---
title: "List Events With Users"
method: GET
path: "/workspaces/{workspace_id}/cases/{case_id}/events"
tags: ["cases"]
---

# List Events With Users

`GET /workspaces/{workspace_id}/cases/{case_id}/events`

## Request

- Base URL: `https://platform.tracecat.com/api`
- URL: `https://platform.tracecat.com/api/workspaces/{workspace_id}/cases/{case_id}/events`
- Auth: one of:
  - API key in cookie `fastapiusersauth`
  - HTTP bearer

List all users for a case.

## Path parameters

- `case_id` string, uuid, required
- `workspace_id` string, uuid, required

## Response `200`

Successful Response

- CaseEventsWithUsers
  - `events` CaseEventRead[], required: The events for the case.
    - union: Base read model for all event types.
      - CreatedEventRead: Event for when a case is created.
        - `wf_exec_id` string, nullable: The execution ID of the workflow that triggered the event.
        - `type` 'case_created'
        - `user_id` string, uuid, nullable: The user who performed the action.
        - `created_at` string, date-time, required: The timestamp of the event.
      - ClosedEventRead: Event for when a case is closed.
        - `wf_exec_id` string, nullable: The execution ID of the workflow that triggered the event.
        - `type` 'case_closed'
        - `old` 'unknown' | 'new' | 'in_progress' | 'on_hold' | 'resolved' | 'closed' | 'other', required: Case status values aligned with OCSF Incident Finding status.
        - `new` 'unknown' | 'new' | 'in_progress' | 'on_hold' | 'resolved' | 'closed' | 'other', required: Case status values aligned with OCSF Incident Finding status.
        - `user_id` string, uuid, nullable: The user who performed the action.
        - `created_at` string, date-time, required: The timestamp of the event.
      - ReopenedEventRead: Event for when a case is reopened.
        - `wf_exec_id` string, nullable: The execution ID of the workflow that triggered the event.
        - `type` 'case_reopened'
        - `old` 'unknown' | 'new' | 'in_progress' | 'on_hold' | 'resolved' | 'closed' | 'other', required: Case status values aligned with OCSF Incident Finding status.
        - `new` 'unknown' | 'new' | 'in_progress' | 'on_hold' | 'resolved' | 'closed' | 'other', required: Case status values aligned with OCSF Incident Finding status.
        - `user_id` string, uuid, nullable: The user who performed the action.
        - `created_at` string, date-time, required: The timestamp of the event.
      - CaseViewedEventRead: Event for when a case is viewed.
        - `wf_exec_id` string, nullable: The execution ID of the workflow that triggered the event.
        - `type` 'case_viewed'
        - `user_id` string, uuid, nullable: The user who performed the action.
        - `created_at` string, date-time, required: The timestamp of the event.
      - UpdatedEventRead: Event for when a case is updated.
        - `wf_exec_id` string, nullable: The execution ID of the workflow that triggered the event.
        - `type` 'case_updated'
        - `field` 'summary', required
        - `old` string, nullable, required
        - `new` string, nullable, required
        - `user_id` string, uuid, nullable: The user who performed the action.
        - `created_at` string, date-time, required: The timestamp of the event.
      - StatusChangedEventRead: Event for when a case status is changed.
        - `wf_exec_id` string, nullable: The execution ID of the workflow that triggered the event.
        - `type` 'status_changed'
        - `old` 'unknown' | 'new' | 'in_progress' | 'on_hold' | 'resolved' | 'closed' | 'other', required: Case status values aligned with OCSF Incident Finding status.
        - `new` 'unknown' | 'new' | 'in_progress' | 'on_hold' | 'resolved' | 'closed' | 'other', required: Case status values aligned with OCSF Incident Finding status.
        - `user_id` string, uuid, nullable: The user who performed the action.
        - `created_at` string, date-time, required: The timestamp of the event.
      - PriorityChangedEventRead: Event for when a case priority is changed.
        - `wf_exec_id` string, nullable: The execution ID of the workflow that triggered the event.
        - `type` 'priority_changed'
        - `old` 'unknown' | 'low' | 'medium' | 'high' | 'critical' | 'other', required: Case priority values aligned with urgency levels. Values: UNKNOWN (0): No priority is assigned LOW (1): Application or personal procedure is unusable, where a workaround is available or a repair is possible MEDIUM (2): Non-critical function or procedure is unusable or hard to use causing operational disruptions with no direct impact on a service's availability. A workaround is available HIGH (3): Critical functionality or network access is interrupted, degraded or unusable, having a severe impact on services availability. No acceptable alternative is possible CRITICAL (4): Interruption making a critical functionality inaccessible or a complete network interruption causing a severe impact on services availability. There is no possible alternative OTHER (99): The priority is not normalized
        - `new` 'unknown' | 'low' | 'medium' | 'high' | 'critical' | 'other', required: Case priority values aligned with urgency levels. Values: UNKNOWN (0): No priority is assigned LOW (1): Application or personal procedure is unusable, where a workaround is available or a repair is possible MEDIUM (2): Non-critical function or procedure is unusable or hard to use causing operational disruptions with no direct impact on a service's availability. A workaround is available HIGH (3): Critical functionality or network access is interrupted, degraded or unusable, having a severe impact on services availability. No acceptable alternative is possible CRITICAL (4): Interruption making a critical functionality inaccessible or a complete network interruption causing a severe impact on services availability. There is no possible alternative OTHER (99): The priority is not normalized
        - `user_id` string, uuid, nullable: The user who performed the action.
        - `created_at` string, date-time, required: The timestamp of the event.
      - SeverityChangedEventRead: Event for when a case severity is changed.
        - `wf_exec_id` string, nullable: The execution ID of the workflow that triggered the event.
        - `type` 'severity_changed'
        - `old` 'unknown' | 'informational' | 'low' | 'medium' | 'high' | 'critical' | 'fatal' | 'other', required: Case severity values aligned with OCSF severity values. Values: UNKNOWN (0): The event/finding severity is unknown INFORMATIONAL (1): Informational message. No action required LOW (2): The user decides if action is needed MEDIUM (3): Action is required but the situation is not serious at this time HIGH (4): Action is required immediately CRITICAL (5): Action is required immediately and the scope is broad FATAL (6): An error occurred but it is too late to take remedial action OTHER (99): The event/finding severity is not mapped
        - `new` 'unknown' | 'informational' | 'low' | 'medium' | 'high' | 'critical' | 'fatal' | 'other', required: Case severity values aligned with OCSF severity values. Values: UNKNOWN (0): The event/finding severity is unknown INFORMATIONAL (1): Informational message. No action required LOW (2): The user decides if action is needed MEDIUM (3): Action is required but the situation is not serious at this time HIGH (4): Action is required immediately CRITICAL (5): Action is required immediately and the scope is broad FATAL (6): An error occurred but it is too late to take remedial action OTHER (99): The event/finding severity is not mapped
        - `user_id` string, uuid, nullable: The user who performed the action.
        - `created_at` string, date-time, required: The timestamp of the event.
      - FieldChangedEventRead: Event for when a case field is changed.
        - `wf_exec_id` string, nullable: The execution ID of the workflow that triggered the event.
        - `type` 'fields_changed'
        - `changes` FieldDiff[], required
          - `field` string, required
          - `old` unknown, required
          - `new` unknown, required
        - `user_id` string, uuid, nullable: The user who performed the action.
        - `created_at` string, date-time, required: The timestamp of the event.
      - AssigneeChangedEventRead: Event for when a case assignee is changed.
        - `wf_exec_id` string, nullable: The execution ID of the workflow that triggered the event.
        - `type` 'assignee_changed'
        - `old` string, uuid, nullable, required
        - `new` string, uuid, nullable, required
        - `user_id` string, uuid, nullable: The user who performed the action.
        - `created_at` string, date-time, required: The timestamp of the event.
      - AttachmentCreatedEventRead: Event for when an attachment is created for a case.
        - `wf_exec_id` string, nullable: The execution ID of the workflow that triggered the event.
        - `type` 'attachment_created'
        - `attachment_id` string, uuid, required
        - `file_name` string, required
        - `content_type` string, required
        - `size` integer, required
        - `user_id` string, uuid, nullable: The user who performed the action.
        - `created_at` string, date-time, required: The timestamp of the event.
      - AttachmentDeletedEventRead: Event for when an attachment is deleted from a case.
        - `wf_exec_id` string, nullable: The execution ID of the workflow that triggered the event.
        - `type` 'attachment_deleted'
        - `attachment_id` string, uuid, required
        - `file_name` string, required
        - `user_id` string, uuid, nullable: The user who performed the action.
        - `created_at` string, date-time, required: The timestamp of the event.
      - TagAddedEventRead: Event for when a tag is added to a case.
        - `wf_exec_id` string, nullable: The execution ID of the workflow that triggered the event.
        - `type` 'tag_added'
        - `tag_id` string, uuid, required
        - `tag_ref` string, required
        - `tag_name` string, required
        - `user_id` string, uuid, nullable: The user who performed the action.
        - `created_at` string, date-time, required: The timestamp of the event.
      - TagRemovedEventRead: Event for when a tag is removed from a case.
        - `wf_exec_id` string, nullable: The execution ID of the workflow that triggered the event.
        - `type` 'tag_removed'
        - `tag_id` string, uuid, required
        - `tag_ref` string, required
        - `tag_name` string, required
        - `user_id` string, uuid, nullable: The user who performed the action.
        - `created_at` string, date-time, required: The timestamp of the event.
      - PayloadChangedEventRead: Event for when a case payload is changed.
        - `wf_exec_id` string, nullable: The execution ID of the workflow that triggered the event.
        - `type` 'payload_changed'
        - `user_id` string, uuid, nullable: The user who performed the action.
        - `created_at` string, date-time, required: The timestamp of the event.
      - CommentCreatedEventRead: Event for when a top-level comment is created.
        - `wf_exec_id` string, nullable: The execution ID of the workflow that triggered the event.
        - `comment_id` string, uuid, required
        - `parent_id` string, uuid, nullable
        - `thread_root_id` string, uuid, required
        - `type` 'comment_created'
        - `user_id` string, uuid, nullable: The user who performed the action.
        - `created_at` string, date-time, required: The timestamp of the event.
      - CommentUpdatedEventRead: Event for when a top-level comment is updated.
        - `wf_exec_id` string, nullable: The execution ID of the workflow that triggered the event.
        - `comment_id` string, uuid, required
        - `parent_id` string, uuid, nullable
        - `thread_root_id` string, uuid, required
        - `type` 'comment_updated'
        - `user_id` string, uuid, nullable: The user who performed the action.
        - `created_at` string, date-time, required: The timestamp of the event.
      - CommentDeletedEventRead: Event for when a top-level comment is deleted.
        - `wf_exec_id` string, nullable: The execution ID of the workflow that triggered the event.
        - `comment_id` string, uuid, required
        - `parent_id` string, uuid, nullable
        - `thread_root_id` string, uuid, required
        - `type` 'comment_deleted'
        - `delete_mode` 'soft' | 'hard', required
        - `user_id` string, uuid, nullable: The user who performed the action.
        - `created_at` string, date-time, required: The timestamp of the event.
      - CommentReplyCreatedEventRead: Event for when a reply is created.
        - `wf_exec_id` string, nullable: The execution ID of the workflow that triggered the event.
        - `comment_id` string, uuid, required
        - `parent_id` string, uuid, nullable
        - `thread_root_id` string, uuid, required
        - `type` 'comment_reply_created'
        - `user_id` string, uuid, nullable: The user who performed the action.
        - `created_at` string, date-time, required: The timestamp of the event.
      - CommentReplyUpdatedEventRead: Event for when a reply is updated.
        - `wf_exec_id` string, nullable: The execution ID of the workflow that triggered the event.
        - `comment_id` string, uuid, required
        - `parent_id` string, uuid, nullable
        - `thread_root_id` string, uuid, required
        - `type` 'comment_reply_updated'
        - `user_id` string, uuid, nullable: The user who performed the action.
        - `created_at` string, date-time, required: The timestamp of the event.
      - CommentReplyDeletedEventRead: Event for when a reply is deleted.
        - `wf_exec_id` string, nullable: The execution ID of the workflow that triggered the event.
        - `comment_id` string, uuid, required
        - `parent_id` string, uuid, nullable
        - `thread_root_id` string, uuid, required
        - `type` 'comment_reply_deleted'
        - `delete_mode` 'soft' | 'hard', required
        - `user_id` string, uuid, nullable: The user who performed the action.
        - `created_at` string, date-time, required: The timestamp of the event.
      - TaskCreatedEventRead: Event for when a task is created for a case.
        - `wf_exec_id` string, nullable: The execution ID of the workflow that triggered the event.
        - `type` 'task_created'
        - `task_id` string, uuid, required
        - `title` string, required
        - `user_id` string, uuid, nullable: The user who performed the action.
        - `created_at` string, date-time, required: The timestamp of the event.
      - TaskStatusChangedEventRead: Event for when a task status is changed.
        - `wf_exec_id` string, nullable: The execution ID of the workflow that triggered the event.
        - `type` 'task_status_changed'
        - `task_id` string, uuid, required
        - `title` string, required
        - `old` 'todo' | 'in_progress' | 'completed' | 'blocked', required: Case task status values.
        - `new` 'todo' | 'in_progress' | 'completed' | 'blocked', required: Case task status values.
        - `user_id` string, uuid, nullable: The user who performed the action.
        - `created_at` string, date-time, required: The timestamp of the event.
      - TaskPriorityChangedEventRead: Event for when a task priority is changed.
        - `wf_exec_id` string, nullable: The execution ID of the workflow that triggered the event.
        - `type` 'task_priority_changed'
        - `task_id` string, uuid, required
        - `title` string, required
        - `old` 'unknown' | 'low' | 'medium' | 'high' | 'critical' | 'other', required: Case priority values aligned with urgency levels. Values: UNKNOWN (0): No priority is assigned LOW (1): Application or personal procedure is unusable, where a workaround is available or a repair is possible MEDIUM (2): Non-critical function or procedure is unusable or hard to use causing operational disruptions with no direct impact on a service's availability. A workaround is available HIGH (3): Critical functionality or network access is interrupted, degraded or unusable, having a severe impact on services availability. No acceptable alternative is possible CRITICAL (4): Interruption making a critical functionality inaccessible or a complete network interruption causing a severe impact on services availability. There is no possible alternative OTHER (99): The priority is not normalized
        - `new` 'unknown' | 'low' | 'medium' | 'high' | 'critical' | 'other', required: Case priority values aligned with urgency levels. Values: UNKNOWN (0): No priority is assigned LOW (1): Application or personal procedure is unusable, where a workaround is available or a repair is possible MEDIUM (2): Non-critical function or procedure is unusable or hard to use causing operational disruptions with no direct impact on a service's availability. A workaround is available HIGH (3): Critical functionality or network access is interrupted, degraded or unusable, having a severe impact on services availability. No acceptable alternative is possible CRITICAL (4): Interruption making a critical functionality inaccessible or a complete network interruption causing a severe impact on services availability. There is no possible alternative OTHER (99): The priority is not normalized
        - `user_id` string, uuid, nullable: The user who performed the action.
        - `created_at` string, date-time, required: The timestamp of the event.
      - TaskWorkflowChangedEventRead: Event for when a task workflow is changed.
        - `wf_exec_id` string, nullable: The execution ID of the workflow that triggered the event.
        - `type` 'task_workflow_changed'
        - `task_id` string, uuid, required
        - `title` string, required
        - `old` union, required
          - string
          - string
          - string
        - `new` union, required
          - string
          - string
          - string
        - `user_id` string, uuid, nullable: The user who performed the action.
        - `created_at` string, date-time, required: The timestamp of the event.
      - TaskDeletedEventRead: Event for when a task is deleted for a case.
        - `wf_exec_id` string, nullable: The execution ID of the workflow that triggered the event.
        - `type` 'task_deleted'
        - `task_id` string, uuid, required
        - `title` string, nullable
        - `user_id` string, uuid, nullable: The user who performed the action.
        - `created_at` string, date-time, required: The timestamp of the event.
      - TaskAssigneeChangedEventRead: Event for when a task assignee is changed.
        - `wf_exec_id` string, nullable: The execution ID of the workflow that triggered the event.
        - `type` 'task_assignee_changed'
        - `task_id` string, uuid, required
        - `title` string, required
        - `old` string, uuid, nullable, required
        - `new` string, uuid, nullable, required
        - `user_id` string, uuid, nullable: The user who performed the action.
        - `created_at` string, date-time, required: The timestamp of the event.
      - DropdownValueChangedEventRead: Event for when a case dropdown value is changed.
        - `wf_exec_id` string, nullable: The execution ID of the workflow that triggered the event.
        - `type` 'dropdown_value_changed'
        - `definition_id` string, required
        - `definition_ref` string, required
        - `definition_name` string, required
        - `old_option_id` string, nullable
        - `old_option_label` string, nullable
        - `new_option_id` string, nullable
        - `new_option_label` string, nullable
        - `user_id` string, uuid, nullable: The user who performed the action.
        - `created_at` string, date-time, required: The timestamp of the event.
      - TableRowLinkedEventRead: Event for when a table row is linked to a case.
        - `wf_exec_id` string, nullable: The execution ID of the workflow that triggered the event.
        - `type` 'table_row_linked'
        - `table_id` string, uuid, required
        - `table_name` string, nullable
        - `row_id` string, uuid, required
        - `user_id` string, uuid, nullable: The user who performed the action.
        - `created_at` string, date-time, required: The timestamp of the event.
      - TableRowUnlinkedEventRead: Event for when a table row is unlinked from a case.
        - `wf_exec_id` string, nullable: The execution ID of the workflow that triggered the event.
        - `type` 'table_row_unlinked'
        - `table_id` string, uuid, required
        - `table_name` string, nullable
        - `row_id` string, uuid, required
        - `user_id` string, uuid, nullable: The user who performed the action.
        - `created_at` string, date-time, required: The timestamp of the event.
      - ParentChangedEventRead: Event for when a case is grouped under, moved to, or removed from a parent.
        - `wf_exec_id` string, nullable: The execution ID of the workflow that triggered the event.
        - `type` 'parent_changed'
        - `old` CaseRef: Stable reference to another case recorded in event data.
          - `id` string, uuid, required
          - `short_id` string, required
        - `new` CaseRef: Stable reference to another case recorded in event data.
          - `id` string, uuid, required
          - `short_id` string, required
        - `user_id` string, uuid, nullable: The user who performed the action.
        - `created_at` string, date-time, required: The timestamp of the event.
      - SubCasesAddedEventRead: Event for when cases are grouped under this case as sub-cases.
        - `wf_exec_id` string, nullable: The execution ID of the workflow that triggered the event.
        - `type` 'sub_cases_added'
        - `sub_cases` CaseRef[], required
          - `id` string, uuid, required
          - `short_id` string, required
        - `user_id` string, uuid, nullable: The user who performed the action.
        - `created_at` string, date-time, required: The timestamp of the event.
      - SubCasesRemovedEventRead: Event for when sub-cases are removed from this case.
        - `wf_exec_id` string, nullable: The execution ID of the workflow that triggered the event.
        - `type` 'sub_cases_removed'
        - `sub_cases` CaseRef[], required
          - `id` string, uuid, required
          - `short_id` string, required
        - `user_id` string, uuid, nullable: The user who performed the action.
        - `created_at` string, date-time, required: The timestamp of the event.
  - `users` UserRead[], required: The users for the case.
    - `id` string, uuid, required
    - `email` string, email, required
    - `is_active` boolean
    - `is_superuser` boolean
    - `is_verified` boolean
    - `role` 'basic' | 'admin', required
    - `first_name` string, nullable
    - `last_name` string, nullable
    - `settings` object, required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/tracecat/apis/tracecat-api.md) - [All operations](https://skmtc.dev/tracecat/apis/tracecat-api/llms.txt) - [OpenAPI document](https://skmtc.dev/tracecat/apis/tracecat-api/revisions/2efdda25045f?raw)