> ## Documentation Index > Fetch the complete documentation index at: https://docs.wirespeed.co/llms.txt > Use this file to discover all available pages before exploring further. # Search and list cases ## OpenAPI ````yaml https://api.wirespeed.co/v1/openapi.json post /v1/cases openapi: 3.0.0 info: title: Wirespeed API description: The public Wirespeed API. v1 is the first stable contract. version: '1.0' contact: {} servers: - url: https://api.wirespeed.co security: [] tags: [] paths: /v1/cases: post: tags: - Cases summary: Search and list cases operationId: CasesController_findAll parameters: [] requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/SearchCasesDto' responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/Cases' security: - bearer: [] components: schemas: SearchCasesDto: type: object properties: size: type: number page: type: number filter: type: string search: type: string orderBy: type: string orderDir: type: string enum: - asc - desc days: type: number description: >- Number of days for time-based filtering (1-365). Used by stats/widget endpoints to set the time window. startDate: type: string description: Start date (inclusive, ISO8601 string) endDate: type: string description: End date (inclusive, ISO8601 string) statuses: type: array description: Filter cases by status items: type: string enum: - NEW - PROCESSING - ESCALATED - HUNTING - MONITORING - CHATOPS - CLOSED verdict: type: string enum: - MALICIOUS - SUSPICIOUS - BENIGN description: Filter cases by verdict assetId: type: string description: Filter cases involving a specific asset severity: type: string enum: - INFORMATIONAL - LOW - MEDIUM - HIGH - CRITICAL description: Filter cases by severity assetType: type: string enum: - USER - PROCESS - USER_AGENT - FILE - ENDPOINT - LOCATION - IP - DOMAIN description: Filter cases by asset type exclusionId: type: string description: Filter cases by exclusion rule onlyWasEscalated: type: boolean description: Only include cases that were escalated onlyWasContained: type: boolean description: Only include cases that were contained onlyWasMobile: type: boolean description: Only include cases that involve mobile devices onlyWasMonitored: type: boolean description: Only include cases that had a monitor onlyChatOps: type: boolean description: Only include cases that involved chat ops integrationPlatform: type: string enum: - admin-by-request - aws - axonius - bitwarden - box - checkpoint-firewall - checkpoint-harmony - cisco-catalyst - cisco-duo - cisco-meraki - cisco-secure-access - cisco-umbrella - cisco-xdr - connectwise-psa - crowdstrike-falcon - cyberark - darktrace - email - exium - fleet-dm - fortianalyzer - fortinet - freshservice - generic-json - generic-syslog - google-alert-center - google-chronicle - google-directory - google-security-center - halcyon - halo-itsm - have-i-been-pwned - horizon3 - hyas-protect - ipinfo - jamf-pro - jamf-protect - jira-cloud - jira-data-center - jumpcloud - kandji - manage-engine-ad-audit-plus - microsoft - microsoft-entra - microsoft-teams - microsoft-teams-v2 - mimecast - ninjaone - odoo-helpdesk - okta - one-password - onelogin - orca-security - pager-duty - palo-alto-networks-cortex - picus - ping-one - reversing-labs - safebreach - sandfly - sentinel-one - service-now - slack - sms - smtp - sonic-wall - sophos - splunk - stairwell - tenable-nessus - thinkst-canary - tracebit - unifi - vectra - watchguard-firebox - windows-event-logs - wirespeed - wiz - wordfence - zscaler-zpa description: Filter cases by integration platform hideDemoClients: type: boolean categoryClass: type: string enum: - ENDPOINT - IDENTITY - CLOUD - EMAIL - NETWORK - DATA - POSTURE - OTHER category: type: string enum: - OTHER__DIAGNOSTIC - OTHER__INFORMATIONAL_EVENT - OTHER__WARNING - OTHER__UNKNOWN - OTHER__DECEPTION - OTHER__DECEPTION__SIMULATION - OTHER__CUSTOM_DETECTION - CLOUD__INVOCATION - CLOUD__DISCOVERY - CLOUD__DATA_TRANSFER - CLOUD__PERSISTENCE - CLOUD__PUBLIC_BUCKET - ENDPOINT__DISCOVERY - ENDPOINT__EXECUTION - ENDPOINT__LIVE_OFF_THE_LAND - ENDPOINT__NUISANCE - ENDPOINT__MALWARE_DISCOVERY - ENDPOINT__MALWARE_EXECUTION - ENDPOINT__LATE_STAGE - ENDPOINT__PERSISTENCE - ENDPOINT__REMOTE_MANAGEMENT - ENDPOINT__LATERAL_MOVEMENT - ENDPOINT__IMPACT - ENDPOINT__EVASION - ENDPOINT__EXPLOITATION - ENDPOINT__SIMULATION - ENDPOINT__PLANNED_CHANGE - IDENTITY__LOGIN - IDENTITY__REJECTED_MFA - IDENTITY__DISCOVERY - IDENTITY__BRUTE_FORCE - IDENTITY__PUBLIC_CREDENTIAL_EXPOSURE - IDENTITY__PRIVATE_CREDENTIAL_EXPOSURE - IDENTITY__PERSISTENCE - IDENTITY__ACCOUNT_COMPROMISE - IDENTITY__OAUTH_GRANT - IDENTITY__SIMULATION - NETWORK__INBOUND_CONNECTION - NETWORK__OUTBOUND_CONNECTION - NETWORK__PHISHING - NETWORK__NOISY - NETWORK__DISCOVERY - EMAIL__PHISHING - EMAIL__PHISHING_REPORTED - EMAIL__EVASION - EMAIL__MALWARE - EMAIL__MALICIOUS_LINK - EMAIL__GRAYMAIL - EMAIL__SPAM - EMAIL__BUSINESS_EMAIL_COMPROMISE - EMAIL__MAILBOX_RULE - DATA__DATA_TRANSFER - DATA__DATA_SHARE - POSTURE__POSTURE - POSTURE__HEALTH createdAt: description: Filter by creation date allOf: - $ref: '#/components/schemas/DateFilterDto' groupIds: description: >- Filter cases by group IDs (OR) — matches cases with detections whose users or endpoints belong to any of the specified groups type: array items: type: string Cases: type: object properties: data: type: array items: $ref: '#/components/schemas/Case' required: - data DateFilterDto: type: object properties: gt: type: string description: Filter for dates greater than this value gte: type: string description: Filter for dates greater than or equal to this value lt: type: string description: Filter for dates less than this value lte: type: string description: Filter for dates less than or equal to this value Case: type: object properties: id: type: string description: Unique identifier for the case sid: type: string description: Short identifier for the case teamId: type: string description: Team ID that owns this case name: type: string description: Custom name for the case lastNotifiedClientAt: type: string nullable: true description: Timestamp when the case was last notified to the client status: type: string enum: - NEW - PROCESSING - ESCALATED - HUNTING - MONITORING - CHATOPS - CLOSED description: Current status of the case createdAt: type: string description: Timestamp when the case was created detectionSids: description: Array of detection SIDs associated with this case type: array items: type: string testMode: type: boolean description: Whether this case is in test mode firstDetectionSourceIngestedAt: type: string description: Timestamp when first detection was ingested firstDetectionSourceDetectedAt: type: string description: Timestamp when first detection was detected by source updatedAt: type: string description: Timestamp when the case was last updated closedAt: type: string description: Timestamp when the case was closed logs: description: Array of log entries for this case type: array items: $ref: '#/components/schemas/JSONLog' contained: type: boolean description: Whether the threat has been contained reingested: type: boolean description: Whether the case has been reingested verdict: type: string enum: - MALICIOUS - SUSPICIOUS - BENIGN description: Verdict assigned to the case helpfulnessRating: type: string enum: - happy - neutral - unhappy nullable: true description: Helpfulness feedback selected when case was resolved title: type: string description: Title of the case based on categories and verdict categories: type: array description: Array of categories assigned to this case items: type: string enum: - OTHER__DIAGNOSTIC - OTHER__INFORMATIONAL_EVENT - OTHER__WARNING - OTHER__UNKNOWN - OTHER__DECEPTION - OTHER__DECEPTION__SIMULATION - OTHER__CUSTOM_DETECTION - CLOUD__INVOCATION - CLOUD__DISCOVERY - CLOUD__DATA_TRANSFER - CLOUD__PERSISTENCE - CLOUD__PUBLIC_BUCKET - ENDPOINT__DISCOVERY - ENDPOINT__EXECUTION - ENDPOINT__LIVE_OFF_THE_LAND - ENDPOINT__NUISANCE - ENDPOINT__MALWARE_DISCOVERY - ENDPOINT__MALWARE_EXECUTION - ENDPOINT__LATE_STAGE - ENDPOINT__PERSISTENCE - ENDPOINT__REMOTE_MANAGEMENT - ENDPOINT__LATERAL_MOVEMENT - ENDPOINT__IMPACT - ENDPOINT__EVASION - ENDPOINT__EXPLOITATION - ENDPOINT__SIMULATION - ENDPOINT__PLANNED_CHANGE - IDENTITY__LOGIN - IDENTITY__REJECTED_MFA - IDENTITY__DISCOVERY - IDENTITY__BRUTE_FORCE - IDENTITY__PUBLIC_CREDENTIAL_EXPOSURE - IDENTITY__PRIVATE_CREDENTIAL_EXPOSURE - IDENTITY__PERSISTENCE - IDENTITY__ACCOUNT_COMPROMISE - IDENTITY__OAUTH_GRANT - IDENTITY__SIMULATION - NETWORK__INBOUND_CONNECTION - NETWORK__OUTBOUND_CONNECTION - NETWORK__PHISHING - NETWORK__NOISY - NETWORK__DISCOVERY - EMAIL__PHISHING - EMAIL__PHISHING_REPORTED - EMAIL__EVASION - EMAIL__MALWARE - EMAIL__MALICIOUS_LINK - EMAIL__GRAYMAIL - EMAIL__SPAM - EMAIL__BUSINESS_EMAIL_COMPROMISE - EMAIL__MAILBOX_RULE - DATA__DATA_TRANSFER - DATA__DATA_SHARE - POSTURE__POSTURE - POSTURE__HEALTH excludeFromMeans: type: boolean description: Whether to exclude this case from mean calculations verdictedAt: type: string description: Timestamp when verdict was assigned detectionCount: type: number description: Number of detections in this case firstRun: type: boolean description: Whether this is the first run of the detection timeToClose: type: number description: Time to close in seconds teamName: type: string description: Name of the team that owns this case containsVIP: type: boolean description: Whether case involves VIP users containsHVA: type: boolean description: Whether case involves critical assets containsMobile: type: boolean description: Whether case involves mobile devices externalTicketId: type: string description: External ticket ID from ticketing system integration externalTicketIntegrationId: type: string description: ID of integration used for external ticket autoContained: type: boolean description: Whether threat was automatically contained severity: type: string description: Severity level of the case severityOrdinal: type: number description: Numeric value of severity for sorting respondedAt: type: string description: Timestamp when case was responded to platforms: description: Array of integration platforms involved type: array items: type: string notes: type: string description: Notes or comments about the case clientNotified: type: boolean description: Whether client has been notified about this case summary: type: string description: AI-generated summary of the case hasPassedAql: type: boolean description: >- Whether at least one detection in this case has passed AQL quality review groups: type: string nullable: true description: CSV of unique group names across all detections in this case groupSummaries: description: >- Unique groups derived from the users and endpoints linked to this case type: array items: $ref: '#/components/schemas/GroupSummary' required: - id - sid - teamId - status - createdAt - detectionSids - testMode - firstDetectionSourceIngestedAt - firstDetectionSourceDetectedAt - logs - contained - reingested - verdict - title - excludeFromMeans - firstRun - containsVIP - containsHVA - containsMobile - severity - severityOrdinal JSONLog: type: object properties: log: type: string description: Log message content timestamp: type: string description: Timestamp when the log was created debug: type: boolean description: Whether this is a debug log entry required: - log - timestamp - debug GroupSummary: type: object properties: id: type: string description: Group ID name: type: string description: Group display name color: type: string nullable: true enum: - gray - red - orange - amber - green - teal - blue - indigo - purple - pink required: - id - name securitySchemes: bearer: scheme: bearer bearerFormat: JWT type: http ````