Skip to content

Create case

POST/cases

Cases API · Cases

Create a new case.

Required permissionxdr-cases.case:create

Parameters

Name In Type Required Description
X-Tenant-ID header string (uuid) Yes Tenant ID.

Request body

Content type: application/json

Request body fields

namestringrequired
Case name. Alphanumeric characters, spaces, and the following punctuation are allowed ., ,, :, (, ), !, +, _, | -, ?, \\, /, ', \", $, #.
Must match the pattern ^[-\p{L}\p{Nl}\d ,!()\\/."':?#$+_|]+$. Must be at most 510 characters long.
typestringrequired
Case type.
Must be one of: hunt, investigation, incident, healthCheck, duplicate, postureImprovement, customerRequest, activeThreat, exposure, managedRisk, generalRequest.
managedBystring
Case managed by.
Must be one of: self, sophos.
severitystring
Case severity.
Must be one of: notSet, critical, high, medium, low, informational.
statusstring
Case status. actionRequired applies only to Sophos-managed cases.
Must be one of: actionRequired, resolved, investigating, new, onHold.
assigneestring
The email address of the case assignee. This field is required and can be set to Unassigned if the case is unassigned.
initialDetectionIdstring
Detection ID.
Must match the pattern ^[a-f0-9_-]+$. Must be at most 150 characters long.
otherDetectionIdsarray of string
Additional detection IDs to associate with the case.
Must contain at most 100 items. Items must be unique. Each item must match the pattern ^[a-f0-9_-]+$. Each item must be at most 150 characters long.
overviewstring
Case overview.
Must be at most 20000 characters long.

Request samples

curl -X POST "https://api-<data-region>.central.sophos.com/cases/v1/cases" -H "Authorization: Bearer <access-token>" -H "X-Tenant-ID: <tenant-id>" -H "Content-Type: application/json" -d "{
  \"name\": \"string\",
  \"type\": \"hunt\",
  \"managedBy\": \"self\",
  \"severity\": \"notSet\",
  \"status\": \"actionRequired\",
  \"assignee\": \"string\",
  \"initialDetectionId\": \"2e0cdd5ffec_3bad8fb8f\",
  \"otherDetectionIds\": [
    \"2e0cdd5ffec_3bad8fb8f\"
  ],
  \"overview\": \"string\"
}"


import requests

response = requests.post(
    "https://api-<data-region>.central.sophos.com/cases/v1/cases",
    headers={
        "Authorization": "Bearer <access-token>",
        "X-Tenant-ID": "<tenant-id>",
        "Content-Type": "application/json",
    },
    json={   'name': 'string',
    'type': 'hunt',
    'managedBy': 'self',
    'severity': 'notSet',
    'status': 'actionRequired',
    'assignee': 'string',
    'initialDetectionId': '2e0cdd5ffec_3bad8fb8f',
    'otherDetectionIds': ['2e0cdd5ffec_3bad8fb8f'],
    'overview': 'string'},
)
print(response.json())


$headers = @{
    "Authorization" = "Bearer <access-token>"
    "X-Tenant-ID" = "<tenant-id>"
    "Content-Type" = "application/json"
}
$body = '{
  "name": "string",
  "type": "hunt",
  "managedBy": "self",
  "severity": "notSet",
  "status": "actionRequired",
  "assignee": "string",
  "initialDetectionId": "2e0cdd5ffec_3bad8fb8f",
  "otherDetectionIds": [
    "2e0cdd5ffec_3bad8fb8f"
  ],
  "overview": "string"
}'
Invoke-RestMethod -Method POST -Uri "https://api-<data-region>.central.sophos.com/cases/v1/cases" -Headers $headers -Body $body -ContentType "application/json"


package main

import (
    "fmt"
    "io"
    "net/http"
    "strings"
)

func main() {
    req, err := http.NewRequest("POST", "https://api-<data-region>.central.sophos.com/cases/v1/cases", strings.NewReader(`{
  "name": "string",
  "type": "hunt",
  "managedBy": "self",
  "severity": "notSet",
  "status": "actionRequired",
  "assignee": "string",
  "initialDetectionId": "2e0cdd5ffec_3bad8fb8f",
  "otherDetectionIds": [
    "2e0cdd5ffec_3bad8fb8f"
  ],
  "overview": "string"
}`))
    if err != nil {
        panic(err)
    }
    req.Header.Set("Authorization", "Bearer <access-token>")
    req.Header.Set("X-Tenant-ID", "<tenant-id>")
    req.Header.Set("Content-Type", "application/json")

    resp, err := http.DefaultClient.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    body, _ := io.ReadAll(resp.Body)
    fmt.Println(string(body))
}


const response = await fetch("https://api-<data-region>.central.sophos.com/cases/v1/cases", {
  method: "POST",
  headers: {
    "Authorization": "Bearer <access-token>",
    "X-Tenant-ID": "<tenant-id>",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
  "name": "string",
  "type": "hunt",
  "managedBy": "self",
  "severity": "notSet",
  "status": "actionRequired",
  "assignee": "string",
  "initialDetectionId": "2e0cdd5ffec_3bad8fb8f",
  "otherDetectionIds": [
    "2e0cdd5ffec_3bad8fb8f"
  ],
  "overview": "string"
}),
});
const data = await response.json();
console.log(data);

Responses

201 — New case.

Response fields

idstringrequired
Case ID.
typestringrequired
Case type.
Must be one of: hunt, investigation, incident, healthCheck, duplicate, postureImprovement, customerRequest, activeThreat, exposure, managedRisk, generalRequest.
namestringrequired
Case name.
Must be at most 510 characters long.
tenantobjectrequired
Tenant reference.
Show child attributesHide child attributes
idstring (uuid)
Tenant ID.
managedBystring
Case managed by.
Must be one of: self, sophos.
createdAtstring (date-time)required
Case created date-time.
createdByobject
Principal reference.
Show child attributesHide child attributes
idstring
Principal ID. This is the client ID for service principals.
typestring (enum)
Principal type.
Must be one of: user, service.
namestring
Principal name. This doesn't apply to service principals.
accountTypestring
Account type.
Must be one of: partner, tenant, organization.
accountIdstring (uuid)
Account ID.
resolvedAtstring (date-time)
Case resolved date-time.
updatedAtstring (date-time)
Case updated date-time.
severitystring
Case severity.
Must be one of: notSet, critical, high, medium, low, informational.
statusstringrequired
Case status. actionRequired applies only to Sophos-managed cases.
Must be one of: actionRequired, resolved, investigating, new, onHold.
initialDetectionobject
Initial Detection in a Case.
Show child attributesHide child attributes
idstring
Detection ID.
severityinteger
Severity of the detection. A higher score implies a more severe detection.
Must be ≥ 1 and ≤ 10.
typestring
Type of the detection.
detectionRulestring
Detection rule ID.
mitreAttacksarray of object
List of MITRE ATT&CK objects associated with this detection.
MITRE ATT&CK name and description.
Show child attributesHide child attributes
tacticobject
Tactic used in the MITRE ATT&CK.
Show child attributesHide child attributes
idstring
ID of the tactic.
namestring
MITRE ATT&CK name.
techniquesarray of object
MITRE ATT&CK techniques.
Technique used in the MITRE ATT&CK.
Show child attributesHide child attributes
idstring
ID of the technique.
namestring
Name of the technique.
timestring (timestamp)
Detection event time.
sensorobject
The sensor which generated the detection.
Show child attributesHide child attributes
idstringrequired
ID of the sensor.
typestringrequired
Sensor type where detection occurred.
Must be one of: cloud, endpoint, email, firewall, iam, network, compound, backupAndRecovery.
sourcestringrequired
The name of the sensor source.
versionstringrequired
The version of the sensor provided by the vendor.
namestring
The name of the sensor.
assigneeobject
Principal reference.
Show child attributesHide child attributes
idstring
Principal ID. This is the client ID for service principals.
typestring (enum)
Principal type.
Must be one of: user, service.
namestring
Principal name. This doesn't apply to service principals.
accountTypestring
Account type.
Must be one of: partner, tenant, organization.
accountIdstring (uuid)
Account ID.
assignedAtstring (date-time)
Assignee set date-time.
overviewstring
Case overview.
Must be at most 20000 characters long.
detectionCountinteger
Count of detections associated with the case.
verdictstring
Case verdict.
Must be one of: falsePositive, truePositiveMalicious, truePositiveBenign, truePositive, inconclusive.
escalatedboolean
Case escalated.

Errors

Status Meaning
400 Bad request.
401 Unauthorized.
403 Forbidden.
500 Unexpected error.

All error responses share the same shape — see the error response object.

Response examples

201

{
  "id": "string",
  "type": "hunt",
  "name": "string",
  "tenant": {
    "id": "00000000-0000-0000-0000-000000000000"
  },
  "managedBy": "self",
  "createdAt": "2026-07-28T00:00:00Z",
  "createdBy": {
    "id": "string",
    "type": "user",
    "name": "string",
    "accountType": "partner",
    "accountId": "00000000-0000-0000-0000-000000000000"
  },
  "resolvedAt": "2026-07-28T00:00:00Z",
  "updatedAt": "2026-07-28T00:00:00Z",
  "severity": "notSet",
  "status": "actionRequired",
  "initialDetection": {
    "id": "string",
    "severity": 5,
    "type": "Threat",
    "detectionRule": "WIN-MITRE-Behavioral-TA0011-T1105",
    "mitreAttacks": [
      {
        "tactic": {
          "id": "TA0002",
          "name": "Execution",
          "techniques": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter"
            }
          ]
        }
      }
    ],
    "time": "string",
    "sensor": {
      "id": "SophosSensorID",
      "type": "cloud",
      "source": "Sophos",
      "version": "1.18.1",
      "name": "string"
    }
  },
  "assignee": {
    "id": "string",
    "type": "user",
    "name": "string",
    "accountType": "partner",
    "accountId": "00000000-0000-0000-0000-000000000000"
  },
  "assignedAt": "2026-07-28T00:00:00Z",
  "overview": "string",
  "detectionCount": 0,
  "verdict": "falsePositive",
  "escalated": true
}

See the guide for a narrative walkthrough of this API.