--- title: "Get Security Case" method: POST path: "/security-case/{id}/get-item" tags: ["Security Case"] --- # Get Security Case `POST /security-case/{id}/get-item` ## Request - Base URL: `https://oneuptime.com/api` - URL: `https://oneuptime.com/api/security-case/{id}/get-item` - Auth: API key in header `APIKey` - TypeScript: (a function with typed inputs; its response is checked against the schema) Endpoint to retrieve a single Security Case by ID ## Path parameters - `id` string, uuid, required ## Request body - object - `select` SecurityCaseSelectSchema: Select schema for SecurityCase. Set fields to true to include them in the response. - `_id` boolean - `createdAt` boolean - `updatedAt` boolean - `deletedAt` boolean - `projectId` boolean - `caseNumber` boolean - `caseNumberWithPrefix` boolean - `title` boolean - `description` boolean - `securityCaseStatusId` boolean - `securityCasePriorityId` boolean - `verdict` boolean - `closingNote` boolean - `assignedToUserId` boolean - `assignedToTeamId` boolean - `source` boolean - `entities` boolean - `mitreTactics` boolean - `mitreTechniques` boolean - `customFields` boolean - `detectionCount` boolean - `firstDetectedAt` boolean - `lastDetectedAt` boolean - `acknowledgedAt` boolean - `containedAt` boolean - `closedAt` boolean - `acknowledgeDueAt` boolean - `containDueAt` boolean - `acknowledgeWarnedAt` boolean - `acknowledgeMissedAt` boolean - `containWarnedAt` boolean - `containMissedAt` boolean - `nextDueAt` boolean - `nextTargetCheckAt` boolean - `closedByUserId` boolean - `groupingKey` boolean - `notifiedSecurityCasePriorityId` boolean - `incidentId` boolean - `aiVerdict` boolean - `aiSuggestedSecurityCasePriorityId` boolean - `aiSuggestedPlaybookId` boolean - `aiTriageReport` boolean - `aiTriagedAt` boolean - `aiTriagePromptInjectionSuspected` boolean - `labels` LabelRelationSelectSchema: What a select may name of the Label records a relation holds: set a field to true to include it. - `_id` boolean - `createdAt` boolean - `updatedAt` boolean - `deletedAt` boolean - `name` boolean - `projectId` boolean - `color` boolean - `isArchived` boolean - `createdByUserId` boolean - `deletedByUserId` boolean ## Response `200` Successful response - object - `data` SecurityCase - `_id` string, uuid: ID of this object. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Security Case], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Security Case] - `createdAt` object: Date and Time when the object was created. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Security Case], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Security Case] - `updatedAt` object: Date and Time when the object was updated. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Security Case], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Security Case] - `deletedAt` object: Date and Time when the object was deleted. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Security Case], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Security Case] - `version` number: Object version - `projectId` string, uuid, required: ID of the project this case belongs to. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Security Case], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `caseNumber` number: The case's number in this project, counting up from 1 as cases are opened. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `caseNumberWithPrefix` string: The case number with the project's case number prefix in front of it, like CASE-42. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `title` string, required: What the case is about, in a line. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Security Case], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Security Case] - `description` string: What is known about the threat, in Markdown. A case opened by a detection starts with the detection's description. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Security Case], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Security Case] - `securityCaseStatusId` string, uuid: ID of the case's status. Optional on create: a new case starts in the project's new status. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Security Case], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Security Case] - `securityCasePriorityId` string, uuid: ID of the case's priority. Optional on create: a case opened by hand starts at the project's medium priority. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Security Case], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Security Case] - `verdict` 'True Positive' | 'Benign Positive' | 'False Positive' | 'Undetermined': What the case turned out to be, set when it is closed: True Positive, Benign Positive, False Positive or Undetermined. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Security Case], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Security Case] - `closingNote` string: Why the case was closed the way it was, in Markdown: what was found and what was done. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Security Case], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Security Case] - `assignedToUserId` string, uuid: ID of the person working the case. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Security Case], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Security Case] - `assignedToTeamId` string, uuid: ID of the team whose queue the case is in. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Security Case], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Security Case] - `source` 'Detection Rule' | 'Threat Intel' | 'Connected Product' | 'Manual' | 'Entity Risk' | 'Data Security': What opened the case: a Detection Rule, Threat Intel, a Connected Product, Entity Risk, or a person (Manual). Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `entities` object: The users, hosts, IP addresses, domains and files the case is about, each as { type, value }. Detections add theirs as they join the case. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Security Case], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Security Case] - `mitreTactics` object: ATT&CK tactic ids (TA0006) the case's detections are tagged with. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Security Case], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Security Case] - `mitreTechniques` object: ATT&CK technique ids (T1110) the case's detections are tagged with. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Security Case], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Security Case] - `customFields` object: The values of the project's own security case fields (Security Events > Settings > Custom Fields), by each field's name. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Security Case], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Security Case] - `detectionCount` number: How many distinct detections the case holds. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `firstDetectedAt` object: When the case's earliest detection fired. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `lastDetectedAt` object: When a detection of the case last fired. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `acknowledgedAt` object: When somebody first took the case on: assigned it to a person, or moved it out of New. The time to acknowledge is measured to here. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `containedAt` object: When the case first reached Contained. The time to contain is measured to here. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `closedAt` object: When the case was closed. Cleared if it is reopened. The time to close is measured to here. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `acknowledgeDueAt` object: When the case must be acknowledged by, from its priority's Acknowledge Within target. Empty when its priority has no target, or when it was acknowledged as it opened. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `containDueAt` object: When the case must be contained or closed by, from its priority's Contain Within target. Empty when its priority has no target. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `acknowledgeWarnedAt` object: When OneUptime told the people on the case that it was about to miss its acknowledge target. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `acknowledgeMissedAt` object: When the case passed its acknowledge due time without being acknowledged. Empty while it has not. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `containWarnedAt` object: When OneUptime told the people on the case that it was about to miss its contain target. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `containMissedAt` object: When the case passed its contain due time without being contained or closed. Empty while it has not. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `nextDueAt` object: The earliest due time of a response target the case has not met yet, a missed one included. Empty when every target is met or the case has none. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `nextTargetCheckAt` object: When OneUptime next checks the case's response targets: when one is about to be missed, or is missed. Empty when there is nothing left to check. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `closedByUserId` string, uuid: ID of the person who closed the case. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `groupingKey` string: What new detections are matched on to join this case while it is open: the entity they are about, or the detection's own fingerprint. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `notifiedSecurityCasePriorityId` string, uuid: ID of the highest priority people have been told about this case at. They are told again only when it rises above it. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `incidentId` string, uuid: ID of the OneUptime incident declared for this case. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `aiVerdict` 'Likely Malicious' | 'Likely Benign' | 'Likely False Positive' | 'Inconclusive': What OneUptime AI made of the case when it triaged it: Likely Malicious, Likely Benign, Likely False Positive or Inconclusive. A suggestion; a person sets the case's verdict. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `aiSuggestedSecurityCasePriorityId` string, uuid: ID of the priority OneUptime AI suggested when it triaged the case. The case's own priority changes only when a person sets it. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `aiSuggestedPlaybookId` string, uuid: ID of the project's playbook OneUptime AI suggested running when it triaged the case. It runs only when a person runs it. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `aiTriageReport` string: The report OneUptime AI wrote when it last triaged the case: what happened, its read and the evidence for it, and the next steps. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `aiTriagedAt` object: When OneUptime AI last finished triaging the case. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `aiTriagePromptInjectionSuspected` boolean: Whether OneUptime AI found text in the case's data written to steer an AI when it triaged the case. It then leaves the call to a person. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `labels` object[]: Labels to filter and report on cases by. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Security Case], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Security Case] - `_id` string, uuid: Unique identifier for the entity - `createdByUserId` string, uuid: ID of the person who opened the case by hand. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `deletedByUserId` string, uuid: ID of the person who deleted the case. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] ## Other responses - `400`: Bad request. This response indicates that the request was malformed or contained invalid data. - `401`: Unauthorized. This response indicates that the request requires user authentication. - `402`: Payment Required. This response indicates that the request requires payment or a valid subscription. - `403`: Forbidden. This response indicates that the server understood the request, but refuses to authorize it. - `404`: Not found. The record does not exist, belongs to another project, or is one you may not read - the same answer for each. - `405`: Project not found. This response indicates that the requested project does not exist or is not accessible. - `408`: Request Timeout. This response indicates that the server timed out waiting for the request. - `415`: Unable to reach server. This response indicates that the server is currently unreachable or down. - `422`: Not authorized. This response indicates that the user does not have permission to access the requested resource. - `500`: Internal Server Error. This response indicates that the server encountered an unexpected condition that prevented it from fulfilling the request. --- [API](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification.md) - [All operations](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification/llms.txt) - [OpenAPI document](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification/revisions/ba3307d00304?raw)