---
title: "POST /cases"
method: POST
path: "/cases"
tags: ["cases"]
---

# POST /cases

`POST /cases`

## Request body

- CreateActionCaseRequest — Create-case request (`api/data_value.rs::CreateCaseRequest`)
  - `description` string, nullable
  - `entityType` string, nullable
  - `entityValue` string, nullable
  - `evidence` object, nullable — Initial evidence payload attached to the case at creation
  - `linkedAlertId` string, nullable
  - `linkedCveFindingId` string, nullable
  - `linkedReportId` string, nullable
  - `priority` string, nullable
  - `sourceId` string, nullable — Identifier of the originating record
  - `sourceType` string, nullable — Origin surface of the case (e.g. `report`, `alert`) — used with `sourceId` to resolve the linked record and seed initial evidence
  - `title` string, required

## Response `201`

Created case

- ActionCase
  - `createdAt` string, required
  - `description` string, nullable
  - `entityType` string, nullable
  - `entityValue` string, nullable
  - `evidence` ActionCaseEvidence[], required
    - `createdAt` string, required
    - `description` string, nullable
    - `id` string, required
    - `kind` string, required
    - `payload` object, required
    - `title` string, required
  - `id` string, required
  - `linkedAlertId` string, nullable
  - `linkedCveFindingId` string, nullable
  - `linkedReportId` string, nullable
  - `organizationId` string, nullable
  - `priority` string, required
  - `status` string, required
  - `title` string, required
  - `updatedAt` string, required
  - `userId` string, required

## Other responses

- `400` — Title is required
- `401` — Unauthorized

## Changes

- **2026-08-31** `9d9ef31d83e5` — 4 breaking, 3 info
  - the response property `message` became nullable for the status `400`
  - the response property `message` became nullable for the status `401`
  - the response property `message` became optional for the status `400`
  - the response property `message` became optional for the status `401`
  - …3 more

[Change history](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/changes/cases/post.md)

---

[API](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api.md) · [All operations](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/llms.txt) · [OpenAPI document](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/revisions/edb544398108?raw)