Search Cases
Search cases with cursor-based pagination, filtering, and sorting.
Authorizations
Path Parameters
Query Parameters
Maximum items per page
1 <= x <= 200Cursor for pagination
Reverse pagination direction
Text to search for in case summary, description, or short ID
Search by exact case short ID (e.g. 42 or CASE-0042)
Filter by case status
Case status values aligned with OCSF Incident Finding status.
unknown, new, in_progress, on_hold, resolved, closed, other Filter by case priority
Case priority values aligned with urgency levels.
Values: UNKNOWN (0): No priority is assigned LOW (1): Application or personal procedure is unusable, where a workaround is available or a repair is possible MEDIUM (2): Non-critical function or procedure is unusable or hard to use causing operational disruptions with no direct impact on a service's availability. A workaround is available HIGH (3): Critical functionality or network access is interrupted, degraded or unusable, having a severe impact on services availability. No acceptable alternative is possible CRITICAL (4): Interruption making a critical functionality inaccessible or a complete network interruption causing a severe impact on services availability. There is no possible alternative OTHER (99): The priority is not normalized
unknown, low, medium, high, critical, other Filter by case severity
Case severity values aligned with OCSF severity values.
Values: UNKNOWN (0): The event/finding severity is unknown INFORMATIONAL (1): Informational message. No action required LOW (2): The user decides if action is needed MEDIUM (3): Action is required but the situation is not serious at this time HIGH (4): Action is required immediately CRITICAL (5): Action is required immediately and the scope is broad FATAL (6): An error occurred but it is too late to take remedial action OTHER (99): The event/finding severity is not mapped
unknown, informational, low, medium, high, critical, fatal, other Filter by tag IDs or slugs (AND logic)
Filter by dropdown values. Format: definition_ref:option_ref (AND across definitions, OR within)
Return cases created at or after this timestamp
Return cases created at or before this timestamp
Return cases updated at or after this timestamp
Return cases updated at or before this timestamp
Filter by assignee ID or 'unassigned'
Column name to order by (e.g. created_at, updated_at, priority, severity, status, tasks). Default: created_at
created_at, updated_at, priority, severity, status, tasks Direction to sort (asc or desc)
asc, desc Include linked table rows
Include only the requested custom field IDs
Include case duration values
Include case payload
Response
Successful Response
Cursor for next page
Cursor for previous page
Whether more items exist
Whether previous items exist
Estimated total count from table statistics