Skip to main content
GET
/
workspaces
/
{workspace_id}
/
cases
/
search
/
aggregate
Error
A valid request URL is required to generate request examples
{
  "total": 123,
  "status_groups": {
    "new": 0,
    "in_progress": 0,
    "on_hold": 0,
    "resolved": 0,
    "closed": 0,
    "unknown": 0,
    "other": 0
  }
}
{
  "detail": [
    {
      "loc": [
        "<string>"
      ],
      "msg": "<string>",
      "type": "<string>",
      "input": "<unknown>",
      "ctx": {}
    }
  ]
}

Authorizations

​
fastapiusersauth
string
cookie
required

Path Parameters

​
workspace_id
string<uuid>
required

Query Parameters

​
search_term
string | null

Text to search for in case summary, description, or short ID

​
status
enum<string>[] | null

Filter by case status

Case status values aligned with OCSF Incident Finding status.

Available options:
unknown,
new,
in_progress,
on_hold,
resolved,
closed,
other
​
priority
enum<string>[] | null

Filter by case priority

Case priority values aligned with urgency levels.

Values: UNKNOWN (0): No priority is assigned LOW (1): Application or personal procedure is unusable, where a workaround is available or a repair is possible MEDIUM (2): Non-critical function or procedure is unusable or hard to use causing operational disruptions with no direct impact on a service's availability. A workaround is available HIGH (3): Critical functionality or network access is interrupted, degraded or unusable, having a severe impact on services availability. No acceptable alternative is possible CRITICAL (4): Interruption making a critical functionality inaccessible or a complete network interruption causing a severe impact on services availability. There is no possible alternative OTHER (99): The priority is not normalized

Available options:
unknown,
low,
medium,
high,
critical,
other
​
severity
enum<string>[] | null

Filter by case severity

Case severity values aligned with OCSF severity values.

Values: UNKNOWN (0): The event/finding severity is unknown INFORMATIONAL (1): Informational message. No action required LOW (2): The user decides if action is needed MEDIUM (3): Action is required but the situation is not serious at this time HIGH (4): Action is required immediately CRITICAL (5): Action is required immediately and the scope is broad FATAL (6): An error occurred but it is too late to take remedial action OTHER (99): The event/finding severity is not mapped

Available options:
unknown,
informational,
low,
medium,
high,
critical,
fatal,
other
​
tags
string[] | null

Filter by tag IDs or slugs (AND logic)

​
dropdown
string[] | null

Filter by dropdown values. Format: definition_ref:option_ref (AND across definitions, OR within)

​
start_time
string<date-time> | null

Return cases created at or after this timestamp

​
end_time
string<date-time> | null

Return cases created at or before this timestamp

​
updated_after
string<date-time> | null

Return cases updated at or after this timestamp

​
updated_before
string<date-time> | null

Return cases updated at or before this timestamp

​
assignee_id
string[] | null

Filter by assignee ID or 'unassigned'

Response

Successful Response

​
total
integer
required
​
status_groups
CaseStatusGroupCounts · object
required