: - type: string - type: 'null' title: Wf Exec Id description: The execution ID of the workflow that triggered the event. type: type: string const: task_priority_changed title: Type default: task_priority_changed task_id: type: string format: uuid title: Task Id title: type: string title: Title old: $ref: '#/components/schemas/CasePriority' new: $ref: '#/components/schemas/CasePriority' user_id: anyOf: - type: string format: uuid - type: 'null' title: User Id description: The user who performed the action. created_at: type: string format: date-time title: Created At description: The timestamp of the event. type: object required: - task_id - title - old - new - created_at title: TaskPriorityChangedEventRead description: Event for when a task priority is changed. TaskWorkflowChangedEventRead: properties: wf_exec_id: anyOf: - type: string - type: 'null' title: Wf Exec Id description: The execution ID of the workflow that triggered the event. type: type: string const: task_workflow_changed title: Type default: task_workflow_changed task_id: type: string format: uuid title: Task Id title: type: string title: Title old: anyOf: - type: string - type: string pattern: wf_[0-9a-zA-Z]+ - type: string pattern: wf-[0-9a-f]{32} - type: 'null' title: Old new: anyOf: - type: string - type: string pattern: wf_[0-9a-zA-Z]+ - type: string pattern: wf-[0-9a-f]{32} - type: 'null' title: New user_id: anyOf: - type: string format: uuid - type: 'null' title: User Id description: The user who performed the action. created_at: type: string format: date-time title: Created At description: The timestamp of the event. type: object required: - task_id - title - old - new - created_at title: TaskWorkflowChangedEventRead description: Event for when a task workflow is changed. TaskDeletedEventRead: properties: wf_exec_id: anyOf: - type: string - type: 'null' title: Wf Exec Id description: The execution ID of the workflow that triggered the event. type: type: string const: task_deleted title: Type default: task_deleted task_id: type: string format: uuid title: Task Id title: anyOf: - type: string - type: 'null' title: Title user_id: anyOf: - type: string format: uuid - type: 'null' title: User Id description: The user who performed the action. created_at: type: string format: date-time title: Created At description: The timestamp of the event. type: object required: - task_id - created_at title: TaskDeletedEventRead description: Event for when a task is deleted for a case. TaskAssigneeChangedEventRead: properties: wf_exec_id: anyOf: - type: string - type: 'null' title: Wf Exec Id description: The execution ID of the workflow that triggered the event. type: type: string const: task_assignee_changed title: Type default: task_assignee_changed task_id: type: string format: uuid title: Task Id title: type: string title: Title old: anyOf: - type: string format: uuid - type: 'null' title: Old new: anyOf: - type: string format: uuid - type: 'null' title: New user_id: anyOf: - type: string format: uuid - type: 'null' title: User Id description: The user who performed the action. created_at: type: string format: date-time title: Created At description: The timestamp of the event. type: object required: - task_id - title - old - new - created_at title: TaskAssigneeChangedEventRead description: Event for when a task assignee is changed. DropdownValueChangedEventRead: properties: wf_exec_id: anyOf: - type: string - type: 'null' title: Wf Exec Id description: The execution ID of the workflow that triggered the event. type: type: string const: dropdown_value_changed title: Type default: dropdown_value_changed definition_id: type: string title: Definition Id definition_ref: type: string title: Definition Ref definition_name: type: string title: Definition Name old_option_id: anyOf: - type: string - type: 'null' title: Old Option Id old_option_label: anyOf: - type: string - type: 'null' title: Old Option Label new_option_id: anyOf: - type: string - type: 'null' title: New Option Id new_option_label: anyOf: - type: string - type: 'null' title: New Option Label user_id: anyOf: - type: string format: uuid - type: 'null' title: User Id description: The user who performed the action. created_at: type: string format: date-time title: Created At description: The timestamp of the event. type: object required: - definition_id - definition_ref - definition_name - created_at title: DropdownValueChangedEventRead description: Event for when a case dropdown value is changed. TableRowLinkedEventRead: properties: wf_exec_id: anyOf: - type: string - type: 'null' title: Wf Exec Id description: The execution ID of the workflow that triggered the event. type: type: string const: table_row_linked title: Type default: table_row_linked table_id: type: string format: uuid title: Table Id table_name: anyOf: - type: string - type: 'null' title: Table Name row_id: type: string format: uuid title: Row Id user_id: anyOf: - type: string format: uuid - type: 'null' title: User Id description: The user who performed the action. created_at: type: string format: date-time title: Created At description: The timestamp of the event. type: object required: - table_id - row_id - created_at title: TableRowLinkedEventRead description: Event for when a table row is linked to a case. TableRowUnlinkedEventRead: properties: wf_exec_id: anyOf: - type: string - type: 'null' title: Wf Exec Id description: The execution ID of the workflow that triggered the event. type: type: string const: table_row_unlinked title: Type default: table_row_unlinked table_id: type: string format: uuid title: Table Id table_name: anyOf: - type: string - type: 'null' title: Table Name row_id: type: string format: uuid title: Row Id user_id: anyOf: - type: string format: uuid - type: 'null' title: User Id description: The user who performed the action. created_at: type: string format: date-time title: Created At description: The timestamp of the event. type: object required: - table_id - row_id - created_at title: TableRowUnlinkedEventRead description: Event for when a table row is unlinked from a case. UserRole: type: string enum: - basic - admin title: UserRole CaseStatus: type: string enum: - unknown - new - in_progress - on_hold - resolved - closed - other title: CaseStatus description: Case status values aligned with OCSF Incident Finding status. CasePriority: type: string enum: - unknown - low - medium - high - critical - other title: CasePriority description: |- Case priority values aligned with urgency levels. Values: UNKNOWN (0): No priority is assigned LOW (1): Application or personal procedure is unusable, where a workaround is available or a repair is possible MEDIUM (2): Non-critical function or procedure is unusable or hard to use causing operational disruptions with no direct impact on a service's availability. A workaround is available HIGH (3): Critical functionality or network access is interrupted, degraded or unusable, having a severe impact on services availability. No acceptable alternative is possible CRITICAL (4): Interruption making a critical functionality inaccessible or a complete network interruption causing a severe impact on services availability. There is no possible alternative OTHER (99): The priority is not normalized CaseSeverity: type: string enum: - unknown - informational - low - medium - high - critical - fatal - other title: CaseSeverity description: |- Case severity values aligned with OCSF severity values. Values: UNKNOWN (0): The event/finding severity is unknown INFORMATIONAL (1): Informational message. No action required LOW (2): The user decides if action is needed MEDIUM (3): Action is required but the situation is not serious at this time HIGH (4): Action is required immediately CRITICAL (5): Action is required immediately and the scope is broad FATAL (6): An error occurred but it is too late to take remedial action OTHER (99): The event/finding severity is not mapped FieldDiff: properties: field: type: string title: Field old: title: Old new: title: New type: object required: - field - old - new title: FieldDiff CaseCommentDeleteMode: type: string enum: - soft - hard CaseTaskStatus: type: string enum: - todo - in_progress - completed - blocked title: CaseTaskStatus description: Case task status values. securitySchemes: APIKeyCookie: type: apiKey in: cookie name: fastapiusersauth ServiceAccountApiKeyBearer: type: http description: Tracecat service account API key. scheme: bearer ````