---
title: "Batch Update Cases"
method: POST
path: "/workspaces/{workspace_id}/cases/batch-update"
tags: ["cases"]
---

# Batch Update Cases

`POST /workspaces/{workspace_id}/cases/batch-update`

## Request

- Base URL: `https://platform.tracecat.com/api`
- URL: `https://platform.tracecat.com/api/workspaces/{workspace_id}/cases/batch-update`
- Auth: one of:
  - API key in cookie `fastapiusersauth`
  - HTTP bearer

Update multiple cases with per-case results.

## Path parameters

- `workspace_id` string, uuid, required

## Request body

- CaseBatchUpdate: Request body for updating multiple cases.
  - `case_ids` string[], required
  - `update` CaseUpdate, required
    - `summary` string, nullable
    - `description` string, nullable
    - `status` 'unknown' | 'new' | 'in_progress' | 'on_hold' | 'resolved' | 'closed' | 'other': Case status values aligned with OCSF Incident Finding status.
    - `priority` 'unknown' | 'low' | 'medium' | 'high' | 'critical' | 'other': Case priority values aligned with urgency levels. Values: UNKNOWN (0): No priority is assigned LOW (1): Application or personal procedure is unusable, where a workaround is available or a repair is possible MEDIUM (2): Non-critical function or procedure is unusable or hard to use causing operational disruptions with no direct impact on a service's availability. A workaround is available HIGH (3): Critical functionality or network access is interrupted, degraded or unusable, having a severe impact on services availability. No acceptable alternative is possible CRITICAL (4): Interruption making a critical functionality inaccessible or a complete network interruption causing a severe impact on services availability. There is no possible alternative OTHER (99): The priority is not normalized
    - `severity` 'unknown' | 'informational' | 'low' | 'medium' | 'high' | 'critical' | 'fatal' | 'other': Case severity values aligned with OCSF severity values. Values: UNKNOWN (0): The event/finding severity is unknown INFORMATIONAL (1): Informational message. No action required LOW (2): The user decides if action is needed MEDIUM (3): Action is required but the situation is not serious at this time HIGH (4): Action is required immediately CRITICAL (5): Action is required immediately and the scope is broad FATAL (6): An error occurred but it is too late to take remedial action OTHER (99): The event/finding severity is not mapped
    - `fields` object, nullable
    - `dropdown_values` CaseDropdownValueInput[], nullable
      - `definition_id` string, uuid, nullable: Dropdown definition ID.
      - `definition_ref` string, nullable: Dropdown definition ref.
      - `option_id` string, uuid, nullable: Dropdown option ID. Pass null to clear the value.
      - `option_ref` string, nullable: Dropdown option ref. Pass null to clear the value.
    - `assignee_id` string, uuid, nullable
    - `payload` object, nullable

## Response `200`

Successful Response

- CaseBatchResponse: Per-case results and aggregate counts for a batch operation.
  - `results` CaseBatchItemResult[], required
    - `case_id` string, uuid, required
    - `success` boolean, required
    - `error` string, nullable
  - `succeeded` integer, required
  - `failed` integer, required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/tracecat/apis/tracecat-api.md) - [All operations](https://skmtc.dev/tracecat/apis/tracecat-api/llms.txt) - [OpenAPI document](https://skmtc.dev/tracecat/apis/tracecat-api/revisions/2efdda25045f?raw)