> ## Documentation Index
> Fetch the complete documentation index at: https://tracecat-feat-mcp-cred-setup.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Cases

## `core.cases.create_case`

Create a new case.

### Inputs

<ParamField path="description" type="string" required>
  The description of the case.
</ParamField>

<ParamField path="summary" type="string" required>
  The summary of the case.
</ParamField>

<ParamField path="create_missing_tags" type="boolean">
  If true, create any tags that do not already exist.

  Default: `false`.
</ParamField>

<ParamField path="dropdown_values" type="array[CaseDropdownValueInput] | null">
  Dropdown selections to set on the case. Each item must include either definition\_id or definition\_ref, and either option\_id or option\_ref (or null to clear).

  Default: `null`.
</ParamField>

<ParamField path="fields" type="object | null">
  Custom fields for the case.

  Default: `null`.
</ParamField>

<ParamField path="payload" type="object | null">
  Payload for the case.

  Default: `null`.
</ParamField>

<ParamField path="priority" type="string">
  The priority of the case.

  Default: `"unknown"`.

  Allowed values: `unknown`, `low`, `medium`, `high`, `critical`, `other`.
</ParamField>

<ParamField path="severity" type="string">
  The severity of the case.

  Default: `"unknown"`.

  Allowed values: `unknown`, `informational`, `low`, `medium`, `high`, `critical`, `fatal`, `other`.
</ParamField>

<ParamField path="status" type="string">
  The status of the case.

  Default: `"unknown"`.

  Allowed values: `unknown`, `new`, `in_progress`, `on_hold`, `resolved`, `closed`, `other`.
</ParamField>

<ParamField path="tags" type="array[string] | null">
  List of tag identifiers (IDs or refs) to add to the case.

  Default: `null`.
</ParamField>

### Examples

**Create a case**

```yaml theme={null}
- ref: create_case
  action: core.cases.create_case
  args:
    summary: "Investigate alert ${{ TRIGGER.alert_id }}"
    description: "Created from workflow trigger."
    priority: high
    severity: high
    tags:
      - phishing
```

## `core.cases.get_case`

Get details of a specific case by ID.

### Inputs

<ParamField path="case_id" type="string" required>
  The ID of the case to retrieve.
</ParamField>

### Examples

**Get a case**

```yaml theme={null}
- ref: get_case
  action: core.cases.get_case
  args:
    case_id: ${{ TRIGGER.case_id }}
```

## `core.cases.update_case`

Update an existing case.

### Inputs

<ParamField path="case_id" type="string" required>
  The ID of the case to update.
</ParamField>

<ParamField path="append" type="boolean">
  If true, append the provided description to the existing description when it is not empty.

  Default: `false`.
</ParamField>

<ParamField path="create_missing_tags" type="boolean">
  If true, create any tags that do not already exist.

  Default: `false`.
</ParamField>

<ParamField path="description" type="string | null">
  The updated description of the case.

  Default: `null`.
</ParamField>

<ParamField path="dropdown_values" type="array[CaseDropdownValueInput] | null">
  Dropdown selections to set or clear. Each item must include either definition\_id or definition\_ref, and either option\_id or option\_ref (or null to clear).

  Default: `null`.
</ParamField>

<ParamField path="fields" type="object | null">
  Updated custom fields for the case.

  Default: `null`.
</ParamField>

<ParamField path="payload" type="object | null">
  Updated payload for the case.

  Default: `null`.
</ParamField>

<ParamField path="priority" type="string | null">
  The updated priority of the case.

  Default: `null`.
</ParamField>

<ParamField path="severity" type="string | null">
  The updated severity of the case.

  Default: `null`.
</ParamField>

<ParamField path="status" type="string | null">
  The updated status of the case.

  Default: `null`.
</ParamField>

<ParamField path="summary" type="string | null">
  The updated summary of the case.

  Default: `null`.
</ParamField>

<ParamField path="tags" type="array[string] | null">
  List of tag identifiers (IDs or refs) to set on the case. This will replace all existing tags.

  Default: `null`.
</ParamField>

### Examples

**Update case fields**

```yaml theme={null}
- ref: update_case
  action: core.cases.update_case
  args:
    case_id: ${{ TRIGGER.case_id }}
    status: in_progress
    priority: critical
    append: true
    description: |
      Analyst note:
      - Escalated after credential theft indicators were confirmed.
```

## `core.cases.list_cases`

List all cases.

### Inputs

<ParamField path="cursor" type="string | null">
  Pagination cursor used to fetch a specific page when paginate=true.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer">
  Maximum number of cases to return.

  Default: `100`.
</ParamField>

<ParamField path="order_by" type="string | null">
  The field to order the cases by.

  Default: `null`.
</ParamField>

<ParamField path="paginate" type="boolean">
  If true, return cursor pagination metadata along with items.

  Default: `false`.
</ParamField>

<ParamField path="reverse" type="boolean">
  Reverse pagination direction when paginate=true.

  Default: `false`.
</ParamField>

<ParamField path="sort" type="string | null">
  The direction to order the cases by.

  Default: `null`.
</ParamField>

### Examples

**List cases**

```yaml theme={null}
- ref: list_cases
  action: core.cases.list_cases
  args:
    limit: 25
    order_by: updated_at
    sort: desc
```

## `core.cases.search_cases`

Search cases based on various criteria.

### Inputs

<ParamField path="assignee_id" type="string | array[string] | null">
  Filter by assignee ID or 'unassigned'.

  Default: `null`.
</ParamField>

<ParamField path="cursor" type="string | null">
  Pagination cursor used to fetch a specific page when paginate=true.

  Default: `null`.
</ParamField>

<ParamField path="dropdown" type="array[string] | null">
  Filter by dropdown values in definition\_ref:option\_ref format.

  Default: `null`.
</ParamField>

<ParamField path="end_time" type="string | null">
  Filter cases created before this time.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer">
  Maximum number of cases to return.

  Default: `100`.
</ParamField>

<ParamField path="order_by" type="string | null">
  The field to order the cases by.

  Default: `null`.
</ParamField>

<ParamField path="paginate" type="boolean">
  If true, return cursor pagination metadata along with items.

  Default: `false`.
</ParamField>

<ParamField path="priority" type="string | array[string] | null">
  Filter by case priority.

  Default: `null`.
</ParamField>

<ParamField path="reverse" type="boolean">
  Reverse pagination direction when paginate=true.

  Default: `false`.
</ParamField>

<ParamField path="search_term" type="string | null">
  Text to search for in case summary and description.

  Default: `null`.
</ParamField>

<ParamField path="severity" type="string | array[string] | null">
  Filter by case severity.

  Default: `null`.
</ParamField>

<ParamField path="short_id" type="string | null">
  Filter by case short\_id.

  Default: `null`.
</ParamField>

<ParamField path="sort" type="string | null">
  The direction to order the cases by.

  Default: `null`.
</ParamField>

<ParamField path="start_time" type="string | null">
  Filter cases created after this time.

  Default: `null`.
</ParamField>

<ParamField path="status" type="string | array[string] | null">
  Filter by case status.

  Default: `null`.
</ParamField>

<ParamField path="tags" type="array[string] | null">
  Filter by tag IDs or refs (AND logic).

  Default: `null`.
</ParamField>

<ParamField path="updated_after" type="string | null">
  Filter cases updated after this time.

  Default: `null`.
</ParamField>

<ParamField path="updated_before" type="string | null">
  Filter cases updated before this time.

  Default: `null`.
</ParamField>

### Examples

**Search cases**

```yaml theme={null}
- ref: search_cases
  action: core.cases.search_cases
  args:
    search_term: phishing
    status:
      - new
      - in_progress
    limit: 25
```

## `core.cases.list_case_events`

List all events for a case in chronological order.

### Inputs

<ParamField path="case_id" type="string" required>
  The ID of the case to get events for.
</ParamField>

### Examples

**List case events**

```yaml theme={null}
- ref: list_case_events
  action: core.cases.list_case_events
  args:
    case_id: ${{ TRIGGER.case_id }}
```

## `core.cases.assign_user`

Assign a user to an existing case.

### Inputs

<ParamField path="assignee_id" type="string" required>
  The ID of the user to assign to the case.
</ParamField>

<ParamField path="case_id" type="string" required>
  The ID of the case to assign a user to.
</ParamField>

### Examples

**Assign a user by ID**

```yaml theme={null}
- ref: assign_user
  action: core.cases.assign_user
  args:
    case_id: ${{ TRIGGER.case_id }}
    assignee_id: ${{ TRIGGER.assignee_id }}
```

## `core.cases.assign_user_by_email`

Assign a user to an existing case by email.

### Inputs

<ParamField path="assignee_email" type="string" required>
  The email of the user to assign to the case.
</ParamField>

<ParamField path="case_id" type="string" required>
  The ID of the case to assign a user to.
</ParamField>

### Examples

**Assign a user by email**

```yaml theme={null}
- ref: assign_user_by_email
  action: core.cases.assign_user_by_email
  args:
    case_id: ${{ TRIGGER.case_id }}
    assignee_email: analyst@example.com
```

## `core.cases.add_case_tag`

Add a tag to a case by tag ID or ref.

### Inputs

<ParamField path="case_id" type="string" required>
  The ID of the case to add a tag to.
</ParamField>

<ParamField path="tag" type="string" required>
  The tag identifier (ID or ref) to add to the case.
</ParamField>

<ParamField path="create_if_missing" type="boolean">
  If true, create the tag if it does not exist.

  Default: `false`.
</ParamField>

### Examples

**Add a case tag**

```yaml theme={null}
- ref: add_case_tag
  action: core.cases.add_case_tag
  args:
    case_id: ${{ TRIGGER.case_id }}
    tag: credential-theft
    create_if_missing: true
```

## `core.cases.remove_case_tag`

Remove a tag from a case by tag ID or ref.

### Inputs

<ParamField path="case_id" type="string" required>
  The ID of the case to remove a tag from.
</ParamField>

<ParamField path="tag" type="string" required>
  The tag identifier (ID or ref) to remove from the case.
</ParamField>

### Examples

**Remove a case tag**

```yaml theme={null}
- ref: remove_case_tag
  action: core.cases.remove_case_tag
  args:
    case_id: ${{ TRIGGER.case_id }}
    tag: needs-triage
```

## `core.cases.delete_case`

Delete a case.

### Inputs

<ParamField path="case_id" type="string" required>
  The ID of the case to delete.
</ParamField>

### Examples

**Delete a case**

```yaml theme={null}
- ref: delete_case
  action: core.cases.delete_case
  args:
    case_id: ${{ TRIGGER.case_id }}
```

## `core.cases.create_comment`

Add a comment to an existing case.

### Inputs

<ParamField path="case_id" type="string" required>
  The ID of the case to comment on.
</ParamField>

<ParamField path="content" type="string" required>
  The comment content.
</ParamField>

<ParamField path="parent_id" type="string | null">
  The ID of the parent comment if this is a reply.

  Default: `null`.
</ParamField>

<ParamField path="workflow_id" type="string | null">
  The ID of the workflow to run when the comment is created.

  Default: `null`.
</ParamField>

### Examples

**Create a comment**

```yaml theme={null}
- ref: create_comment
  action: core.cases.create_comment
  args:
    case_id: ${{ TRIGGER.case_id }}
    content: "Initial triage started."
```

## `core.cases.reply_to_comment`

Reply to a top-level case comment.

### Inputs

<ParamField path="case_id" type="string" required>
  The ID of the case containing the parent comment.
</ParamField>

<ParamField path="content" type="string" required>
  The reply content.
</ParamField>

<ParamField path="parent_comment_id" type="string" required>
  The ID of the top-level comment to reply to.
</ParamField>

### Examples

**Reply to a comment**

```yaml theme={null}
- ref: reply_to_comment
  action: core.cases.reply_to_comment
  args:
    case_id: ${{ TRIGGER.case_id }}
    parent_comment_id: ${{ TRIGGER.comment_id }}
    content: "Added IOC context."
```

## `core.cases.update_comment`

Update an existing case comment.

### Inputs

<ParamField path="comment_id" type="string" required>
  The ID of the comment to update.
</ParamField>

<ParamField path="content" type="string" required>
  The updated comment content.
</ParamField>

### Examples

**Update a comment**

```yaml theme={null}
- ref: update_comment
  action: core.cases.update_comment
  args:
    comment_id: ${{ TRIGGER.comment_id }}
    content: "Initial triage started. Waiting on endpoint data."
```

## `core.cases.list_comments`

List all comments for a case.

### Inputs

<ParamField path="case_id" type="string" required>
  The ID of the case to get comments for.
</ParamField>

### Examples

**List comments**

```yaml theme={null}
- ref: list_comments
  action: core.cases.list_comments
  args:
    case_id: ${{ TRIGGER.case_id }}
```

## `core.cases.list_comment_threads`

List comment threads for a case.

### Inputs

<ParamField path="case_id" type="string" required>
  The ID of the case to get comment threads for.
</ParamField>

### Examples

**List comment threads**

```yaml theme={null}
- ref: list_comment_threads
  action: core.cases.list_comment_threads
  args:
    case_id: ${{ TRIGGER.case_id }}
```

## `core.cases.get_comment_thread`

Get the full thread for a comment ID.

### Inputs

<ParamField path="comment_id" type="string" required>
  The ID of a comment within the thread.
</ParamField>

### Examples

**Get a comment thread**

```yaml theme={null}
- ref: get_comment_thread
  action: core.cases.get_comment_thread
  args:
    comment_id: ${{ TRIGGER.comment_id }}
```

## `core.cases.upload_attachment`

Upload a file attachment to a case.

### Inputs

<ParamField path="case_id" type="string" required>
  The ID of the case to attach the file to.
</ParamField>

<ParamField path="content_base64" type="string" required>
  The file content encoded in base64.
</ParamField>

<ParamField path="content_type" type="string" required>
  The MIME type of the file (e.g., 'application/pdf').
</ParamField>

<ParamField path="file_name" type="string" required>
  The original filename.
</ParamField>

### Examples

**Upload an attachment**

```yaml theme={null}
- ref: upload_attachment
  action: core.cases.upload_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    file_name: note.txt
    content_base64: Zm9yZW5zaWMgbm90ZXM=
    content_type: text/plain
```

## `core.cases.upload_attachment_from_url`

Upload a file attachment to a case from a URL.

### Inputs

<ParamField path="case_id" type="string" required>
  The ID of the case to attach the file to.
</ParamField>

<ParamField path="url" type="string" required>
  The URL of the file to upload.
</ParamField>

<ParamField path="file_name" type="string | null">
  Filename of the file to upload. If not provided, the filename will be inferred from the URL.

  Default: `null`.
</ParamField>

<ParamField path="headers" type="map[string, string] | null">
  The headers to use when downloading the file.

  Default: `null`.
</ParamField>

### Examples

**Upload an attachment from a URL**

```yaml theme={null}
- ref: upload_attachment_from_url
  action: core.cases.upload_attachment_from_url
  args:
    case_id: ${{ TRIGGER.case_id }}
    url: https://artifacts.example.com/evidence/${{ TRIGGER.alert_id }}
    headers:
      Authorization: Bearer ${{ SECRETS.artifacts.API_TOKEN }}
    file_name: evidence.json
```

## `core.cases.list_attachments`

List all attachments for a case.

### Inputs

<ParamField path="case_id" type="string" required>
  The ID of the case to list attachments for.
</ParamField>

### Examples

**List attachments**

```yaml theme={null}
- ref: list_attachments
  action: core.cases.list_attachments
  args:
    case_id: ${{ TRIGGER.case_id }}
```

## `core.cases.get_attachment`

Get attachment metadata without downloading the content.

### Inputs

<ParamField path="attachment_id" type="string" required>
  The ID of the attachment to get.
</ParamField>

<ParamField path="case_id" type="string" required>
  The ID of the case containing the attachment.
</ParamField>

### Examples

**Get attachment metadata**

```yaml theme={null}
- ref: get_attachment
  action: core.cases.get_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
```

## `core.cases.get_attachment_download_url`

Get a presigned S3 URL for downloading an attachment.

### Inputs

<ParamField path="attachment_id" type="string" required>
  The ID of the attachment.
</ParamField>

<ParamField path="case_id" type="string" required>
  The ID of the case containing the attachment.
</ParamField>

<ParamField path="expiry" type="integer | null">
  URL expiry time in seconds. If not provided, uses the default from configuration.

  Default: `null`.
</ParamField>

### Examples

**Get an attachment download URL**

```yaml theme={null}
- ref: get_attachment_download_url
  action: core.cases.get_attachment_download_url
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
    expiry: 900
```

## `core.cases.download_attachment`

Download an attachment's content.

### Inputs

<ParamField path="attachment_id" type="string" required>
  The ID of the attachment to download.
</ParamField>

<ParamField path="case_id" type="string" required>
  The ID of the case containing the attachment.
</ParamField>

### Examples

**Download an attachment**

```yaml theme={null}
- ref: download_attachment
  action: core.cases.download_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
```

## `core.cases.delete_attachment`

Delete an attachment from a case.

### Inputs

<ParamField path="attachment_id" type="string" required>
  The ID of the attachment to delete.
</ParamField>

<ParamField path="case_id" type="string" required>
  The ID of the case containing the attachment.
</ParamField>

### Examples

**Delete an attachment**

```yaml theme={null}
- ref: delete_attachment
  action: core.cases.delete_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
```

## `core.cases.create_task`

Create a new task for a case.

<Badge icon="lock" color="blue" size="lg" shape="pill">Enterprise Edition</Badge>

### Inputs

<ParamField path="case_id" type="string" required>
  The ID of the case to create a task for.
</ParamField>

<ParamField path="title" type="string" required>
  The title of the task.
</ParamField>

<ParamField path="assignee_id" type="string | null">
  The ID of the user to assign the task to.

  Default: `null`.
</ParamField>

<ParamField path="default_trigger_values" type="object | null">
  The default trigger values for the task.

  Default: `null`.
</ParamField>

<ParamField path="description" type="string | null">
  The description of the task.

  Default: `null`.
</ParamField>

<ParamField path="priority" type="string">
  The priority of the task (unknown, low, medium, high, critical).

  Default: `"unknown"`.
</ParamField>

<ParamField path="status" type="string">
  The status of the task (todo, in\_progress, blocked, completed).

  Default: `"todo"`.
</ParamField>

<ParamField path="workflow_id" type="string | null">
  The ID of the workflow associated with this task.

  Default: `null`.
</ParamField>

### Examples

**Create a task**

```yaml theme={null}
- ref: create_task
  action: core.cases.create_task
  args:
    case_id: ${{ TRIGGER.case_id }}
    title: Collect email headers
    description: Pull the original message from the mail gateway.
    priority: high
    status: todo
```

## `core.cases.get_task`

Get a specific case task by ID.

<Badge icon="lock" color="blue" size="lg" shape="pill">Enterprise Edition</Badge>

### Inputs

<ParamField path="task_id" type="string" required>
  The ID of the task to retrieve.
</ParamField>

### Examples

**Get a task**

```yaml theme={null}
- ref: get_task
  action: core.cases.get_task
  args:
    task_id: ${{ TRIGGER.task_id }}
```

## `core.cases.list_tasks`

List all tasks for a case.

<Badge icon="lock" color="blue" size="lg" shape="pill">Enterprise Edition</Badge>

### Inputs

<ParamField path="case_id" type="string" required>
  The ID of the case to list tasks for.
</ParamField>

### Examples

**List tasks**

```yaml theme={null}
- ref: list_tasks
  action: core.cases.list_tasks
  args:
    case_id: ${{ TRIGGER.case_id }}
```

## `core.cases.update_task`

Update an existing case task.

<Badge icon="lock" color="blue" size="lg" shape="pill">Enterprise Edition</Badge>

### Inputs

<ParamField path="task_id" type="string" required>
  The ID of the task to update.
</ParamField>

<ParamField path="assignee_id" type="string | null">
  The ID of the user to assign the task to.

  Default: `null`.
</ParamField>

<ParamField path="default_trigger_values" type="object | null">
  The default trigger values for the task.

  Default: `null`.
</ParamField>

<ParamField path="description" type="string | null">
  The updated description of the task.

  Default: `null`.
</ParamField>

<ParamField path="priority" type="string | null">
  The updated priority of the task (unknown, low, medium, high, critical).

  Default: `null`.
</ParamField>

<ParamField path="status" type="string | null">
  The updated status of the task (todo, in\_progress, blocked, completed).

  Default: `null`.
</ParamField>

<ParamField path="title" type="string | null">
  The updated title of the task.

  Default: `null`.
</ParamField>

<ParamField path="workflow_id" type="string | null">
  The ID of the workflow associated with this task.

  Default: `null`.
</ParamField>

### Examples

**Update a task**

```yaml theme={null}
- ref: update_task
  action: core.cases.update_task
  args:
    task_id: ${{ TRIGGER.task_id }}
    status: in_progress
```

## `core.cases.delete_task`

Delete a case task.

<Badge icon="lock" color="blue" size="lg" shape="pill">Enterprise Edition</Badge>

### Inputs

<ParamField path="task_id" type="string" required>
  The ID of the task to delete.
</ParamField>

### Examples

**Delete a task**

```yaml theme={null}
- ref: delete_task
  action: core.cases.delete_task
  args:
    task_id: ${{ TRIGGER.task_id }}
```

## `core.cases.link_row`

Link an existing table row to a case.

<Badge icon="lock" color="blue" size="lg" shape="pill">Enterprise Edition</Badge>

### Inputs

<ParamField path="case_id" type="string" required>
  Case ID
</ParamField>

<ParamField path="row_id" type="string" required>
  Row ID
</ParamField>

<ParamField path="table_id" type="string" required>
  Table ID
</ParamField>

### Examples

**Link a table row**

```yaml theme={null}
- ref: link_row
  action: core.cases.link_row
  args:
    case_id: ${{ TRIGGER.case_id }}
    table_id: indicators
    row_id: ${{ TRIGGER.row_id }}
```

## `core.cases.unlink_row`

Remove a linked table row from a case.

<Badge icon="lock" color="blue" size="lg" shape="pill">Enterprise Edition</Badge>

### Inputs

<ParamField path="case_id" type="string" required>
  Case ID
</ParamField>

<ParamField path="row_id" type="string" required>
  Row ID
</ParamField>

<ParamField path="table_id" type="string" required>
  Table ID
</ParamField>

### Examples

**Unlink a table row**

```yaml theme={null}
- ref: unlink_row
  action: core.cases.unlink_row
  args:
    case_id: ${{ TRIGGER.case_id }}
    table_id: indicators
    row_id: ${{ TRIGGER.row_id }}
```

## `core.cases.insert_row`

Insert a row into a table and link it to a case.

<Badge icon="lock" color="blue" size="lg" shape="pill">Enterprise Edition</Badge>

<Info>
  Linked rows use regular tables. Create the destination table with
  the same `columns` schema documented in
  [Tables](/automations/tables).
</Info>

### Inputs

<ParamField path="case_id" type="string" required>
  Case ID
</ParamField>

<ParamField path="row" type="object" required>
  Row values
</ParamField>

<ParamField path="table_id" type="string" required>
  Table ID
</ParamField>

### Examples

**Insert and link a table row**

```yaml theme={null}
- ref: insert_case_row
  action: core.cases.insert_row
  args:
    case_id: ${{ TRIGGER.case_id }}
    table_id: indicators
    row:
      value: ${{ TRIGGER.indicator }}
      indicator_type: domain
```

## `core.cases.get_case_metrics`

Get case metrics as OTEL-aligned time-series for the provided case IDs.

<Badge icon="lock" color="blue" size="lg" shape="pill">Enterprise Edition</Badge>

### Inputs

<ParamField path="case_ids" type="array[string]" required>
  List of case IDs to get case metrics for.
</ParamField>

### Examples

**Read case metrics**

```yaml theme={null}
- ref: case_metrics
  action: core.cases.get_case_metrics
  args:
    case_ids:
      - ${{ TRIGGER.case_id }}
      - ${{ TRIGGER.related_case_id }}
```