--- title: "List Security Case" method: POST path: "/security-case/get-list" tags: ["Security Case"] --- # List Security Case `POST /security-case/get-list` ## Request - Base URL: `https://oneuptime.com/api` - URL: `https://oneuptime.com/api/security-case/get-list` - Auth: API key in header `APIKey` - TypeScript: (a function with typed inputs; its response is checked against the schema) Endpoint to list all Security Case items ## Request body - object - `query` SecurityCaseQuerySchema: Query schema for SecurityCase. A field takes a value, which it matches exactly, or an operator its type allows. A relation is filtered by the fields of the record it names, {"": {"": }}, and a resource with owners by who owns it, {"owners": {"_type": "OwnedBy", "userIds": [...], "teamIds": [...]}}. - `_id` union: A filter on a Object ID field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes. - string, uuid - object - `_type` 'EqualTo', required - `value` string, uuid, required - object - `_type` 'NotEqual', required - `value` string, uuid, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, uuid, required - object - `_type` 'Includes', required - `value` string[], required - `createdAt` union: A filter on a Date field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z. - string, date-time - object - `_type` 'EqualTo', required - `value` string, date-time, required - object - `_type` 'NotEqual', required - `value` string, date-time, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, date-time, required - object - `_type` 'GreaterThan', required - `value` string, date-time, required - object - `_type` 'LessThan', required - `value` string, date-time, required - object - `_type` 'GreaterThanOrEqual', required - `value` string, date-time, required - object - `_type` 'LessThanOrEqual', required - `value` string, date-time, required - object - `_type` 'InBetween', required - `startValue` string, date-time, required - `endValue` string, date-time, required - `updatedAt` union: A filter on a Date field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z. - string, date-time - object - `_type` 'EqualTo', required - `value` string, date-time, required - object - `_type` 'NotEqual', required - `value` string, date-time, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, date-time, required - object - `_type` 'GreaterThan', required - `value` string, date-time, required - object - `_type` 'LessThan', required - `value` string, date-time, required - object - `_type` 'GreaterThanOrEqual', required - `value` string, date-time, required - object - `_type` 'LessThanOrEqual', required - `value` string, date-time, required - object - `_type` 'InBetween', required - `startValue` string, date-time, required - `endValue` string, date-time, required - `deletedAt` union: A filter on a Date field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z. - string, date-time - object - `_type` 'EqualTo', required - `value` string, date-time, required - object - `_type` 'NotEqual', required - `value` string, date-time, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, date-time, required - object - `_type` 'GreaterThan', required - `value` string, date-time, required - object - `_type` 'LessThan', required - `value` string, date-time, required - object - `_type` 'GreaterThanOrEqual', required - `value` string, date-time, required - object - `_type` 'LessThanOrEqual', required - `value` string, date-time, required - object - `_type` 'InBetween', required - `startValue` string, date-time, required - `endValue` string, date-time, required - `projectId` union: A filter on a Object ID field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes. - string, uuid - object - `_type` 'EqualTo', required - `value` string, uuid, required - object - `_type` 'NotEqual', required - `value` string, uuid, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, uuid, required - object - `_type` 'Includes', required - `value` string[], required - `caseNumber` union: A filter on a Number field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. - number - object - `_type` 'EqualTo', required - `value` number, required - object - `_type` 'NotEqual', required - `value` number, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` number, required - object - `_type` 'GreaterThan', required - `value` number, required - object - `_type` 'LessThan', required - `value` number, required - object - `_type` 'GreaterThanOrEqual', required - `value` number, required - object - `_type` 'LessThanOrEqual', required - `value` number, required - object - `_type` 'InBetween', required - `startValue` number, required - `endValue` number, required - `caseNumberWithPrefix` union: A filter on a Text field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes. - string - object - `_type` 'EqualTo', required - `value` string, required - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - object - `_type` 'Includes', required - `value` string[], required - `title` union: A filter on a Long Text field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes. - string - object - `_type` 'EqualTo', required - `value` string, required - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - object - `_type` 'Includes', required - `value` string[], required - `description` union: A filter on a Markdown field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes. - string - object - `_type` 'EqualTo', required - `value` string, required - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - object - `_type` 'Includes', required - `value` string[], required - `securityCaseStatusId` union: A filter on a Object ID field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes. - string, uuid - object - `_type` 'EqualTo', required - `value` string, uuid, required - object - `_type` 'NotEqual', required - `value` string, uuid, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, uuid, required - object - `_type` 'Includes', required - `value` string[], required - `securityCasePriorityId` union: A filter on a Object ID field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes. - string, uuid - object - `_type` 'EqualTo', required - `value` string, uuid, required - object - `_type` 'NotEqual', required - `value` string, uuid, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, uuid, required - object - `_type` 'Includes', required - `value` string[], required - `verdict` union: A filter on a Text field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes. - string - object - `_type` 'EqualTo', required - `value` string, required - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - object - `_type` 'Includes', required - `value` string[], required - `closingNote` union: A filter on a Markdown field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes. - string - object - `_type` 'EqualTo', required - `value` string, required - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - object - `_type` 'Includes', required - `value` string[], required - `assignedToUserId` union: A filter on a Object ID field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes. - string, uuid - object - `_type` 'EqualTo', required - `value` string, uuid, required - object - `_type` 'NotEqual', required - `value` string, uuid, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, uuid, required - object - `_type` 'Includes', required - `value` string[], required - `assignedToTeamId` union: A filter on a Object ID field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes. - string, uuid - object - `_type` 'EqualTo', required - `value` string, uuid, required - object - `_type` 'NotEqual', required - `value` string, uuid, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, uuid, required - object - `_type` 'Includes', required - `value` string[], required - `source` union: A filter on a Text field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes. - string - object - `_type` 'EqualTo', required - `value` string, required - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - object - `_type` 'Includes', required - `value` string[], required - `entities` union: A filter on a JSON field, by key: {"": {"": }}. A key takes a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. IsNull and NotNull on the field itself ask whether it holds anything. - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `mitreTactics` union: A filter on a JSON field, by key: {"": {"": }}. A key takes a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. IsNull and NotNull on the field itself ask whether it holds anything. - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `mitreTechniques` union: A filter on a JSON field, by key: {"": {"": }}. A key takes a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. IsNull and NotNull on the field itself ask whether it holds anything. - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `customFields` union: A filter on a JSON field, by key: {"": {"": }}. A key takes a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. IsNull and NotNull on the field itself ask whether it holds anything. - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `detectionCount` union: A filter on a Number field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. - number - object - `_type` 'EqualTo', required - `value` number, required - object - `_type` 'NotEqual', required - `value` number, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` number, required - object - `_type` 'GreaterThan', required - `value` number, required - object - `_type` 'LessThan', required - `value` number, required - object - `_type` 'GreaterThanOrEqual', required - `value` number, required - object - `_type` 'LessThanOrEqual', required - `value` number, required - object - `_type` 'InBetween', required - `startValue` number, required - `endValue` number, required - `firstDetectedAt` union: A filter on a Date field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z. - string, date-time - object - `_type` 'EqualTo', required - `value` string, date-time, required - object - `_type` 'NotEqual', required - `value` string, date-time, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, date-time, required - object - `_type` 'GreaterThan', required - `value` string, date-time, required - object - `_type` 'LessThan', required - `value` string, date-time, required - object - `_type` 'GreaterThanOrEqual', required - `value` string, date-time, required - object - `_type` 'LessThanOrEqual', required - `value` string, date-time, required - object - `_type` 'InBetween', required - `startValue` string, date-time, required - `endValue` string, date-time, required - `lastDetectedAt` union: A filter on a Date field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z. - string, date-time - object - `_type` 'EqualTo', required - `value` string, date-time, required - object - `_type` 'NotEqual', required - `value` string, date-time, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, date-time, required - object - `_type` 'GreaterThan', required - `value` string, date-time, required - object - `_type` 'LessThan', required - `value` string, date-time, required - object - `_type` 'GreaterThanOrEqual', required - `value` string, date-time, required - object - `_type` 'LessThanOrEqual', required - `value` string, date-time, required - object - `_type` 'InBetween', required - `startValue` string, date-time, required - `endValue` string, date-time, required - `acknowledgedAt` union: A filter on a Date field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z. - string, date-time - object - `_type` 'EqualTo', required - `value` string, date-time, required - object - `_type` 'NotEqual', required - `value` string, date-time, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, date-time, required - object - `_type` 'GreaterThan', required - `value` string, date-time, required - object - `_type` 'LessThan', required - `value` string, date-time, required - object - `_type` 'GreaterThanOrEqual', required - `value` string, date-time, required - object - `_type` 'LessThanOrEqual', required - `value` string, date-time, required - object - `_type` 'InBetween', required - `startValue` string, date-time, required - `endValue` string, date-time, required - `containedAt` union: A filter on a Date field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z. - string, date-time - object - `_type` 'EqualTo', required - `value` string, date-time, required - object - `_type` 'NotEqual', required - `value` string, date-time, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, date-time, required - object - `_type` 'GreaterThan', required - `value` string, date-time, required - object - `_type` 'LessThan', required - `value` string, date-time, required - object - `_type` 'GreaterThanOrEqual', required - `value` string, date-time, required - object - `_type` 'LessThanOrEqual', required - `value` string, date-time, required - object - `_type` 'InBetween', required - `startValue` string, date-time, required - `endValue` string, date-time, required - `closedAt` union: A filter on a Date field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z. - string, date-time - object - `_type` 'EqualTo', required - `value` string, date-time, required - object - `_type` 'NotEqual', required - `value` string, date-time, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, date-time, required - object - `_type` 'GreaterThan', required - `value` string, date-time, required - object - `_type` 'LessThan', required - `value` string, date-time, required - object - `_type` 'GreaterThanOrEqual', required - `value` string, date-time, required - object - `_type` 'LessThanOrEqual', required - `value` string, date-time, required - object - `_type` 'InBetween', required - `startValue` string, date-time, required - `endValue` string, date-time, required - `acknowledgeDueAt` union: A filter on a Date field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z. - string, date-time - object - `_type` 'EqualTo', required - `value` string, date-time, required - object - `_type` 'NotEqual', required - `value` string, date-time, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, date-time, required - object - `_type` 'GreaterThan', required - `value` string, date-time, required - object - `_type` 'LessThan', required - `value` string, date-time, required - object - `_type` 'GreaterThanOrEqual', required - `value` string, date-time, required - object - `_type` 'LessThanOrEqual', required - `value` string, date-time, required - object - `_type` 'InBetween', required - `startValue` string, date-time, required - `endValue` string, date-time, required - `containDueAt` union: A filter on a Date field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z. - string, date-time - object - `_type` 'EqualTo', required - `value` string, date-time, required - object - `_type` 'NotEqual', required - `value` string, date-time, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, date-time, required - object - `_type` 'GreaterThan', required - `value` string, date-time, required - object - `_type` 'LessThan', required - `value` string, date-time, required - object - `_type` 'GreaterThanOrEqual', required - `value` string, date-time, required - object - `_type` 'LessThanOrEqual', required - `value` string, date-time, required - object - `_type` 'InBetween', required - `startValue` string, date-time, required - `endValue` string, date-time, required - `acknowledgeWarnedAt` union: A filter on a Date field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z. - string, date-time - object - `_type` 'EqualTo', required - `value` string, date-time, required - object - `_type` 'NotEqual', required - `value` string, date-time, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, date-time, required - object - `_type` 'GreaterThan', required - `value` string, date-time, required - object - `_type` 'LessThan', required - `value` string, date-time, required - object - `_type` 'GreaterThanOrEqual', required - `value` string, date-time, required - object - `_type` 'LessThanOrEqual', required - `value` string, date-time, required - object - `_type` 'InBetween', required - `startValue` string, date-time, required - `endValue` string, date-time, required - `acknowledgeMissedAt` union: A filter on a Date field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z. - string, date-time - object - `_type` 'EqualTo', required - `value` string, date-time, required - object - `_type` 'NotEqual', required - `value` string, date-time, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, date-time, required - object - `_type` 'GreaterThan', required - `value` string, date-time, required - object - `_type` 'LessThan', required - `value` string, date-time, required - object - `_type` 'GreaterThanOrEqual', required - `value` string, date-time, required - object - `_type` 'LessThanOrEqual', required - `value` string, date-time, required - object - `_type` 'InBetween', required - `startValue` string, date-time, required - `endValue` string, date-time, required - `containWarnedAt` union: A filter on a Date field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z. - string, date-time - object - `_type` 'EqualTo', required - `value` string, date-time, required - object - `_type` 'NotEqual', required - `value` string, date-time, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, date-time, required - object - `_type` 'GreaterThan', required - `value` string, date-time, required - object - `_type` 'LessThan', required - `value` string, date-time, required - object - `_type` 'GreaterThanOrEqual', required - `value` string, date-time, required - object - `_type` 'LessThanOrEqual', required - `value` string, date-time, required - object - `_type` 'InBetween', required - `startValue` string, date-time, required - `endValue` string, date-time, required - `containMissedAt` union: A filter on a Date field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z. - string, date-time - object - `_type` 'EqualTo', required - `value` string, date-time, required - object - `_type` 'NotEqual', required - `value` string, date-time, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, date-time, required - object - `_type` 'GreaterThan', required - `value` string, date-time, required - object - `_type` 'LessThan', required - `value` string, date-time, required - object - `_type` 'GreaterThanOrEqual', required - `value` string, date-time, required - object - `_type` 'LessThanOrEqual', required - `value` string, date-time, required - object - `_type` 'InBetween', required - `startValue` string, date-time, required - `endValue` string, date-time, required - `nextDueAt` union: A filter on a Date field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z. - string, date-time - object - `_type` 'EqualTo', required - `value` string, date-time, required - object - `_type` 'NotEqual', required - `value` string, date-time, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, date-time, required - object - `_type` 'GreaterThan', required - `value` string, date-time, required - object - `_type` 'LessThan', required - `value` string, date-time, required - object - `_type` 'GreaterThanOrEqual', required - `value` string, date-time, required - object - `_type` 'LessThanOrEqual', required - `value` string, date-time, required - object - `_type` 'InBetween', required - `startValue` string, date-time, required - `endValue` string, date-time, required - `nextTargetCheckAt` union: A filter on a Date field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z. - string, date-time - object - `_type` 'EqualTo', required - `value` string, date-time, required - object - `_type` 'NotEqual', required - `value` string, date-time, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, date-time, required - object - `_type` 'GreaterThan', required - `value` string, date-time, required - object - `_type` 'LessThan', required - `value` string, date-time, required - object - `_type` 'GreaterThanOrEqual', required - `value` string, date-time, required - object - `_type` 'LessThanOrEqual', required - `value` string, date-time, required - object - `_type` 'InBetween', required - `startValue` string, date-time, required - `endValue` string, date-time, required - `closedByUserId` union: A filter on a Object ID field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes. - string, uuid - object - `_type` 'EqualTo', required - `value` string, uuid, required - object - `_type` 'NotEqual', required - `value` string, uuid, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, uuid, required - object - `_type` 'Includes', required - `value` string[], required - `groupingKey` union: A filter on a Long Text field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes. - string - object - `_type` 'EqualTo', required - `value` string, required - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - object - `_type` 'Includes', required - `value` string[], required - `notifiedSecurityCasePriorityId` union: A filter on a Object ID field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes. - string, uuid - object - `_type` 'EqualTo', required - `value` string, uuid, required - object - `_type` 'NotEqual', required - `value` string, uuid, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, uuid, required - object - `_type` 'Includes', required - `value` string[], required - `incidentId` union: A filter on a Object ID field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes. - string, uuid - object - `_type` 'EqualTo', required - `value` string, uuid, required - object - `_type` 'NotEqual', required - `value` string, uuid, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, uuid, required - object - `_type` 'Includes', required - `value` string[], required - `aiVerdict` union: A filter on a Text field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes. - string - object - `_type` 'EqualTo', required - `value` string, required - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - object - `_type` 'Includes', required - `value` string[], required - `aiSuggestedSecurityCasePriorityId` union: A filter on a Object ID field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes. - string, uuid - object - `_type` 'EqualTo', required - `value` string, uuid, required - object - `_type` 'NotEqual', required - `value` string, uuid, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, uuid, required - object - `_type` 'Includes', required - `value` string[], required - `aiSuggestedPlaybookId` union: A filter on a Object ID field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes. - string, uuid - object - `_type` 'EqualTo', required - `value` string, uuid, required - object - `_type` 'NotEqual', required - `value` string, uuid, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, uuid, required - object - `_type` 'Includes', required - `value` string[], required - `aiTriageReport` union: A filter on a Markdown field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes. - string - object - `_type` 'EqualTo', required - `value` string, required - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - object - `_type` 'Includes', required - `value` string[], required - `aiTriagedAt` union: A filter on a Date field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z. - string, date-time - object - `_type` 'EqualTo', required - `value` string, date-time, required - object - `_type` 'NotEqual', required - `value` string, date-time, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, date-time, required - object - `_type` 'GreaterThan', required - `value` string, date-time, required - object - `_type` 'LessThan', required - `value` string, date-time, required - object - `_type` 'GreaterThanOrEqual', required - `value` string, date-time, required - object - `_type` 'LessThanOrEqual', required - `value` string, date-time, required - object - `_type` 'InBetween', required - `startValue` string, date-time, required - `endValue` string, date-time, required - `aiTriagePromptInjectionSuspected` union: A filter on a Boolean field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull. - boolean - object - `_type` 'EqualTo', required - `value` boolean, required - object - `_type` 'NotEqual', required - `value` boolean, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` boolean, required - `labels` union: A filter on a Entity Array field: a value, which it matches exactly, or one of these operators: EqualTo, IsNull, NotNull, Includes. A list of ids, or Includes, matches the records related to any of them; IsNull those related to none. - string[] - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'Includes', required - `value` string[], required - `createdByUserId` union: A filter on a Object ID field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes. - string, uuid - object - `_type` 'EqualTo', required - `value` string, uuid, required - object - `_type` 'NotEqual', required - `value` string, uuid, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, uuid, required - object - `_type` 'Includes', required - `value` string[], required - `deletedByUserId` union: A filter on a Object ID field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes. - string, uuid - object - `_type` 'EqualTo', required - `value` string, uuid, required - object - `_type` 'NotEqual', required - `value` string, uuid, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, uuid, required - object - `_type` 'Includes', required - `value` string[], required - `select` SecurityCaseSelectSchema: Select schema for SecurityCase. Set fields to true to include them in the response. - `_id` boolean - `createdAt` boolean - `updatedAt` boolean - `deletedAt` boolean - `projectId` boolean - `caseNumber` boolean - `caseNumberWithPrefix` boolean - `title` boolean - `description` boolean - `securityCaseStatusId` boolean - `securityCasePriorityId` boolean - `verdict` boolean - `closingNote` boolean - `assignedToUserId` boolean - `assignedToTeamId` boolean - `source` boolean - `entities` boolean - `mitreTactics` boolean - `mitreTechniques` boolean - `customFields` boolean - `detectionCount` boolean - `firstDetectedAt` boolean - `lastDetectedAt` boolean - `acknowledgedAt` boolean - `containedAt` boolean - `closedAt` boolean - `acknowledgeDueAt` boolean - `containDueAt` boolean - `acknowledgeWarnedAt` boolean - `acknowledgeMissedAt` boolean - `containWarnedAt` boolean - `containMissedAt` boolean - `nextDueAt` boolean - `nextTargetCheckAt` boolean - `closedByUserId` boolean - `groupingKey` boolean - `notifiedSecurityCasePriorityId` boolean - `incidentId` boolean - `aiVerdict` boolean - `aiSuggestedSecurityCasePriorityId` boolean - `aiSuggestedPlaybookId` boolean - `aiTriageReport` boolean - `aiTriagedAt` boolean - `aiTriagePromptInjectionSuspected` boolean - `labels` LabelRelationSelectSchema: What a select may name of the Label records a relation holds: set a field to true to include it. - `_id` boolean - `createdAt` boolean - `updatedAt` boolean - `deletedAt` boolean - `name` boolean - `projectId` boolean - `color` boolean - `isArchived` boolean - `createdByUserId` boolean - `deletedByUserId` boolean - `sort` SecurityCaseSortSchema: Sort schema for SecurityCase. Only sortable fields are included. - `_id` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `createdAt` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `updatedAt` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `deletedAt` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `projectId` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `caseNumber` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `caseNumberWithPrefix` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `title` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `securityCaseStatusId` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `securityCasePriorityId` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `verdict` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `assignedToUserId` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `assignedToTeamId` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `source` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `detectionCount` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `firstDetectedAt` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `lastDetectedAt` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `acknowledgedAt` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `containedAt` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `closedAt` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `acknowledgeDueAt` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `containDueAt` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `acknowledgeWarnedAt` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `acknowledgeMissedAt` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `containWarnedAt` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `containMissedAt` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `nextDueAt` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `nextTargetCheckAt` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `closedByUserId` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `groupingKey` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `notifiedSecurityCasePriorityId` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `incidentId` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `aiVerdict` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `aiSuggestedSecurityCasePriorityId` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `aiSuggestedPlaybookId` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `aiTriagedAt` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `aiTriagePromptInjectionSuspected` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `createdByUserId` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `deletedByUserId` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `limit` number: Maximum number of items to return. Defaults to 10. - `skip` number: Number of items to skip for pagination. Defaults to 0. ## Response `200` Successful response - object - `data` SecurityCase[] - `_id` string, uuid: ID of this object. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Security Case], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Security Case] - `createdAt` object: Date and Time when the object was created. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Security Case], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Security Case] - `updatedAt` object: Date and Time when the object was updated. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Security Case], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Security Case] - `deletedAt` object: Date and Time when the object was deleted. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Security Case], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Security Case] - `version` number: Object version - `projectId` string, uuid, required: ID of the project this case belongs to. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Security Case], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `caseNumber` number: The case's number in this project, counting up from 1 as cases are opened. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `caseNumberWithPrefix` string: The case number with the project's case number prefix in front of it, like CASE-42. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `title` string, required: What the case is about, in a line. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Security Case], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Security Case] - `description` string: What is known about the threat, in Markdown. A case opened by a detection starts with the detection's description. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Security Case], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Security Case] - `securityCaseStatusId` string, uuid: ID of the case's status. Optional on create: a new case starts in the project's new status. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Security Case], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Security Case] - `securityCasePriorityId` string, uuid: ID of the case's priority. Optional on create: a case opened by hand starts at the project's medium priority. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Security Case], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Security Case] - `verdict` 'True Positive' | 'Benign Positive' | 'False Positive' | 'Undetermined': What the case turned out to be, set when it is closed: True Positive, Benign Positive, False Positive or Undetermined. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Security Case], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Security Case] - `closingNote` string: Why the case was closed the way it was, in Markdown: what was found and what was done. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Security Case], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Security Case] - `assignedToUserId` string, uuid: ID of the person working the case. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Security Case], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Security Case] - `assignedToTeamId` string, uuid: ID of the team whose queue the case is in. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Security Case], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Security Case] - `source` 'Detection Rule' | 'Threat Intel' | 'Connected Product' | 'Manual' | 'Entity Risk' | 'Data Security': What opened the case: a Detection Rule, Threat Intel, a Connected Product, Entity Risk, or a person (Manual). Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `entities` object: The users, hosts, IP addresses, domains and files the case is about, each as { type, value }. Detections add theirs as they join the case. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Security Case], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Security Case] - `mitreTactics` object: ATT&CK tactic ids (TA0006) the case's detections are tagged with. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Security Case], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Security Case] - `mitreTechniques` object: ATT&CK technique ids (T1110) the case's detections are tagged with. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Security Case], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Security Case] - `customFields` object: The values of the project's own security case fields (Security Events > Settings > Custom Fields), by each field's name. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Security Case], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Security Case] - `detectionCount` number: How many distinct detections the case holds. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `firstDetectedAt` object: When the case's earliest detection fired. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `lastDetectedAt` object: When a detection of the case last fired. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `acknowledgedAt` object: When somebody first took the case on: assigned it to a person, or moved it out of New. The time to acknowledge is measured to here. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `containedAt` object: When the case first reached Contained. The time to contain is measured to here. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `closedAt` object: When the case was closed. Cleared if it is reopened. The time to close is measured to here. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `acknowledgeDueAt` object: When the case must be acknowledged by, from its priority's Acknowledge Within target. Empty when its priority has no target, or when it was acknowledged as it opened. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `containDueAt` object: When the case must be contained or closed by, from its priority's Contain Within target. Empty when its priority has no target. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `acknowledgeWarnedAt` object: When OneUptime told the people on the case that it was about to miss its acknowledge target. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `acknowledgeMissedAt` object: When the case passed its acknowledge due time without being acknowledged. Empty while it has not. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `containWarnedAt` object: When OneUptime told the people on the case that it was about to miss its contain target. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `containMissedAt` object: When the case passed its contain due time without being contained or closed. Empty while it has not. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `nextDueAt` object: The earliest due time of a response target the case has not met yet, a missed one included. Empty when every target is met or the case has none. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `nextTargetCheckAt` object: When OneUptime next checks the case's response targets: when one is about to be missed, or is missed. Empty when there is nothing left to check. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `closedByUserId` string, uuid: ID of the person who closed the case. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `groupingKey` string: What new detections are matched on to join this case while it is open: the entity they are about, or the detection's own fingerprint. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `notifiedSecurityCasePriorityId` string, uuid: ID of the highest priority people have been told about this case at. They are told again only when it rises above it. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `incidentId` string, uuid: ID of the OneUptime incident declared for this case. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `aiVerdict` 'Likely Malicious' | 'Likely Benign' | 'Likely False Positive' | 'Inconclusive': What OneUptime AI made of the case when it triaged it: Likely Malicious, Likely Benign, Likely False Positive or Inconclusive. A suggestion; a person sets the case's verdict. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `aiSuggestedSecurityCasePriorityId` string, uuid: ID of the priority OneUptime AI suggested when it triaged the case. The case's own priority changes only when a person sets it. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `aiSuggestedPlaybookId` string, uuid: ID of the project's playbook OneUptime AI suggested running when it triaged the case. It runs only when a person runs it. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `aiTriageReport` string: The report OneUptime AI wrote when it last triaged the case: what happened, its read and the evidence for it, and the next steps. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `aiTriagedAt` object: When OneUptime AI last finished triaging the case. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `aiTriagePromptInjectionSuspected` boolean: Whether OneUptime AI found text in the case's data written to steer an AI when it triaged the case. It then leaves the call to a person. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `labels` object[]: Labels to filter and report on cases by. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Security Case], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Security Case] - `_id` string, uuid: Unique identifier for the entity - `createdByUserId` string, uuid: ID of the person who opened the case by hand. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `deletedByUserId` string, uuid: ID of the person who deleted the case. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Case], Update: [No access - you don't have permission for this operation] - `count` number ## Other responses - `400`: Bad request. This response indicates that the request was malformed or contained invalid data. - `401`: Unauthorized. This response indicates that the request requires user authentication. - `402`: Payment Required. This response indicates that the request requires payment or a valid subscription. - `403`: Forbidden. This response indicates that the server understood the request, but refuses to authorize it. - `405`: Project not found. This response indicates that the requested project does not exist or is not accessible. - `408`: Request Timeout. This response indicates that the server timed out waiting for the request. - `415`: Unable to reach server. This response indicates that the server is currently unreachable or down. - `422`: Not authorized. This response indicates that the user does not have permission to access the requested resource. - `500`: Internal Server Error. This response indicates that the server encountered an unexpected condition that prevented it from fulfilling the request. --- [API](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification.md) - [All operations](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification/llms.txt) - [OpenAPI document](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification/revisions/ba3307d00304?raw)