Search Cases
Search cases with cursor-based pagination, filtering, and sorting.
Authorizations
Path Parameters
Query Parameters
Maximum items per page
1 <= x <= 200Cursor for pagination
Reverse pagination direction
Text to search for in case summary, description, short ID, or case UUID
Explicit full_text or literal; omitted mode preserves legacy search. Explicit lexical modes; omitted table mode remains a legacy policy.
full_text, literal Selected text fields; omitted searches both.
summary, description Search by exact case short ID (e.g. 42 or CASE-0042)
Filter by exact case UUID
Place a complete case reference first, even outside view filters. Workspace authorization and explicit identity/relationship constraints remain strict. Filtered counts exclude cases outside the view.
The ordinary filter population is empty; exact promotion may still match.
Filter by case status
Case status values aligned with OCSF Incident Finding status.
unknown, new, in_progress, on_hold, resolved, closed, other Filter by case priority
Case priority values aligned with urgency levels.
Values: UNKNOWN (0): No priority is assigned LOW (1): Application or personal procedure is unusable, where a workaround is available or a repair is possible MEDIUM (2): Non-critical function or procedure is unusable or hard to use causing operational disruptions with no direct impact on a service's availability. A workaround is available HIGH (3): Critical functionality or network access is interrupted, degraded or unusable, having a severe impact on services availability. No acceptable alternative is possible CRITICAL (4): Interruption making a critical functionality inaccessible or a complete network interruption causing a severe impact on services availability. There is no possible alternative OTHER (99): The priority is not normalized
unknown, low, medium, high, critical, other Filter by case severity
Case severity values aligned with OCSF severity values.
Values: UNKNOWN (0): The event/finding severity is unknown INFORMATIONAL (1): Informational message. No action required LOW (2): The user decides if action is needed MEDIUM (3): Action is required but the situation is not serious at this time HIGH (4): Action is required immediately CRITICAL (5): Action is required immediately and the scope is broad FATAL (6): An error occurred but it is too late to take remedial action OTHER (99): The event/finding severity is not mapped
unknown, informational, low, medium, high, critical, fatal, other Filter by tag IDs or slugs (matches cases with any of the tags)
Filter by dropdown values. Format: definition_ref:option_ref (AND across definitions, OR within)
Return cases created at or after this timestamp
Return cases created at or before this timestamp
Return cases updated at or after this timestamp
Return cases updated at or before this timestamp
Filter by assignee ID or 'unassigned'
Full-text defaults to relevance; legacy/literal defaults to created_at. Explicit columns preserve their ordering.
relevance, created_at, updated_at, priority, severity, status, tasks, id, short_id, assignee, tags Direction to sort (asc or desc)
asc, desc Include linked table rows
Include only the requested custom field IDs
Include case duration values
Include case payload
Return only these literal top-level payload keys, automatically including the subset regardless of include_payload. Dots are literal; nested values are returned whole. Missing keys are omitted and null values preserved. An empty list acts as omitted; an empty string selects the literal empty key.
Include the exact filtered total_estimate for compatibility. Set false on all pages when fetching aggregate counts separately; total_estimate will be null.
Return every case, or only top-level cases without a parent.
all, top_level Return only the sub-cases of this parent case
JSON-encoded array of up to 100 object paths, e.g. [["alert","source","ip"]]. Each path contains 1 to 32 literal keys. Preserves nesting, combines with payload_fields, and includes the subset automatically. Selected parents include their whole value. Missing paths are omitted; nulls are preserved. Arrays can be selected whole, without index traversal. An empty list acts as omitted.
Response
Successful Response
Cursor for next page
Cursor for previous page
Whether more items exist
Whether previous items exist
Estimated total count from table statistics