> ## Documentation Index > Fetch the complete documentation index at: https://docs.tracecat.com/llms.txt > Use this file to discover all available pages before exploring further. # Query Case Aggregates > Count the same typed matching conditions as search. ## OpenAPI ````yaml https://platform.tracecat.com/api/openapi.json post /workspaces/{workspace_id}/cases/search/aggregate openapi: 3.1.0 info: title: Tracecat API summary: Tracecat API description: The open source AI automation platform for security teams and agents. termsOfService: >- https://docs.google.com/document/d/e/2PACX-1vQvDe3SoVAPoQc51MgfGCP71IqFYX_rMVEde8zC4qmBCec5f8PLKQRdxa6tsUABT8gWAR9J-EVs2CrQ/pub contact: name: Tracecat Founders email: founders@tracecat.com license: name: AGPL-3.0 url: https://www.gnu.org/licenses/agpl-3.0.html version: '1' servers: - url: /api security: [] tags: - name: public description: Public facing endpoints - name: workflows description: Workflow management - name: actions description: Action management - name: triggers description: Workflow triggers - name: secrets description: Secret management - name: variables description: Workspace variable management paths: /workspaces/{workspace_id}/cases/search/aggregate: post: tags: - cases summary: Query Case Aggregates description: Count the same typed matching conditions as search. operationId: cases-query_case_aggregates parameters: - name: workspace_id in: path required: true schema: type: string format: uuid title: Workspace Id requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/CaseQuery' responses: '200': description: Successful Response content: application/json: schema: $ref: '#/components/schemas/CaseSearchAggregateRead' '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' security: - APIKeyCookie: [] - ServiceAccountApiKeyBearer: [] components: schemas: CaseQuery: properties: filters: anyOf: - $ref: '#/components/schemas/Filter' - type: 'null' description: >- AND/OR/NOT conditions. Payload scalar equality uses field="payload.metadata.product.vendor_name", op="eq", value="Microsoft". Dot-separated literal keys or numeric array indices; keys containing dots are unsupported. Equality preserves JSON types. Payload is_null matches a missing path; explicit JSON null is a present value. Exclusions omit missing paths unless ORed with is_null. search_term: anyOf: - type: string maxLength: 1000 - type: 'null' title: Search Term search_mode: anyOf: - $ref: '#/components/schemas/SearchMode' - type: 'null' description: >- Explicit word/phrase or escaped substring search. Omitted mode retains legacy matching and ordering. search_columns: anyOf: - items: type: string enum: - summary - description type: array maxItems: 2 minItems: 1 - type: 'null' title: Search Columns short_id: anyOf: - type: string maxLength: 1000 - type: 'null' title: Short Id case_id: anyOf: - type: string format: uuid - type: 'null' title: Case Id hierarchy: type: string enum: - all - top_level title: Hierarchy default: all parent_id: anyOf: - type: string format: uuid - type: 'null' title: Parent Id status: anyOf: - items: $ref: '#/components/schemas/CaseStatus' type: array - type: 'null' title: Status priority: anyOf: - items: $ref: '#/components/schemas/CasePriority' type: array - type: 'null' title: Priority severity: anyOf: - items: $ref: '#/components/schemas/CaseSeverity' type: array - type: 'null' title: Severity assignee_id: anyOf: - items: anyOf: - type: string format: uuid - type: string enum: - unassigned - __UNASSIGNED__ type: array - type: 'null' title: Assignee Id tags: anyOf: - items: type: string type: array maxItems: 1000 - type: 'null' title: Tags dropdown: anyOf: - items: type: string type: array maxItems: 50 - type: 'null' title: Dropdown start_time: anyOf: - type: string format: date-time - type: 'null' title: Start Time end_time: anyOf: - type: string format: date-time - type: 'null' title: End Time updated_after: anyOf: - type: string format: date-time - type: 'null' title: Updated After updated_before: anyOf: - type: string format: date-time - type: 'null' title: Updated Before additionalProperties: false type: object title: CaseQuery description: >- Matching criteria shared by case search and filtered status counts. Explicit text, identity, and hierarchy constraints are combined with ``filters`` using AND. Workspace and entitlement checks belong to the service and cannot be supplied or negated by this request. Tag membership uses existing filter nodes: ``in`` matches any tag, an ``and`` of ``contains`` conditions requires all tags, and ``not`` around ``in`` excludes the selected tags. ``is_null`` matches no tags. Scalar dropdown/custom-field exclusions retain SQL NULL semantics: ``ne``, ``not_in``, and negated comparisons exclude unset values. Include unset values explicitly with an ``or`` containing ``is_null``. CaseSearchAggregateRead: properties: total: type: integer title: Total status_groups: $ref: '#/components/schemas/CaseStatusGroupCounts' type: object required: - total - status_groups title: CaseSearchAggregateRead HTTPValidationError: properties: detail: items: $ref: '#/components/schemas/ValidationError' type: array title: Detail type: object title: HTTPValidationError Filter: oneOf: - $ref: '#/components/schemas/Condition' - $ref: '#/components/schemas/AndClause' - $ref: '#/components/schemas/OrClause' - $ref: '#/components/schemas/NotClause' SearchMode: type: string enum: - full_text - literal title: SearchMode description: Explicit lexical modes; omitted table mode remains a legacy policy. CaseStatus: type: string enum: - unknown - new - in_progress - on_hold - resolved - closed - other title: CaseStatus description: Case status values aligned with OCSF Incident Finding status. CasePriority: type: string enum: - unknown - low - medium - high - critical - other title: CasePriority description: |- Case priority values aligned with urgency levels. Values: UNKNOWN (0): No priority is assigned LOW (1): Application or personal procedure is unusable, where a workaround is available or a repair is possible MEDIUM (2): Non-critical function or procedure is unusable or hard to use causing operational disruptions with no direct impact on a service's availability. A workaround is available HIGH (3): Critical functionality or network access is interrupted, degraded or unusable, having a severe impact on services availability. No acceptable alternative is possible CRITICAL (4): Interruption making a critical functionality inaccessible or a complete network interruption causing a severe impact on services availability. There is no possible alternative OTHER (99): The priority is not normalized CaseSeverity: type: string enum: - unknown - informational - low - medium - high - critical - fatal - other title: CaseSeverity description: |- Case severity values aligned with OCSF severity values. Values: UNKNOWN (0): The event/finding severity is unknown INFORMATIONAL (1): Informational message. No action required LOW (2): The user decides if action is needed MEDIUM (3): Action is required but the situation is not serious at this time HIGH (4): Action is required immediately CRITICAL (5): Action is required immediately and the scope is broad FATAL (6): An error occurred but it is too late to take remedial action OTHER (99): The event/finding severity is not mapped CaseStatusGroupCounts: properties: new: type: integer title: New default: 0 in_progress: type: integer title: In Progress default: 0 on_hold: type: integer title: On Hold default: 0 resolved: type: integer title: Resolved default: 0 closed: type: integer title: Closed default: 0 unknown: type: integer title: Unknown default: 0 other: type: integer title: Other default: 0 type: object title: CaseStatusGroupCounts ValidationError: properties: loc: items: anyOf: - type: string - type: integer type: array title: Location msg: type: string title: Message type: type: string title: Error Type input: title: Input ctx: type: object title: Context type: object required: - loc - msg - type title: ValidationError Condition: properties: field: type: string minLength: 1 title: Field op: $ref: '#/components/schemas/FilterOp' value: anyOf: - $ref: '#/components/schemas/FilterValue' - type: 'null' additionalProperties: false type: object required: - field - op title: Condition description: A predicate over one resolver-defined field. AndClause: properties: and: items: $ref: '#/components/schemas/Filter' type: array minItems: 1 title: And additionalProperties: false type: object required: - and title: AndClause description: A conjunction of one or more filters. OrClause: properties: or: items: $ref: '#/components/schemas/Filter' type: array minItems: 1 title: Or additionalProperties: false type: object required: - or title: OrClause description: A disjunction of one or more filters. NotClause: properties: not: $ref: '#/components/schemas/Filter' additionalProperties: false type: object required: - not title: NotClause description: The negation of one filter. FilterOp: type: string enum: - eq - ne - in - not_in - gt - gte - lt - lte - contains - starts_with - is_null title: FilterOp description: Operations supported by the shared filter language. FilterValue: anyOf: - $ref: '#/components/schemas/FilterScalar' - items: $ref: '#/components/schemas/FilterScalar' type: array FilterScalar: anyOf: - type: string - type: integer - type: number - type: boolean - type: string pattern: ^(?!^[-+.]*$)[+-]?0*\d*\.?\d*$ - type: string format: date-time - type: string format: date - type: string format: uuid securitySchemes: APIKeyCookie: type: apiKey in: cookie name: fastapiusersauth ServiceAccountApiKeyBearer: type: http description: Tracecat service account API key. scheme: bearer ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.