---
title: "Query Case Aggregates"
method: POST
path: "/workspaces/{workspace_id}/cases/search/aggregate"
tags: ["cases"]
---

# Query Case Aggregates

`POST /workspaces/{workspace_id}/cases/search/aggregate`

## Request

- Base URL: `https://platform.tracecat.com/api`
- URL: `https://platform.tracecat.com/api/workspaces/{workspace_id}/cases/search/aggregate`
- Auth: one of:
  - API key in cookie `fastapiusersauth`
  - HTTP bearer

Count the same typed matching conditions as search.

## Path parameters

- `workspace_id` string, uuid, required

## Request body

- CaseQuery: Matching criteria shared by case search and filtered status counts. Explicit text, identity, and hierarchy constraints are combined with ``filters`` using AND. Workspace and entitlement checks belong to the service and cannot be supplied or negated by this request. Tag membership uses existing filter nodes: ``in`` matches any tag, an ``and`` of ``contains`` conditions requires all tags, and ``not`` around ``in`` excludes the selected tags. ``is_null`` matches no tags. Scalar dropdown/custom-field exclusions retain SQL NULL semantics: ``ne``, ``not_in``, and negated comparisons exclude unset values. Include unset values explicitly with an ``or`` containing ``is_null``.
  - `filters` union
    - Condition: A predicate over one resolver-defined field.
      - `field` string, required
      - `op` 'eq' | 'ne' | 'in' | 'not_in' | 'gt' | 'gte' | 'lt' | 'lte' | 'contains' | 'starts_with' | 'is_null', required: Operations supported by the shared filter language.
      - `value` union
        - union
          - string
          - integer
          - number
          - boolean
          - string
          - string, date-time
          - string, date
          - string, uuid
        - FilterScalar[]
          - union
            - string
            - integer
            - number
            - boolean
            - string
            - string, date-time
            - string, date
            - string, uuid
    - AndClause: A conjunction of one or more filters.
      - `and` Filter[], required
    - OrClause: A disjunction of one or more filters.
      - `or` Filter[], required
    - NotClause: The negation of one filter.
      - `not` Filter, required (recursive)
  - `search_term` string, nullable
  - `search_mode` 'full_text' | 'literal': Explicit lexical modes; omitted table mode remains a legacy policy.
  - `search_columns` string[], nullable
  - `short_id` string, nullable
  - `case_id` string, uuid, nullable
  - `hierarchy` 'all' | 'top_level'
  - `parent_id` string, uuid, nullable
  - `status` CaseStatus[], nullable
  - `priority` CasePriority[], nullable
  - `severity` CaseSeverity[], nullable
  - `assignee_id` union[], nullable
    - union
      - string, uuid
      - 'unassigned' | '__UNASSIGNED__'
  - `tags` string[], nullable
  - `dropdown` string[], nullable
  - `start_time` string, date-time, nullable
  - `end_time` string, date-time, nullable
  - `updated_after` string, date-time, nullable
  - `updated_before` string, date-time, nullable

## Response `200`

Successful Response

- CaseSearchAggregateRead
  - `total` integer, required
  - `status_groups` CaseStatusGroupCounts, required
    - `new` integer
    - `in_progress` integer
    - `on_hold` integer
    - `resolved` integer
    - `closed` integer
    - `unknown` integer
    - `other` integer

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/tracecat/apis/tracecat-api.md) - [All operations](https://skmtc.dev/tracecat/apis/tracecat-api/llms.txt) - [OpenAPI document](https://skmtc.dev/tracecat/apis/tracecat-api/revisions/2efdda25045f?raw)