Skip to content

Get cases

GET/cases

Cases API · Cases

Search a specific customer's cases.

Required permissionxdr-cases.case:read

Parameters

Name In Type Required Description
X-Tenant-ID header string (uuid) Yes Tenant ID.
managedBy query string No Case is managed by.
Must be one of: self, sophos.
type query array of string No Match by case type.
Each item must be one of: hunt, investigation, incident, healthCheck, duplicate, postureImprovement, customerRequest, activeThreat, exposure, managedRisk, generalRequest.
severity query array of string No Case severity.
Each item must be one of: notSet, critical, high, medium, low, informational.
status query array of string No Match by case status. Self-managed cases support new, investigating, onHold, and resolved, while Sophos-managed cases include additional statuses such as actionRequired.
Each item must be one of: actionRequired, resolved, investigating, new, onHold.
assignee query string No For self-managed cases, match by case assignee email, or 'Unassigned' if no assignee is set. For Sophos-managed cases, the assignee is always 'MDR Ops' or 'Unassigned'.
name query string No Match by case name.
overviewContains query string No Partial match by case overview.
createdAfter query string No Timestamp or duration format.
createdBefore query string No Timestamp or duration format.
escalated query boolean No Case escalated.
verdict query string No Is the case a false positive or true positive.
Must be one of: falsePositive, truePositiveMalicious, truePositiveBenign, truePositive, inconclusive.
page query integer No The page number to fetch, starting with 1.
pageSize query integer No The size of the page requested.
sort query string No Sort column ex. sort=“type:asc” sort=“type:desc" sort=“type”.

Request samples

curl -X GET "https://api-<data-region>.central.sophos.com/cases/v1/cases" -H "Authorization: Bearer <access-token>" -H "X-Tenant-ID: <tenant-id>"


import requests

response = requests.get(
    "https://api-<data-region>.central.sophos.com/cases/v1/cases",
    headers={
        "Authorization": "Bearer <access-token>",
        "X-Tenant-ID": "<tenant-id>",
    },
)
print(response.json())


$headers = @{
    "Authorization" = "Bearer <access-token>"
    "X-Tenant-ID" = "<tenant-id>"
}
Invoke-RestMethod -Method GET -Uri "https://api-<data-region>.central.sophos.com/cases/v1/cases" -Headers $headers


package main

import (
    "fmt"
    "io"
    "net/http"
)

func main() {
    req, err := http.NewRequest("GET", "https://api-<data-region>.central.sophos.com/cases/v1/cases", nil)
    if err != nil {
        panic(err)
    }
    req.Header.Set("Authorization", "Bearer <access-token>")
    req.Header.Set("X-Tenant-ID", "<tenant-id>")

    resp, err := http.DefaultClient.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    body, _ := io.ReadAll(resp.Body)
    fmt.Println(string(body))
}


const response = await fetch("https://api-<data-region>.central.sophos.com/cases/v1/cases", {
  method: "GET",
  headers: {
    "Authorization": "Bearer <access-token>",
    "X-Tenant-ID": "<tenant-id>",
  },
});
const data = await response.json();
console.log(data);

Responses

200 — Cases found.

Response fields

itemsarray of object
A case.
Show child attributesHide child attributes
idstringrequired
Case ID.
typestringrequired
Case type.
Must be one of: hunt, investigation, incident, healthCheck, duplicate, postureImprovement, customerRequest, activeThreat, exposure, managedRisk, generalRequest.
namestringrequired
Case name.
Must be at most 510 characters long.
tenantobjectrequired
Tenant reference.
Show child attributesHide child attributes
idstring (uuid)
Tenant ID.
managedBystring
Case managed by.
Must be one of: self, sophos.
createdAtstring (date-time)required
Case created date-time.
createdByobject
Principal reference.
Show child attributesHide child attributes
idstring
Principal ID. This is the client ID for service principals.
typestring (enum)
Principal type.
Must be one of: user, service.
namestring
Principal name. This doesn't apply to service principals.
accountTypestring
Account type.
Must be one of: partner, tenant, organization.
accountIdstring (uuid)
Account ID.
resolvedAtstring (date-time)
Case resolved date-time.
updatedAtstring (date-time)
Case updated date-time.
severitystring
Case severity.
Must be one of: notSet, critical, high, medium, low, informational.
statusstringrequired
Case status. actionRequired applies only to Sophos-managed cases.
Must be one of: actionRequired, resolved, investigating, new, onHold.
initialDetectionobject
Initial Detection in a Case.
Show child attributesHide child attributes
idstring
Detection ID.
severityinteger
Severity of the detection. A higher score implies a more severe detection.
Must be ≥ 1 and ≤ 10.
typestring
Type of the detection.
detectionRulestring
Detection rule ID.
mitreAttacksarray of object
List of MITRE ATT&CK objects associated with this detection.
MITRE ATT&CK name and description.
Show child attributesHide child attributes
tacticobject
Tactic used in the MITRE ATT&CK.
Show child attributesHide child attributes
idstring
ID of the tactic.
namestring
MITRE ATT&CK name.
techniquesarray of object
MITRE ATT&CK techniques.
Technique used in the MITRE ATT&CK.
Show child attributesHide child attributes
idstring
ID of the technique.
namestring
Name of the technique.
timestring (timestamp)
Detection event time.
sensorobject
The sensor which generated the detection.
Show child attributesHide child attributes
idstringrequired
ID of the sensor.
typestringrequired
Sensor type where detection occurred.
Must be one of: cloud, endpoint, email, firewall, iam, network, compound, backupAndRecovery.
sourcestringrequired
The name of the sensor source.
versionstringrequired
The version of the sensor provided by the vendor.
namestring
The name of the sensor.
assigneeobject
Principal reference.
Show child attributesHide child attributes
idstring
Principal ID. This is the client ID for service principals.
typestring (enum)
Principal type.
Must be one of: user, service.
namestring
Principal name. This doesn't apply to service principals.
accountTypestring
Account type.
Must be one of: partner, tenant, organization.
accountIdstring (uuid)
Account ID.
assignedAtstring (date-time)
Assignee set date-time.
overviewstring
Case overview.
Must be at most 20000 characters long.
detectionCountinteger
Count of detections associated with the case.
verdictstring
Case verdict.
Must be one of: falsePositive, truePositiveMalicious, truePositiveBenign, truePositive, inconclusive.
escalatedboolean
Case escalated.
pagesobject
Show child attributesHide child attributes
currentintegerrequired
The 1-based page number being returned.
sizeintegerrequired
The size of the page being returned.
totalinteger
(Optional) The total number of pages that exist, if pageTotal=true in the request.
itemsinteger
(Optional) The total number of items across all pages.
maxSizeintegerrequired
The maximum page size that can be requested.

Errors

Status Meaning
400 Bad request.
401 Unauthorized.
403 Forbidden.
500 Unexpected error.

All error responses share the same shape — see the error response object.

Response examples

200

{
  "items": [
    {
      "id": "string",
      "type": "hunt",
      "name": "string",
      "tenant": {
        "id": "00000000-0000-0000-0000-000000000000"
      },
      "managedBy": "self",
      "createdAt": "2026-07-28T00:00:00Z",
      "createdBy": {
        "id": "string",
        "type": "user",
        "name": "string",
        "accountType": "partner",
        "accountId": "00000000-0000-0000-0000-000000000000"
      },
      "resolvedAt": "2026-07-28T00:00:00Z",
      "updatedAt": "2026-07-28T00:00:00Z",
      "severity": "notSet",
      "status": "actionRequired",
      "initialDetection": {
        "id": "string",
        "severity": 5,
        "type": "Threat",
        "detectionRule": "WIN-MITRE-Behavioral-TA0011-T1105",
        "mitreAttacks": [
          {
            "tactic": {
              "id": "TA0002",
              "name": "Execution",
              "techniques": [
                {
                  "id": "T1059",
                  "name": "Command and Scripting Interpreter"
                }
              ]
            }
          }
        ],
        "time": "string",
        "sensor": {
          "id": "SophosSensorID",
          "type": "cloud",
          "source": "Sophos",
          "version": "1.18.1",
          "name": "string"
        }
      },
      "assignee": {
        "id": "string",
        "type": "user",
        "name": "string",
        "accountType": "partner",
        "accountId": "00000000-0000-0000-0000-000000000000"
      },
      "assignedAt": "2026-07-28T00:00:00Z",
      "overview": "string",
      "detectionCount": 0,
      "verdict": "falsePositive",
      "escalated": true
    }
  ],
  "pages": {
    "current": 0,
    "size": 0,
    "total": 0,
    "items": 0,
    "maxSize": 0
  }
}

See the guide for a narrative walkthrough of this API.