Skip to main content
POST
Error

Authorizations

​
fastapiusersauth
string
cookie
required

Path Parameters

​
workspace_id
string<uuid>
required

Body

application/json

Matching criteria shared by case search and filtered status counts.

Explicit text, identity, and hierarchy constraints are combined with filters using AND. Workspace and entitlement checks belong to the service and cannot be supplied or negated by this request.

Tag membership uses existing filter nodes: in matches any tag, an and of contains conditions requires all tags, and not around in excludes the selected tags. is_null matches no tags.

Scalar dropdown/custom-field exclusions retain SQL NULL semantics: ne, not_in, and negated comparisons exclude unset values. Include unset values explicitly with an or containing is_null.

​
filters
Condition · object

AND/OR/NOT conditions. Payload scalar equality uses field="payload.metadata.product.vendor_name", op="eq", value="Microsoft". Dot-separated literal keys or numeric array indices; keys containing dots are unsupported. Equality preserves JSON types. Payload is_null matches a missing path; explicit JSON null is a present value. Exclusions omit missing paths unless ORed with is_null.

​
search_term
string | null
Maximum string length: 1000
​
search_mode
enum<string> | null

Explicit word/phrase or escaped substring search. Omitted mode retains legacy matching and ordering.

Available options:
full_text,
literal
​
search_columns
enum<string>[] | null
Required array length: 1 - 2 elements
Available options:
summary,
description
​
short_id
string | null
Maximum string length: 1000
​
case_id
string<uuid> | null
​
hierarchy
enum<string>
default:all
Available options:
all,
top_level
​
parent_id
string<uuid> | null
​
status
enum<string>[] | null

Case status values aligned with OCSF Incident Finding status.

Available options:
unknown,
new,
in_progress,
on_hold,
resolved,
closed,
other
​
priority
enum<string>[] | null

Case priority values aligned with urgency levels.

Values: UNKNOWN (0): No priority is assigned LOW (1): Application or personal procedure is unusable, where a workaround is available or a repair is possible MEDIUM (2): Non-critical function or procedure is unusable or hard to use causing operational disruptions with no direct impact on a service's availability. A workaround is available HIGH (3): Critical functionality or network access is interrupted, degraded or unusable, having a severe impact on services availability. No acceptable alternative is possible CRITICAL (4): Interruption making a critical functionality inaccessible or a complete network interruption causing a severe impact on services availability. There is no possible alternative OTHER (99): The priority is not normalized

Available options:
unknown,
low,
medium,
high,
critical,
other
​
severity
enum<string>[] | null

Case severity values aligned with OCSF severity values.

Values: UNKNOWN (0): The event/finding severity is unknown INFORMATIONAL (1): Informational message. No action required LOW (2): The user decides if action is needed MEDIUM (3): Action is required but the situation is not serious at this time HIGH (4): Action is required immediately CRITICAL (5): Action is required immediately and the scope is broad FATAL (6): An error occurred but it is too late to take remedial action OTHER (99): The event/finding severity is not mapped

Available options:
unknown,
informational,
low,
medium,
high,
critical,
fatal,
other
​
assignee_id
(string<uuid> | enum<string>)[] | null
​
tags
string[] | null
Maximum array length: 1000
​
dropdown
string[] | null
Maximum array length: 50
​
start_time
string<date-time> | null
​
end_time
string<date-time> | null
​
updated_after
string<date-time> | null
​
updated_before
string<date-time> | null

Response

Successful Response

​
total
integer
required
​
status_groups
CaseStatusGroupCounts · object
required