TRtracecat
cases

List Cases

List cases with default filtering and sorting options.

get/workspaces/{workspace_id}/cases

Request

  • Base URL
    https://platform.tracecat.com/api
  • Auth
    • API key in cookie fastapiusersauth
    • or HTTP bearer

Path parameters

workspace_idstring uuid required

Query parameters

limitinteger

Maximum items per page

cursorstring nullable

Cursor for pagination

reverseboolean

Reverse pagination direction

order_by'created_at' | 'updated_at' | 'priority' | 'severity' | 'status' | 'tasks' | 'assignee' | 'tags' nullable

Column name to order by (e.g. created_at, updated_at, priority, severity, status, tasks, assignee, tags). Default: created_at

sort'asc' | 'desc' nullable

Direction to sort (asc or desc)

include_rowsboolean

Include linked table rows

field_idsstring[] nullable

Include only the requested custom field IDs

include_durationsboolean

Include case duration values

include_payloadboolean

Include case payload

payload_fieldsstring[] nullable

Return only these literal top-level payload keys, automatically including the subset regardless of include_payload. Dots are literal; nested values are returned whole. Missing keys are omitted and null values preserved. An empty list acts as omitted; an empty string selects the literal empty key.

include_countboolean

Include the exact filtered total_estimate for compatibility. Set false when fetching aggregate counts separately; total_estimate will be null.

hierarchy'all' | 'top_level'

Return every case, or only top-level cases without a parent.

payload_pathsstring nullable

JSON-encoded array of up to 100 object paths, e.g. [["alert","source","ip"]]. Each path contains 1 to 32 literal keys. Preserves nesting, combines with payload_fields, and includes the subset automatically. Selected parents include their whole value. Missing paths are omitted; nulls are preserved. Arrays can be selected whole, without index traversal. An empty list acts as omitted.

Response

Successful Response

next_cursorstring nullable

Cursor for next page

prev_cursorstring nullable

Cursor for previous page

has_moreboolean

Whether more items exist

has_previousboolean

Whether previous items exist

total_estimateinteger nullable

Estimated total count from table statistics

Changes

No recorded changes to this operation across all 1 revision of this API.