TRtracecat
cases

Create Case

Create a new case.

post/workspaces/{workspace_id}/cases

Request

  • Base URL
    https://platform.tracecat.com/api
  • Auth
    • API key in cookie fastapiusersauth
    • or HTTP bearer

Path parameters

workspace_idstring uuid required

Request body

summarystring required
descriptionstring required
status'unknown' | 'new' | 'in_progress' | 'on_hold' | 'resolved' | 'closed' | 'other' required

Case status values aligned with OCSF Incident Finding status.

priority'unknown' | 'low' | 'medium' | 'high' | 'critical' | 'other' required

Case priority values aligned with urgency levels.

Values: UNKNOWN (0): No priority is assigned LOW (1): Application or personal procedure is unusable, where a workaround is available or a repair is possible MEDIUM (2): Non-critical function or procedure is unusable or hard to use causing operational disruptions with no direct impact on a service's availability. A workaround is available HIGH (3): Critical functionality or network access is interrupted, degraded or unusable, having a severe impact on services availability. No acceptable alternative is possible CRITICAL (4): Interruption making a critical functionality inaccessible or a complete network interruption causing a severe impact on services availability. There is no possible alternative OTHER (99): The priority is not normalized

severity'unknown' | 'informational' | 'low' | 'medium' | 'high' | 'critical' | 'fatal' | 'other' required

Case severity values aligned with OCSF severity values.

Values: UNKNOWN (0): The event/finding severity is unknown INFORMATIONAL (1): Informational message. No action required LOW (2): The user decides if action is needed MEDIUM (3): Action is required but the situation is not serious at this time HIGH (4): Action is required immediately CRITICAL (5): Action is required immediately and the scope is broad FATAL (6): An error occurred but it is too late to take remedial action OTHER (99): The event/finding severity is not mapped

fieldsobject nullable
assignee_idstring uuid nullable
payloadobject nullable
parent_idstring uuid nullable

Create the case as a sub-case of this top-level case.

Response

Successful Response

idstring uuid required
short_idstring required
created_atstring date-time required
updated_atstring date-time required
summarystring required
status'unknown' | 'new' | 'in_progress' | 'on_hold' | 'resolved' | 'closed' | 'other' required

Case status values aligned with OCSF Incident Finding status.

priority'unknown' | 'low' | 'medium' | 'high' | 'critical' | 'other' required

Case priority values aligned with urgency levels.

Values: UNKNOWN (0): No priority is assigned LOW (1): Application or personal procedure is unusable, where a workaround is available or a repair is possible MEDIUM (2): Non-critical function or procedure is unusable or hard to use causing operational disruptions with no direct impact on a service's availability. A workaround is available HIGH (3): Critical functionality or network access is interrupted, degraded or unusable, having a severe impact on services availability. No acceptable alternative is possible CRITICAL (4): Interruption making a critical functionality inaccessible or a complete network interruption causing a severe impact on services availability. There is no possible alternative OTHER (99): The priority is not normalized

severity'unknown' | 'informational' | 'low' | 'medium' | 'high' | 'critical' | 'fatal' | 'other' required

Case severity values aligned with OCSF severity values.

Values: UNKNOWN (0): The event/finding severity is unknown INFORMATIONAL (1): Informational message. No action required LOW (2): The user decides if action is needed MEDIUM (3): Action is required but the situation is not serious at this time HIGH (4): Action is required immediately CRITICAL (5): Action is required immediately and the scope is broad FATAL (6): An error occurred but it is too late to take remedial action OTHER (99): The event/finding severity is not mapped

descriptionstring required
payloadobject nullable required
num_sub_casesinteger required

Changes

No recorded changes to this operation across all 1 revision of this API.