Cases API

The Cases API supports investigation workflows around one or more alerts. Cases preserve ownership, status, notes, timeline, linked evidence, disposition, and approval history.

Case List And Detail

GET/v1/cases

List cases for the current organization.

POST/v1/cases

Create a case manually or from selected alerts.

GET/v1/cases/{caseId}

Fetch a case with linked alerts, notes, timeline, and investigation context.

PATCH/v1/cases/{caseId}

Update core case metadata such as title, priority, assignee, or summary.

Case Lifecycle

POST/v1/cases/{caseId}/assign

Assign or reassign ownership.

POST/v1/cases/{caseId}/status

Update status with an optional reason.

POST/v1/cases/{caseId}/submit-review

Submit a recommended disposition for approval.

POST/v1/cases/{caseId}/review

Approve, reject, or request changes on a submitted disposition.

POST/v1/cases/{caseId}/close

Close a case with a final disposition.

POST/v1/cases/{caseId}/reopen

Reopen a closed case when policy allows.

Case Evidence

POST/v1/cases/{caseId}/alerts

Link one or more alerts to a case.

POST/v1/cases/{caseId}/notes

Add a case note or investigation comment.

GET/v1/cases/{caseId}/timeline

Fetch timeline events for the case.

See Cases And Investigations.