Skip to main content
GET
Error

Authorizations

fastapiusersauth
string
cookie
required

Path Parameters

workspace_id
string<uuid>
required

Query Parameters

limit
integer
default:20

Maximum items per page

Required range: 1 <= x <= 200
cursor
string | null

Cursor for pagination

reverse
boolean
default:false

Reverse pagination direction

search_term
string | null

Text to search for in case summary, description, short ID, or case UUID

search_mode
enum<string> | null

Explicit full_text or literal; omitted mode preserves legacy search. Explicit lexical modes; omitted table mode remains a legacy policy.

Available options:
full_text,
literal
search_columns
enum<string>[] | null

Selected text fields; omitted searches both.

Available options:
summary,
description
short_id
string | null

Search by exact case short ID (e.g. 42 or CASE-0042)

case_id
string<uuid> | null

Filter by exact case UUID

promote_exact_match
boolean
default:false

Place a complete case reference first, even outside view filters. Workspace authorization and explicit identity/relationship constraints remain strict. Filtered counts exclude cases outside the view.

match_none
boolean
default:false

The ordinary filter population is empty; exact promotion may still match.

status
enum<string>[] | null

Filter by case status

Case status values aligned with OCSF Incident Finding status.

Available options:
unknown,
new,
in_progress,
on_hold,
resolved,
closed,
other
priority
enum<string>[] | null

Filter by case priority

Case priority values aligned with urgency levels.

Values: UNKNOWN (0): No priority is assigned LOW (1): Application or personal procedure is unusable, where a workaround is available or a repair is possible MEDIUM (2): Non-critical function or procedure is unusable or hard to use causing operational disruptions with no direct impact on a service's availability. A workaround is available HIGH (3): Critical functionality or network access is interrupted, degraded or unusable, having a severe impact on services availability. No acceptable alternative is possible CRITICAL (4): Interruption making a critical functionality inaccessible or a complete network interruption causing a severe impact on services availability. There is no possible alternative OTHER (99): The priority is not normalized

Available options:
unknown,
low,
medium,
high,
critical,
other
severity
enum<string>[] | null

Filter by case severity

Case severity values aligned with OCSF severity values.

Values: UNKNOWN (0): The event/finding severity is unknown INFORMATIONAL (1): Informational message. No action required LOW (2): The user decides if action is needed MEDIUM (3): Action is required but the situation is not serious at this time HIGH (4): Action is required immediately CRITICAL (5): Action is required immediately and the scope is broad FATAL (6): An error occurred but it is too late to take remedial action OTHER (99): The event/finding severity is not mapped

Available options:
unknown,
informational,
low,
medium,
high,
critical,
fatal,
other
tags
string[] | null

Filter by tag IDs or slugs (matches cases with any of the tags)

dropdown
string[] | null

Filter by dropdown values. Format: definition_ref:option_ref (AND across definitions, OR within)

start_time
string<date-time> | null

Return cases created at or after this timestamp

end_time
string<date-time> | null

Return cases created at or before this timestamp

updated_after
string<date-time> | null

Return cases updated at or after this timestamp

updated_before
string<date-time> | null

Return cases updated at or before this timestamp

assignee_id
string[] | null

Filter by assignee ID or 'unassigned'

order_by
enum<string> | null

Full-text defaults to relevance; legacy/literal defaults to created_at. Explicit columns preserve their ordering.

Available options:
relevance,
created_at,
updated_at,
priority,
severity,
status,
tasks,
id,
short_id,
assignee,
tags
sort
enum<string> | null

Direction to sort (asc or desc)

Available options:
asc,
desc
include_rows
boolean
default:false

Include linked table rows

field_ids
string[] | null

Include only the requested custom field IDs

include_durations
boolean
default:false

Include case duration values

include_payload
boolean
default:false

Include case payload

payload_fields
string[] | null

Return only these literal top-level payload keys, automatically including the subset regardless of include_payload. Dots are literal; nested values are returned whole. Missing keys are omitted and null values preserved. An empty list acts as omitted; an empty string selects the literal empty key.

include_count
boolean
default:true

Include the exact filtered total_estimate for compatibility. Set false on all pages when fetching aggregate counts separately; total_estimate will be null.

hierarchy
enum<string>
default:all

Return every case, or only top-level cases without a parent.

Available options:
all,
top_level
parent_id
string<uuid> | null

Return only the sub-cases of this parent case

payload_paths
string | null

JSON-encoded array of up to 100 object paths, e.g. [["alert","source","ip"]]. Each path contains 1 to 32 literal keys. Preserves nesting, combines with payload_fields, and includes the subset automatically. Selected parents include their whole value. Missing paths are omitted; nulls are preserved. Arrays can be selected whole, without index traversal. An empty list acts as omitted.

Response

Successful Response

items
CaseReadMinimal · object[]
required
next_cursor
string | null

Cursor for next page

prev_cursor
string | null

Cursor for previous page

has_more
boolean
default:false

Whether more items exist

has_previous
boolean
default:false

Whether previous items exist

total_estimate
integer | null

Estimated total count from table statistics