---
title: "GET /cases"
method: GET
path: "/cases"
tags: ["cases"]
---

# GET /cases

`GET /cases`

## Response `200`

Case workspace list, wrapped as `{"cases": […]}`

- CasesListResponse — GET /cases response wrapper (`api/data_value.rs::list_cases` returns `{"cases": […]}`, not a bare array)
  - `cases` ActionCase[], required
    - `createdAt` string, required
    - `description` string, nullable
    - `entityType` string, nullable
    - `entityValue` string, nullable
    - `evidence` ActionCaseEvidence[], required
      - `createdAt` string, required
      - `description` string, nullable
      - `id` string, required
      - `kind` string, required
      - `payload` object, required
      - `title` string, required
    - `id` string, required
    - `linkedAlertId` string, nullable
    - `linkedCveFindingId` string, nullable
    - `linkedReportId` string, nullable
    - `organizationId` string, nullable
    - `priority` string, required
    - `status` string, required
    - `title` string, required
    - `updatedAt` string, required
    - `userId` string, required

## Other responses

- `401` — Unauthorized

## Changes

- **2026-08-31** `9d9ef31d83e5` — 3 breaking, 1 info
  - the response's body type changed from `array` to `object` for status `200`
  - the response property `message` became nullable for the status `401`
  - the response property `message` became optional for the status `401`
  - added the required property `cases` to the response with the `200` status

[Change history](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/changes/cases/get.md)

---

[API](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api.md) · [All operations](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/llms.txt) · [OpenAPI document](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/revisions/edb544398108?raw)