splitCase¶
MUTATIONsplitCase
Cases GraphQL API · Mutations
splitCase creates one new destination case and moves the selected case evidence to it asynchronously. Only detections, events, saved searches, and files can be moved. Key findings, comments, entities, and agents remain on the source case. Requested evidence not attached to the source case (already removed, or never present) is silently ignored — only what is still attached when the move runs is moved; the rest is recorded in the audit trail as skipped. SCHEDULED attachments (upload link issued but file not yet uploaded) are likewise skipped and left on the source.
Request samples¶
curl -X POST "https://api.taegis.sophos.com/graphql" -H "Authorization: Bearer <access-token>" -H "X-Tenant-ID: <tenant-id>" -H "Content-Type: application/json" -d "{
\"query\": \"mutation SplitCase(\$input: SplitCaseInput!) { splitCase(input: \$input) { caseId destinationCaseId detectionIds eventIds searchQueries fileIds } }\",
\"variables\": {
\"input\": {
\"caseId\": \"<caseId>\",
\"newCase\": {
\"typeId\": \"<typeId>\",
\"severity\": 0,
\"title\": \"<title>\",
\"primaryStatusId\": \"<primaryStatusId>\"
}
}
}
}"
import requests
response = requests.post(
"https://api.taegis.sophos.com/graphql",
headers={
"Authorization": "Bearer <access-token>",
"X-Tenant-ID": "<tenant-id>",
"Content-Type": "application/json",
},
json={ 'query': 'mutation SplitCase($input: SplitCaseInput!) { splitCase(input: '
'$input) { caseId destinationCaseId detectionIds eventIds '
'searchQueries fileIds } }',
'variables': { 'input': { 'caseId': '<caseId>',
'newCase': { 'typeId': '<typeId>',
'severity': 0,
'title': '<title>',
'primaryStatusId': '<primaryStatusId>'}}}},
)
print(response.json())
$headers = @{
"Authorization" = "Bearer <access-token>"
"X-Tenant-ID" = "<tenant-id>"
"Content-Type" = "application/json"
}
$body = '{
"query": "mutation SplitCase($input: SplitCaseInput!) { splitCase(input: $input) { caseId destinationCaseId detectionIds eventIds searchQueries fileIds } }",
"variables": {
"input": {
"caseId": "<caseId>",
"newCase": {
"typeId": "<typeId>",
"severity": 0,
"title": "<title>",
"primaryStatusId": "<primaryStatusId>"
}
}
}
}'
Invoke-RestMethod -Method POST -Uri "https://api.taegis.sophos.com/graphql" -Headers $headers -Body $body -ContentType "application/json"
package main
import (
"fmt"
"io"
"net/http"
"strings"
)
func main() {
req, err := http.NewRequest("POST", "https://api.taegis.sophos.com/graphql", strings.NewReader(`{
"query": "mutation SplitCase($input: SplitCaseInput!) { splitCase(input: $input) { caseId destinationCaseId detectionIds eventIds searchQueries fileIds } }",
"variables": {
"input": {
"caseId": "<caseId>",
"newCase": {
"typeId": "<typeId>",
"severity": 0,
"title": "<title>",
"primaryStatusId": "<primaryStatusId>"
}
}
}
}`))
if err != nil {
panic(err)
}
req.Header.Set("Authorization", "Bearer <access-token>")
req.Header.Set("X-Tenant-ID", "<tenant-id>")
req.Header.Set("Content-Type", "application/json")
resp, err := http.DefaultClient.Do(req)
if err != nil {
panic(err)
}
defer resp.Body.Close()
body, _ := io.ReadAll(resp.Body)
fmt.Println(string(body))
}
const response = await fetch("https://api.taegis.sophos.com/graphql", {
method: "POST",
headers: {
"Authorization": "Bearer <access-token>",
"X-Tenant-ID": "<tenant-id>",
"Content-Type": "application/json",
},
body: JSON.stringify({
"query": "mutation SplitCase($input: SplitCaseInput!) { splitCase(input: $input) { caseId destinationCaseId detectionIds eventIds searchQueries fileIds } }",
"variables": {
"input": {
"caseId": "<caseId>",
"newCase": {
"typeId": "<typeId>",
"severity": 0,
"title": "<title>",
"primaryStatusId": "<primaryStatusId>"
}
}
}
}),
});
const data = await response.json();
console.log(data);