> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tracecat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Query Cases

> Search with typed AND/OR/NOT filters and independent result details.



## OpenAPI

````yaml https://platform.tracecat.com/api/openapi.json post /workspaces/{workspace_id}/cases/search
openapi: 3.1.0
info:
  title: Tracecat API
  summary: Tracecat API
  description: The open source AI automation platform for security teams and agents.
  termsOfService: >-
    https://docs.google.com/document/d/e/2PACX-1vQvDe3SoVAPoQc51MgfGCP71IqFYX_rMVEde8zC4qmBCec5f8PLKQRdxa6tsUABT8gWAR9J-EVs2CrQ/pub
  contact:
    name: Tracecat Founders
    email: founders@tracecat.com
  license:
    name: AGPL-3.0
    url: https://www.gnu.org/licenses/agpl-3.0.html
  version: '1'
servers:
  - url: /api
security: []
tags:
  - name: public
    description: Public facing endpoints
  - name: workflows
    description: Workflow management
  - name: actions
    description: Action management
  - name: triggers
    description: Workflow triggers
  - name: secrets
    description: Secret management
  - name: variables
    description: Workspace variable management
paths:
  /workspaces/{workspace_id}/cases/search:
    post:
      tags:
        - cases
      summary: Query Cases
      description: Search with typed AND/OR/NOT filters and independent result details.
      operationId: cases-query_cases
      parameters:
        - name: workspace_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Workspace Id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CaseSearchRequest'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CursorPaginatedResponse_CaseReadMinimal_'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
        - APIKeyCookie: []
        - ServiceAccountApiKeyBearer: []
components:
  schemas:
    CaseSearchRequest:
      properties:
        limit:
          type: integer
          maximum: 200
          minimum: 1
          title: Limit
          description: Maximum items per page
          default: 20
        cursor:
          anyOf:
            - type: string
            - type: 'null'
          title: Cursor
          description: Cursor for pagination
        reverse:
          type: boolean
          title: Reverse
          description: Reverse pagination direction
          default: false
        filters:
          anyOf:
            - $ref: '#/components/schemas/Filter'
            - type: 'null'
          description: >-
            AND/OR/NOT conditions. Payload scalar equality uses
            field="payload.metadata.product.vendor_name", op="eq",
            value="Microsoft". Dot-separated literal keys or numeric array
            indices; keys containing dots are unsupported. Equality preserves
            JSON types. Payload is_null matches a missing path; explicit JSON
            null is a present value. Exclusions omit missing paths unless ORed
            with is_null.
        search_term:
          anyOf:
            - type: string
              maxLength: 1000
            - type: 'null'
          title: Search Term
        search_mode:
          anyOf:
            - $ref: '#/components/schemas/SearchMode'
            - type: 'null'
          description: >-
            Explicit word/phrase or escaped substring search. Omitted mode
            retains legacy matching and ordering.
        search_columns:
          anyOf:
            - items:
                type: string
                enum:
                  - summary
                  - description
              type: array
              maxItems: 2
              minItems: 1
            - type: 'null'
          title: Search Columns
        short_id:
          anyOf:
            - type: string
              maxLength: 1000
            - type: 'null'
          title: Short Id
        case_id:
          anyOf:
            - type: string
              format: uuid
            - type: 'null'
          title: Case Id
        hierarchy:
          type: string
          enum:
            - all
            - top_level
          title: Hierarchy
          default: all
        parent_id:
          anyOf:
            - type: string
              format: uuid
            - type: 'null'
          title: Parent Id
        status:
          anyOf:
            - items:
                $ref: '#/components/schemas/CaseStatus'
              type: array
            - type: 'null'
          title: Status
        priority:
          anyOf:
            - items:
                $ref: '#/components/schemas/CasePriority'
              type: array
            - type: 'null'
          title: Priority
        severity:
          anyOf:
            - items:
                $ref: '#/components/schemas/CaseSeverity'
              type: array
            - type: 'null'
          title: Severity
        assignee_id:
          anyOf:
            - items:
                anyOf:
                  - type: string
                    format: uuid
                  - type: string
                    enum:
                      - unassigned
                      - __UNASSIGNED__
              type: array
            - type: 'null'
          title: Assignee Id
        tags:
          anyOf:
            - items:
                type: string
              type: array
              maxItems: 1000
            - type: 'null'
          title: Tags
        dropdown:
          anyOf:
            - items:
                type: string
              type: array
              maxItems: 50
            - type: 'null'
          title: Dropdown
        start_time:
          anyOf:
            - type: string
              format: date-time
            - type: 'null'
          title: Start Time
        end_time:
          anyOf:
            - type: string
              format: date-time
            - type: 'null'
          title: End Time
        updated_after:
          anyOf:
            - type: string
              format: date-time
            - type: 'null'
          title: Updated After
        updated_before:
          anyOf:
            - type: string
              format: date-time
            - type: 'null'
          title: Updated Before
        order_by:
          anyOf:
            - $ref: '#/components/schemas/CaseSearchOrder'
            - type: 'null'
        sort:
          anyOf:
            - type: string
              enum:
                - asc
                - desc
            - type: 'null'
          title: Sort
        include_rows:
          type: boolean
          title: Include Rows
          default: false
        field_ids:
          anyOf:
            - items:
                type: string
              type: array
            - type: 'null'
          title: Field Ids
        include_durations:
          type: boolean
          title: Include Durations
          default: false
        include_payload:
          type: boolean
          title: Include Payload
          default: false
        payload_fields:
          anyOf:
            - items:
                type: string
              type: array
              maxItems: 100
            - type: 'null'
          title: Payload Fields
        payload_paths:
          anyOf:
            - items:
                items:
                  type: string
                type: array
                maxItems: 32
                minItems: 1
              type: array
              maxItems: 100
            - type: 'null'
          title: Payload Paths
        include_count:
          type: boolean
          title: Include Count
          default: true
        promote_exact_match:
          type: boolean
          title: Promote Exact Match
          description: >-
            Place complete case references before filtered text matches within
            the authorized workspace.
          default: false
        match_none:
          type: boolean
          title: Match None
          description: The ordinary filter population matches no cases.
          default: false
      additionalProperties: false
      type: object
      title: CaseSearchRequest
      description: A case query with pagination, sorting, and independent result details.
    CursorPaginatedResponse_CaseReadMinimal_:
      properties:
        items:
          items:
            $ref: '#/components/schemas/CaseReadMinimal'
          type: array
          title: Items
        next_cursor:
          anyOf:
            - type: string
            - type: 'null'
          title: Next Cursor
          description: Cursor for next page
        prev_cursor:
          anyOf:
            - type: string
            - type: 'null'
          title: Prev Cursor
          description: Cursor for previous page
        has_more:
          type: boolean
          title: Has More
          description: Whether more items exist
          default: false
        has_previous:
          type: boolean
          title: Has Previous
          description: Whether previous items exist
          default: false
        total_estimate:
          anyOf:
            - type: integer
            - type: 'null'
          title: Total Estimate
          description: Estimated total count from table statistics
      type: object
      required:
        - items
      title: CursorPaginatedResponse[CaseReadMinimal]
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    Filter:
      oneOf:
        - $ref: '#/components/schemas/Condition'
        - $ref: '#/components/schemas/AndClause'
        - $ref: '#/components/schemas/OrClause'
        - $ref: '#/components/schemas/NotClause'
    SearchMode:
      type: string
      enum:
        - full_text
        - literal
      title: SearchMode
      description: Explicit lexical modes; omitted table mode remains a legacy policy.
    CaseStatus:
      type: string
      enum:
        - unknown
        - new
        - in_progress
        - on_hold
        - resolved
        - closed
        - other
      title: CaseStatus
      description: Case status values aligned with OCSF Incident Finding status.
    CasePriority:
      type: string
      enum:
        - unknown
        - low
        - medium
        - high
        - critical
        - other
      title: CasePriority
      description: |-
        Case priority values aligned with urgency levels.

        Values:
            UNKNOWN (0): No priority is assigned
            LOW (1): Application or personal procedure is unusable, where a workaround is available or a repair is possible
            MEDIUM (2): Non-critical function or procedure is unusable or hard to use causing operational disruptions with no direct impact on a service's availability. A workaround is available
            HIGH (3): Critical functionality or network access is interrupted, degraded or unusable, having a severe impact on services availability. No acceptable alternative is possible
            CRITICAL (4): Interruption making a critical functionality inaccessible or a complete network interruption causing a severe impact on services availability. There is no possible alternative
            OTHER (99): The priority is not normalized
    CaseSeverity:
      type: string
      enum:
        - unknown
        - informational
        - low
        - medium
        - high
        - critical
        - fatal
        - other
      title: CaseSeverity
      description: |-
        Case severity values aligned with OCSF severity values.

        Values:
            UNKNOWN (0): The event/finding severity is unknown
            INFORMATIONAL (1): Informational message. No action required
            LOW (2): The user decides if action is needed
            MEDIUM (3): Action is required but the situation is not serious at this time
            HIGH (4): Action is required immediately
            CRITICAL (5): Action is required immediately and the scope is broad
            FATAL (6): An error occurred but it is too late to take remedial action
            OTHER (99): The event/finding severity is not mapped
    CaseSearchOrder:
      type: string
      enum:
        - relevance
        - created_at
        - updated_at
        - priority
        - severity
        - status
        - tasks
        - id
        - short_id
        - assignee
        - tags
    CaseReadMinimal:
      properties:
        is_exact_match:
          type: boolean
          title: Is Exact Match
          description: This row is the promoted exact case reference.
          default: false
        is_outside_filters:
          type: boolean
          title: Is Outside Filters
          description: The promoted reference falls outside the filtered results.
          default: false
        id:
          type: string
          format: uuid
          title: Id
        short_id:
          type: string
          title: Short Id
        search_match:
          anyOf:
            - $ref: '#/components/schemas/CaseSearchMatchRead'
            - type: 'null'
        created_at:
          type: string
          format: date-time
          title: Created At
        updated_at:
          type: string
          format: date-time
          title: Updated At
        summary:
          type: string
          title: Summary
        status:
          $ref: '#/components/schemas/CaseStatus'
        priority:
          $ref: '#/components/schemas/CasePriority'
        severity:
          $ref: '#/components/schemas/CaseSeverity'
        assignee:
          anyOf:
            - $ref: '#/components/schemas/UserRead'
            - type: 'null'
        tags:
          items:
            $ref: '#/components/schemas/CaseTagRead'
          type: array
          title: Tags
        dropdown_values:
          items:
            $ref: '#/components/schemas/CaseDropdownValueRead'
          type: array
          title: Dropdown Values
        rows:
          items:
            $ref: '#/components/schemas/CaseTableRowRead'
          type: array
          title: Rows
        durations:
          anyOf:
            - items:
                $ref: '#/components/schemas/CaseDurationRead'
              type: array
            - type: 'null'
          title: Durations
        field_values:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Field Values
        payload:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Payload
        num_tasks_completed:
          type: integer
          title: Num Tasks Completed
          default: 0
        num_tasks_total:
          type: integer
          title: Num Tasks Total
          default: 0
        parent:
          anyOf:
            - $ref: '#/components/schemas/CaseParentRead'
            - type: 'null'
        num_sub_cases:
          type: integer
          title: Num Sub Cases
      type: object
      required:
        - id
        - short_id
        - created_at
        - updated_at
        - summary
        - status
        - priority
        - severity
        - dropdown_values
        - num_sub_cases
      title: CaseReadMinimal
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
              - type: string
              - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
        input:
          title: Input
        ctx:
          type: object
          title: Context
      type: object
      required:
        - loc
        - msg
        - type
      title: ValidationError
    Condition:
      properties:
        field:
          type: string
          minLength: 1
          title: Field
        op:
          $ref: '#/components/schemas/FilterOp'
        value:
          anyOf:
            - $ref: '#/components/schemas/FilterValue'
            - type: 'null'
      additionalProperties: false
      type: object
      required:
        - field
        - op
      title: Condition
      description: A predicate over one resolver-defined field.
    AndClause:
      properties:
        and:
          items:
            $ref: '#/components/schemas/Filter'
          type: array
          minItems: 1
          title: And
      additionalProperties: false
      type: object
      required:
        - and
      title: AndClause
      description: A conjunction of one or more filters.
    OrClause:
      properties:
        or:
          items:
            $ref: '#/components/schemas/Filter'
          type: array
          minItems: 1
          title: Or
      additionalProperties: false
      type: object
      required:
        - or
      title: OrClause
      description: A disjunction of one or more filters.
    NotClause:
      properties:
        not:
          $ref: '#/components/schemas/Filter'
      additionalProperties: false
      type: object
      required:
        - not
      title: NotClause
      description: The negation of one filter.
    CaseSearchMatchRead:
      properties:
        score:
          anyOf:
            - type: number
              minimum: 0
            - type: 'null'
          title: Score
        matched_columns:
          items:
            type: string
            enum:
              - summary
              - description
              - id
              - short_id
          type: array
          maxItems: 4
          title: Matched Columns
        excerpts:
          items:
            type: string
            maxLength: 240
          type: array
          maxItems: 2
          title: Excerpts
      type: object
      title: CaseSearchMatchRead
      description: >-
        Bounded lexical metadata beside case fields; excerpts are untrusted
        text.
    UserRead:
      properties:
        id:
          type: string
          format: uuid
          title: Id
        email:
          type: string
          format: email
          title: Email
        is_active:
          type: boolean
          title: Is Active
          default: true
        is_superuser:
          type: boolean
          title: Is Superuser
          default: false
        is_verified:
          type: boolean
          title: Is Verified
          default: false
        role:
          $ref: '#/components/schemas/UserRole'
        first_name:
          anyOf:
            - type: string
            - type: 'null'
          title: First Name
        last_name:
          anyOf:
            - type: string
            - type: 'null'
          title: Last Name
        settings:
          additionalProperties: true
          type: object
          title: Settings
      type: object
      required:
        - id
        - email
        - role
        - settings
      title: UserRead
    CaseTagRead:
      properties:
        id:
          type: string
          format: uuid
          title: Id
        name:
          type: string
          title: Name
        ref:
          type: string
          title: Ref
        color:
          anyOf:
            - type: string
            - type: 'null'
          title: Color
      type: object
      required:
        - id
        - name
        - ref
        - color
      title: CaseTagRead
      description: Tag data.
    CaseDropdownValueRead:
      properties:
        id:
          type: string
          format: uuid
          title: Id
        definition_id:
          type: string
          format: uuid
          title: Definition Id
        definition_ref:
          type: string
          title: Definition Ref
        definition_name:
          type: string
          title: Definition Name
        option_id:
          anyOf:
            - type: string
              format: uuid
            - type: 'null'
          title: Option Id
        option_label:
          anyOf:
            - type: string
            - type: 'null'
          title: Option Label
        option_ref:
          anyOf:
            - type: string
            - type: 'null'
          title: Option Ref
        option_icon_name:
          anyOf:
            - type: string
            - type: 'null'
          title: Option Icon Name
        option_color:
          anyOf:
            - type: string
            - type: 'null'
          title: Option Color
      type: object
      required:
        - id
        - definition_id
        - definition_ref
        - definition_name
      title: CaseDropdownValueRead
      description: Per-case dropdown value with full definition/option info.
    CaseTableRowRead:
      properties:
        id:
          type: string
          format: uuid
          title: Id
        case_id:
          type: string
          format: uuid
          title: Case Id
        table_id:
          type: string
          format: uuid
          title: Table Id
        table_name:
          anyOf:
            - type: string
            - type: 'null'
          title: Table Name
        row_id:
          type: string
          format: uuid
          title: Row Id
        row_data:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Row Data
        is_row_available:
          type: boolean
          title: Is Row Available
          default: true
        created_at:
          type: string
          format: date-time
          title: Created At
        updated_at:
          type: string
          format: date-time
          title: Updated At
      type: object
      required:
        - id
        - case_id
        - table_id
        - row_id
        - created_at
        - updated_at
      title: CaseTableRowRead
    CaseDurationRead:
      properties:
        definition_id:
          type: string
          format: uuid
          title: Definition Id
          description: Identifier of the case duration definition generating this duration.
        start_event_id:
          anyOf:
            - type: string
              format: uuid
            - type: 'null'
          title: Start Event Id
          description: Case event that started the duration, if available.
        end_event_id:
          anyOf:
            - type: string
              format: uuid
            - type: 'null'
          title: End Event Id
          description: Case event that ended the duration, if available.
        started_at:
          anyOf:
            - type: string
              format: date-time
            - type: 'null'
          title: Started At
          description: Timestamp when the duration began.
        ended_at:
          anyOf:
            - type: string
              format: date-time
            - type: 'null'
          title: Ended At
          description: Timestamp when the duration ended.
        duration:
          anyOf:
            - type: string
              format: duration
            - type: 'null'
          title: Duration
          description: Total elapsed time between start and end timestamps.
        id:
          type: string
          format: uuid
          title: Id
        case_id:
          type: string
          format: uuid
          title: Case Id
      type: object
      required:
        - definition_id
        - id
        - case_id
      title: CaseDurationRead
      description: Read model for case duration records.
    CaseParentRead:
      properties:
        id:
          type: string
          format: uuid
          title: Id
        short_id:
          type: string
          title: Short Id
        summary:
          type: string
          title: Summary
      type: object
      required:
        - id
        - short_id
        - summary
      title: CaseParentRead
      description: Summary of a sub-case's parent case.
    FilterOp:
      type: string
      enum:
        - eq
        - ne
        - in
        - not_in
        - gt
        - gte
        - lt
        - lte
        - contains
        - starts_with
        - is_null
      title: FilterOp
      description: Operations supported by the shared filter language.
    FilterValue:
      anyOf:
        - $ref: '#/components/schemas/FilterScalar'
        - items:
            $ref: '#/components/schemas/FilterScalar'
          type: array
    UserRole:
      type: string
      enum:
        - basic
        - admin
      title: UserRole
    FilterScalar:
      anyOf:
        - type: string
        - type: integer
        - type: number
        - type: boolean
        - type: string
          pattern: ^(?!^[-+.]*$)[+-]?0*\d*\.?\d*$
        - type: string
          format: date-time
        - type: string
          format: date
        - type: string
          format: uuid
  securitySchemes:
    APIKeyCookie:
      type: apiKey
      in: cookie
      name: fastapiusersauth
    ServiceAccountApiKeyBearer:
      type: http
      description: Tracecat service account API key.
      scheme: bearer

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.