> ## Documentation Index > Fetch the complete documentation index at: https://docs.wirespeed.co/llms.txt > Use this file to discover all available pages before exploring further. # Get case by ID or SID ## OpenAPI ````yaml https://api.wirespeed.co/v1/openapi.json get /v1/cases/{idOrSid} openapi: 3.0.0 info: title: Wirespeed API description: The public Wirespeed API. v1 is the first stable contract. version: '1.0' contact: {} servers: - url: https://api.wirespeed.co security: [] tags: [] paths: /v1/cases/{idOrSid}: get: tags: - Cases summary: Get case by ID or SID operationId: CasesController_findOne parameters: - name: idOrSid required: true in: path description: Case ID or SID schema: type: string responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/Case' '404': description: '' security: - bearer: [] components: schemas: Case: type: object properties: id: type: string description: Unique identifier for the case sid: type: string description: Short identifier for the case teamId: type: string description: Team ID that owns this case name: type: string description: Custom name for the case lastNotifiedClientAt: type: string nullable: true description: Timestamp when the case was last notified to the client status: type: string enum: - NEW - PROCESSING - ESCALATED - HUNTING - MONITORING - CHATOPS - CLOSED description: Current status of the case createdAt: type: string description: Timestamp when the case was created detectionSids: description: Array of detection SIDs associated with this case type: array items: type: string testMode: type: boolean description: Whether this case is in test mode firstDetectionSourceIngestedAt: type: string description: Timestamp when first detection was ingested firstDetectionSourceDetectedAt: type: string description: Timestamp when first detection was detected by source updatedAt: type: string description: Timestamp when the case was last updated closedAt: type: string description: Timestamp when the case was closed logs: description: Array of log entries for this case type: array items: $ref: '#/components/schemas/JSONLog' contained: type: boolean description: Whether the threat has been contained reingested: type: boolean description: Whether the case has been reingested verdict: type: string enum: - MALICIOUS - SUSPICIOUS - BENIGN description: Verdict assigned to the case helpfulnessRating: type: string enum: - happy - neutral - unhappy nullable: true description: Helpfulness feedback selected when case was resolved title: type: string description: Title of the case based on categories and verdict categories: type: array description: Array of categories assigned to this case items: type: string enum: - OTHER__DIAGNOSTIC - OTHER__INFORMATIONAL_EVENT - OTHER__WARNING - OTHER__UNKNOWN - OTHER__DECEPTION - OTHER__DECEPTION__SIMULATION - OTHER__CUSTOM_DETECTION - CLOUD__INVOCATION - CLOUD__DISCOVERY - CLOUD__DATA_TRANSFER - CLOUD__PERSISTENCE - CLOUD__PUBLIC_BUCKET - ENDPOINT__DISCOVERY - ENDPOINT__EXECUTION - ENDPOINT__LIVE_OFF_THE_LAND - ENDPOINT__NUISANCE - ENDPOINT__MALWARE_DISCOVERY - ENDPOINT__MALWARE_EXECUTION - ENDPOINT__LATE_STAGE - ENDPOINT__PERSISTENCE - ENDPOINT__REMOTE_MANAGEMENT - ENDPOINT__LATERAL_MOVEMENT - ENDPOINT__IMPACT - ENDPOINT__EVASION - ENDPOINT__EXPLOITATION - ENDPOINT__SIMULATION - ENDPOINT__PLANNED_CHANGE - IDENTITY__LOGIN - IDENTITY__REJECTED_MFA - IDENTITY__DISCOVERY - IDENTITY__BRUTE_FORCE - IDENTITY__PUBLIC_CREDENTIAL_EXPOSURE - IDENTITY__PRIVATE_CREDENTIAL_EXPOSURE - IDENTITY__PERSISTENCE - IDENTITY__ACCOUNT_COMPROMISE - IDENTITY__SIMULATION - NETWORK__INBOUND_CONNECTION - NETWORK__OUTBOUND_CONNECTION - NETWORK__PHISHING - NETWORK__NOISY - NETWORK__DISCOVERY - EMAIL__PHISHING - EMAIL__PHISHING_REPORTED - EMAIL__EVASION - EMAIL__MALWARE - EMAIL__MALICIOUS_LINK - EMAIL__GRAYMAIL - EMAIL__SPAM - EMAIL__BUSINESS_EMAIL_COMPROMISE - EMAIL__MAILBOX_RULE - DATA__DATA_TRANSFER - DATA__DATA_SHARE - POSTURE__POSTURE - POSTURE__HEALTH excludeFromMeans: type: boolean description: Whether to exclude this case from mean calculations verdictedAt: type: string description: Timestamp when verdict was assigned detectionCount: type: number description: Number of detections in this case firstRun: type: boolean description: Whether this is the first run of the detection timeToClose: type: number description: Time to close in seconds teamName: type: string description: Name of the team that owns this case containsVIP: type: boolean description: Whether case involves VIP users containsHVA: type: boolean description: Whether case involves critical assets containsMobile: type: boolean description: Whether case involves mobile devices externalTicketId: type: string description: External ticket ID from ticketing system integration externalTicketIntegrationId: type: string description: ID of integration used for external ticket autoContained: type: boolean description: Whether threat was automatically contained severity: type: string description: Severity level of the case severityOrdinal: type: number description: Numeric value of severity for sorting respondedAt: type: string description: Timestamp when case was responded to platforms: description: Array of integration platforms involved type: array items: type: string notes: type: string description: Notes or comments about the case clientNotified: type: boolean description: Whether client has been notified about this case summary: type: string description: AI-generated summary of the case hasPassedAql: type: boolean description: >- Whether at least one detection in this case has passed AQL quality review groups: type: string nullable: true description: CSV of unique group names across all detections in this case groupSummaries: description: >- Unique groups derived from the users and endpoints linked to this case type: array items: $ref: '#/components/schemas/GroupSummary' required: - id - sid - teamId - status - createdAt - detectionSids - testMode - firstDetectionSourceIngestedAt - firstDetectionSourceDetectedAt - logs - contained - reingested - verdict - title - excludeFromMeans - firstRun - containsVIP - containsHVA - containsMobile - severity - severityOrdinal JSONLog: type: object properties: log: type: string description: Log message content timestamp: type: string description: Timestamp when the log was created debug: type: boolean description: Whether this is a debug log entry required: - log - timestamp - debug GroupSummary: type: object properties: id: type: string description: Group ID name: type: string description: Group display name color: type: string nullable: true enum: - gray - red - orange - amber - green - teal - blue - indigo - purple - pink required: - id - name securitySchemes: bearer: scheme: bearer bearerFormat: JWT type: http ````