---
title: "Update Case"
method: PATCH
path: "/workspaces/{workspace_id}/cases/{case_id}"
tags: ["cases"]
---

# Update Case

`PATCH /workspaces/{workspace_id}/cases/{case_id}`

## Request

- Base URL: `https://platform.tracecat.com/api`
- URL: `https://platform.tracecat.com/api/workspaces/{workspace_id}/cases/{case_id}`
- Auth: one of:
  - API key in cookie `fastapiusersauth`
  - HTTP bearer

Update a case.

## Path parameters

- `case_id` string, uuid, required
- `workspace_id` string, uuid, required

## Query parameters

- `include_rows` boolean: Include linked table rows

## Request body

- CaseUpdate
  - `summary` string, nullable
  - `description` string, nullable
  - `status` 'unknown' | 'new' | 'in_progress' | 'on_hold' | 'resolved' | 'closed' | 'other': Case status values aligned with OCSF Incident Finding status.
  - `priority` 'unknown' | 'low' | 'medium' | 'high' | 'critical' | 'other': Case priority values aligned with urgency levels. Values: UNKNOWN (0): No priority is assigned LOW (1): Application or personal procedure is unusable, where a workaround is available or a repair is possible MEDIUM (2): Non-critical function or procedure is unusable or hard to use causing operational disruptions with no direct impact on a service's availability. A workaround is available HIGH (3): Critical functionality or network access is interrupted, degraded or unusable, having a severe impact on services availability. No acceptable alternative is possible CRITICAL (4): Interruption making a critical functionality inaccessible or a complete network interruption causing a severe impact on services availability. There is no possible alternative OTHER (99): The priority is not normalized
  - `severity` 'unknown' | 'informational' | 'low' | 'medium' | 'high' | 'critical' | 'fatal' | 'other': Case severity values aligned with OCSF severity values. Values: UNKNOWN (0): The event/finding severity is unknown INFORMATIONAL (1): Informational message. No action required LOW (2): The user decides if action is needed MEDIUM (3): Action is required but the situation is not serious at this time HIGH (4): Action is required immediately CRITICAL (5): Action is required immediately and the scope is broad FATAL (6): An error occurred but it is too late to take remedial action OTHER (99): The event/finding severity is not mapped
  - `fields` object, nullable
  - `dropdown_values` CaseDropdownValueInput[], nullable
    - `definition_id` string, uuid, nullable: Dropdown definition ID.
    - `definition_ref` string, nullable: Dropdown definition ref.
    - `option_id` string, uuid, nullable: Dropdown option ID. Pass null to clear the value.
    - `option_ref` string, nullable: Dropdown option ref. Pass null to clear the value.
  - `assignee_id` string, uuid, nullable
  - `payload` object, nullable

## Response `200`

Successful Response

- CaseRead
  - `id` string, uuid, required
  - `short_id` string, required
  - `created_at` string, date-time, required
  - `updated_at` string, date-time, required
  - `summary` string, required
  - `status` 'unknown' | 'new' | 'in_progress' | 'on_hold' | 'resolved' | 'closed' | 'other', required: Case status values aligned with OCSF Incident Finding status.
  - `priority` 'unknown' | 'low' | 'medium' | 'high' | 'critical' | 'other', required: Case priority values aligned with urgency levels. Values: UNKNOWN (0): No priority is assigned LOW (1): Application or personal procedure is unusable, where a workaround is available or a repair is possible MEDIUM (2): Non-critical function or procedure is unusable or hard to use causing operational disruptions with no direct impact on a service's availability. A workaround is available HIGH (3): Critical functionality or network access is interrupted, degraded or unusable, having a severe impact on services availability. No acceptable alternative is possible CRITICAL (4): Interruption making a critical functionality inaccessible or a complete network interruption causing a severe impact on services availability. There is no possible alternative OTHER (99): The priority is not normalized
  - `severity` 'unknown' | 'informational' | 'low' | 'medium' | 'high' | 'critical' | 'fatal' | 'other', required: Case severity values aligned with OCSF severity values. Values: UNKNOWN (0): The event/finding severity is unknown INFORMATIONAL (1): Informational message. No action required LOW (2): The user decides if action is needed MEDIUM (3): Action is required but the situation is not serious at this time HIGH (4): Action is required immediately CRITICAL (5): Action is required immediately and the scope is broad FATAL (6): An error occurred but it is too late to take remedial action OTHER (99): The event/finding severity is not mapped
  - `description` string, required
  - `fields` CaseFieldRead[], required
    - `id` string, required
    - `display_name` string, required
    - `type` 'TEXT' | 'INTEGER' | 'NUMERIC' | 'DATE' | 'BOOLEAN' | 'TIMESTAMPTZ' | 'JSONB' | 'SELECT' | 'MULTI_SELECT' | 'UUID', required: Read-only type for case field metadata.
    - `description` string, required
    - `nullable` boolean, required
    - `default` string, nullable, required
    - `reserved` boolean, required
    - `options` string[], nullable
    - `kind` 'LONG_TEXT' | 'URL': Semantic kind for case custom fields. Controls how the field is rendered in the UI without changing the underlying SQL storage type.
    - `required_on_closure` boolean
    - `value` unknown, required
  - `assignee` UserRead
    - `id` string, uuid, required
    - `email` string, email, required
    - `is_active` boolean
    - `is_superuser` boolean
    - `is_verified` boolean
    - `role` 'basic' | 'admin', required
    - `first_name` string, nullable
    - `last_name` string, nullable
    - `settings` object, required
  - `payload` object, nullable, required
  - `tags` CaseTagRead[]
    - `id` string, uuid, required
    - `name` string, required
    - `ref` string, required
    - `color` string, nullable, required
  - `dropdown_values` CaseDropdownValueRead[], required
    - `id` string, uuid, required
    - `definition_id` string, uuid, required
    - `definition_ref` string, required
    - `definition_name` string, required
    - `option_id` string, uuid, nullable
    - `option_label` string, nullable
    - `option_ref` string, nullable
    - `option_icon_name` string, nullable
    - `option_color` string, nullable
  - `rows` CaseTableRowRead[]
    - `id` string, uuid, required
    - `case_id` string, uuid, required
    - `table_id` string, uuid, required
    - `table_name` string, nullable
    - `row_id` string, uuid, required
    - `row_data` object, nullable
    - `is_row_available` boolean
    - `created_at` string, date-time, required
    - `updated_at` string, date-time, required
  - `parent` CaseParentRead: Summary of a sub-case's parent case.
    - `id` string, uuid, required
    - `short_id` string, required
    - `summary` string, required
  - `num_sub_cases` integer, required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/tracecat/apis/tracecat-api.md) - [All operations](https://skmtc.dev/tracecat/apis/tracecat-api/llms.txt) - [OpenAPI document](https://skmtc.dev/tracecat/apis/tracecat-api/revisions/2efdda25045f?raw)