Skip to content

Get case by ID

GET/cases/{caseId}

Cases API · Cases

Get a case by ID.

Required permissionxdr-cases.case:read

Parameters

Name In Type Required Description
X-Tenant-ID header string (uuid) Yes Tenant ID.
caseId path string Yes Case ID. The ID follows the pattern ^[A-Za-z0-9]+-[A-Za-z0-9]+$.

Request samples

curl -X GET "https://api-<data-region>.central.sophos.com/cases/v1/cases/<caseId>" -H "Authorization: Bearer <access-token>" -H "X-Tenant-ID: <tenant-id>"


import requests

response = requests.get(
    "https://api-<data-region>.central.sophos.com/cases/v1/cases/<caseId>",
    headers={
        "Authorization": "Bearer <access-token>",
        "X-Tenant-ID": "<tenant-id>",
    },
)
print(response.json())


$headers = @{
    "Authorization" = "Bearer <access-token>"
    "X-Tenant-ID" = "<tenant-id>"
}
Invoke-RestMethod -Method GET -Uri "https://api-<data-region>.central.sophos.com/cases/v1/cases/<caseId>" -Headers $headers


package main

import (
    "fmt"
    "io"
    "net/http"
)

func main() {
    req, err := http.NewRequest("GET", "https://api-<data-region>.central.sophos.com/cases/v1/cases/<caseId>", nil)
    if err != nil {
        panic(err)
    }
    req.Header.Set("Authorization", "Bearer <access-token>")
    req.Header.Set("X-Tenant-ID", "<tenant-id>")

    resp, err := http.DefaultClient.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    body, _ := io.ReadAll(resp.Body)
    fmt.Println(string(body))
}


const response = await fetch("https://api-<data-region>.central.sophos.com/cases/v1/cases/<caseId>", {
  method: "GET",
  headers: {
    "Authorization": "Bearer <access-token>",
    "X-Tenant-ID": "<tenant-id>",
  },
});
const data = await response.json();
console.log(data);

Responses

200 — Requested case.

Response fields

idstringrequired
Case ID.
typestringrequired
Case type.
Must be one of: hunt, investigation, incident, healthCheck, duplicate, postureImprovement, customerRequest, activeThreat, exposure, managedRisk, generalRequest.
namestringrequired
Case name.
Must be at most 510 characters long.
tenantobjectrequired
Tenant reference.
Show child attributesHide child attributes
idstring (uuid)
Tenant ID.
managedBystring
Case managed by.
Must be one of: self, sophos.
createdAtstring (date-time)required
Case created date-time.
createdByobject
Principal reference.
Show child attributesHide child attributes
idstring
Principal ID. This is the client ID for service principals.
typestring (enum)
Principal type.
Must be one of: user, service.
namestring
Principal name. This doesn't apply to service principals.
accountTypestring
Account type.
Must be one of: partner, tenant, organization.
accountIdstring (uuid)
Account ID.
resolvedAtstring (date-time)
Case resolved date-time.
updatedAtstring (date-time)
Case updated date-time.
severitystring
Case severity.
Must be one of: notSet, critical, high, medium, low, informational.
statusstringrequired
Case status. actionRequired applies only to Sophos-managed cases.
Must be one of: actionRequired, resolved, investigating, new, onHold.
initialDetectionobject
Initial Detection in a Case.
Show child attributesHide child attributes
idstring
Detection ID.
severityinteger
Severity of the detection. A higher score implies a more severe detection.
Must be ≥ 1 and ≤ 10.
typestring
Type of the detection.
detectionRulestring
Detection rule ID.
mitreAttacksarray of object
List of MITRE ATT&CK objects associated with this detection.
MITRE ATT&CK name and description.
Show child attributesHide child attributes
tacticobject
Tactic used in the MITRE ATT&CK.
Show child attributesHide child attributes
idstring
ID of the tactic.
namestring
MITRE ATT&CK name.
techniquesarray of object
MITRE ATT&CK techniques.
Technique used in the MITRE ATT&CK.
Show child attributesHide child attributes
idstring
ID of the technique.
namestring
Name of the technique.
timestring (timestamp)
Detection event time.
sensorobject
The sensor which generated the detection.
Show child attributesHide child attributes
idstringrequired
ID of the sensor.
typestringrequired
Sensor type where detection occurred.
Must be one of: cloud, endpoint, email, firewall, iam, network, compound, backupAndRecovery.
sourcestringrequired
The name of the sensor source.
versionstringrequired
The version of the sensor provided by the vendor.
namestring
The name of the sensor.
assigneeobject
Principal reference.
Show child attributesHide child attributes
idstring
Principal ID. This is the client ID for service principals.
typestring (enum)
Principal type.
Must be one of: user, service.
namestring
Principal name. This doesn't apply to service principals.
accountTypestring
Account type.
Must be one of: partner, tenant, organization.
accountIdstring (uuid)
Account ID.
assignedAtstring (date-time)
Assignee set date-time.
overviewstring
Case overview.
Must be at most 20000 characters long.
detectionCountinteger
Count of detections associated with the case.
verdictstring
Case verdict.
Must be one of: falsePositive, truePositiveMalicious, truePositiveBenign, truePositive, inconclusive.
escalatedboolean
Case escalated.

Errors

Status Meaning
400 Bad request.
401 Unauthorized.
403 Forbidden.
404 Not found.
500 Unexpected error.

All error responses share the same shape — see the error response object.

Response examples

200

{
  "id": "string",
  "type": "hunt",
  "name": "string",
  "tenant": {
    "id": "00000000-0000-0000-0000-000000000000"
  },
  "managedBy": "self",
  "createdAt": "2026-07-28T00:00:00Z",
  "createdBy": {
    "id": "string",
    "type": "user",
    "name": "string",
    "accountType": "partner",
    "accountId": "00000000-0000-0000-0000-000000000000"
  },
  "resolvedAt": "2026-07-28T00:00:00Z",
  "updatedAt": "2026-07-28T00:00:00Z",
  "severity": "notSet",
  "status": "actionRequired",
  "initialDetection": {
    "id": "string",
    "severity": 5,
    "type": "Threat",
    "detectionRule": "WIN-MITRE-Behavioral-TA0011-T1105",
    "mitreAttacks": [
      {
        "tactic": {
          "id": "TA0002",
          "name": "Execution",
          "techniques": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter"
            }
          ]
        }
      }
    ],
    "time": "string",
    "sensor": {
      "id": "SophosSensorID",
      "type": "cloud",
      "source": "Sophos",
      "version": "1.18.1",
      "name": "string"
    }
  },
  "assignee": {
    "id": "string",
    "type": "user",
    "name": "string",
    "accountType": "partner",
    "accountId": "00000000-0000-0000-0000-000000000000"
  },
  "assignedAt": "2026-07-28T00:00:00Z",
  "overview": "string",
  "detectionCount": 0,
  "verdict": "falsePositive",
  "escalated": true
}

See the guide for a narrative walkthrough of this API.