---
updatedAt: 2026-08-31T03:40:46.000Z
agentTools:
  projectIndex: https://readme.cipherowl.ai/llms.txt
---

# Get one Case

Returns one Case together with the address's current screening route: the Case that currently holds it (normally where the next screening hit lands — see ScreeningRoute for when a hit opens a successor instead) and any intake suppression in force. The Case's screening and audit history are served by List Screenings and List Audit Events.

# OpenAPI definition

```json
{
  "openapi": "3.0.3",
  "info": {
    "title": "API ENDPOINTS",
    "description": "CipherOwl blockchain compliance and risk assessment APIs.",
    "version": "1.0"
  },
  "servers": [
    {
      "url": "https://svc.cipherowl.ai"
    }
  ],
  "security": [
    {
      "BearerAuth": []
    }
  ],
  "tags": [
    {
      "name": "Case Management",
      "description": "Read the organization's compliance cases. Search and page the case queue, read one case with the screening route currently in force for its address, its append-only screening history, and its audit trail. Read-only: cases are opened by screening (or by hand in the CipherOwl console), worked and closed there, and no write route is published here. A Case identifies its address by `network`; Cases opened today store the chain there (e.g. `evm`)."
    }
  ],
  "paths": {
    "/api/case-management/v1/cases/{caseId}": {
      "get": {
        "summary": "Get one Case",
        "description": "Returns one Case together with the address's current screening route: the Case that currently holds it (normally where the next screening hit lands — see ScreeningRoute for when a hit opens a successor instead) and any intake suppression in force. The Case's screening and audit history are served by List Screenings and List Audit Events.",
        "operationId": "CaseManagementService_GetCase",
        "responses": {
          "200": {
            "description": "A successful response.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/case_managementv1GetCaseResponse"
                }
              }
            }
          }
        },
        "parameters": [
          {
            "name": "caseId",
            "description": "Identifier of the Case (Case.id).",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "includeDeleted",
            "description": "Also serve the Case when it is in the Trash (soft-deleted). Default\n(false) answers NOT_FOUND for a deleted Case. Requires the Case Management\nManager role, which API clients authenticating with client credentials do\nnot hold: they are denied when they set it, so leave it unset.",
            "in": "query",
            "required": false,
            "schema": {
              "type": "boolean"
            }
          }
        ],
        "tags": [
          "Case Management"
        ]
      }
    }
  },
  "components": {
    "securitySchemes": {
      "BearerAuth": {
        "type": "http",
        "scheme": "bearer",
        "bearerFormat": "JWT",
        "description": "OAuth 2.0 access token obtained from /oauth/token using client credentials."
      }
    },
    "schemas": {
      "case_managementv1Case": {
        "type": "object",
        "properties": {
          "id": {
            "type": "string",
            "description": "Unique Case identifier; the caseId path parameter of the per-Case routes."
          },
          "status": {
            "allOf": [
              {
                "$ref": "#/components/schemas/case_managementv1CaseStatus"
              }
            ],
            "description": "Current lifecycle status; see CaseStatus for the values and the moves\nbetween them. Together with investigatorId (assigned or not) and\narchivedAt (archived or not) it places the Case in exactly one\nwork-queue stage — the QueueStage the List Cases queueStage filter\nselects on."
          },
          "investigatorId": {
            "type": "string",
            "description": "Subject id of the investigator the Case is assigned to; absent while the\nCase is unassigned."
          },
          "clientReference": {
            "type": "string",
            "description": "Your own system's reference for the Case, for correlating it with your\nrecords: supplied when the Case was opened and editable in the console\nafterwards; absent when none is set. Filterable in List Cases."
          },
          "network": {
            "type": "string",
            "description": "Network of the Case's address. Cases opened today store the chain here\n(\"evm\", \"solana\", \"bitcoin\", \"tron\", …); older Cases may carry a network\nkey such as \"ethereum_mainnet\". The network a screening hit named is on\nthe Case's screening history (trigger.network)."
          },
          "address": {
            "type": "string",
            "description": "The Case's address, in the canonical form for its chain; the\nservice normalizes it on intake."
          },
          "createdBy": {
            "type": "string",
            "description": "Who created the Case: the subject id of the user who opened it by hand, or\nthe service identity \"system:screening\" when a screening hit opened it\nautomatically. Never an email address."
          },
          "createdAt": {
            "type": "string",
            "format": "date-time",
            "description": "When the Case was created."
          },
          "updatedAt": {
            "type": "string",
            "format": "date-time",
            "description": "When the Case last changed: moves on every status change, assignment,\nmetadata edit, workflow action and accepted screening hit — the instant\nupdatedFrom/updatedTo filter on in List Cases. Three Case-level changes\nleave it untouched: a screening hit recorded under MONITOR_ONLY\nsuppression (adds a Screening history entry), suppressing or resuming\nscreening intake (changes screeningRoute) — both increment version only —\nand closureReportStatus, which is read live from the report. It tracks\nthe Case itself, not its Screening history: evidence and artifacts on\nthat history settle asynchronously without moving updatedAt or version,\nso re-read the Screening history for their progress."
          },
          "version": {
            "type": "string",
            "format": "int64",
            "description": "Change counter, incremented on every accepted change to the Case,\nMONITOR_ONLY screening hits and intake suppress/resume included.\nclosureReportStatus is read live from the report and changes without\nmoving version or updatedAt."
          },
          "closedAt": {
            "type": "string",
            "format": "date-time",
            "description": "When the Case was closed. Present only while the Case is Closed; reopening\nclears it. Earlier closures remain in the audit trail as CASE_CLOSED\nevents, each with its own closure under payload.closure."
          },
          "latestClosureNumber": {
            "type": "string",
            "format": "int64",
            "description": "Ordinal of the Case's latest closure: 1 for the first close, one more for\nevery close after a reopen. Absent while the Case is not Closed."
          },
          "latestDisposition": {
            "allOf": [
              {
                "$ref": "#/components/schemas/v1ClosureDisposition"
              }
            ],
            "description": "Outcome recorded by the latest closure; see ClosureDisposition. Absent\nwhile the Case is not Closed."
          },
          "closureReportStatus": {
            "allOf": [
              {
                "$ref": "#/components/schemas/v1ClosureReportStatus"
              }
            ],
            "description": "Render state of the latest Closure Report; see ClosureReportStatus. Read\nlive from the report, so it changes without moving updatedAt or version.\nAbsent while the Case is not Closed."
          },
          "archivedAt": {
            "type": "string",
            "format": "date-time",
            "description": "When the Case was archived; absent while not archived. Only a Closed Case\nis archived, and reopening it clears this."
          },
          "mutedAt": {
            "type": "string",
            "format": "date-time",
            "description": "When the Case was muted; absent while not muted. Muting is a flag beside\nthe lifecycle, not a status of its own: a muted Case keeps its status and\nqueue stage. Set when a Manager mutes the Case in the console and cleared\non unmute, close or reopen, so a Closed or Archived Case is never muted."
          },
          "mutedBy": {
            "type": "string",
            "description": "Subject id of the Manager who muted the Case; absent when not muted."
          },
          "muteReason": {
            "type": "string",
            "description": "Reason given for the current mute; absent when not muted. Reasons for\nearlier mutes live in the CASE_MUTED / CASE_UNMUTED audit events."
          },
          "title": {
            "type": "string",
            "description": "Human-readable title; never empty. Supplied by the creator of a Case opened\nby hand; generated for a Case opened by a screening hit as\n\"CASE_{yyMMdd}_{4 random uppercase alphanumerics}\" (e.g. CASE_260728_7Q2F)\nfrom the UTC creation date. Editable in the console."
          },
          "priority": {
            "allOf": [
              {
                "$ref": "#/components/schemas/v1CasePriority"
              }
            ],
            "description": "Triage priority; see CasePriority. Absent when no priority is set.\nEditable in the console."
          },
          "deletedAt": {
            "type": "string",
            "format": "date-time",
            "description": "When the Case was moved to the Trash (soft-deleted); absent while the Case\nis active. A deleted Case keeps every other field but is left out of List\nCases and Get Case unless the Manager-only deletedOnly / includeDeleted\noption asks for it — API clients authenticating with client credentials\ncannot, so they never see a deleted Case. Managers restore Cases from the\nTrash in the console."
          },
          "deletedBy": {
            "type": "string",
            "description": "Subject id of the Manager who deleted the Case; absent while not deleted\nand cleared on restore. Who/when/why of earlier deletions lives in the\nCASE_DELETED / CASE_RESTORED audit events."
          },
          "deleteReason": {
            "type": "string",
            "description": "Reason given for the current deletion; absent while not deleted and\ncleared on restore."
          }
        },
        "description": "Case is one compliance Case: a single blockchain address on a single chain\nclass, opened by a screening hit or by hand, and worked through the Open /\nPending Approval / Closed lifecycle (status; see CaseStatus). Fields\ndescribed as absent are omitted from the JSON response rather than sent\nempty."
      },
      "case_managementv1CaseStatus": {
        "type": "string",
        "enum": [
          "CASE_STATUS_UNSPECIFIED",
          "CASE_STATUS_OPEN",
          "CASE_STATUS_PENDING_APPROVAL",
          "CASE_STATUS_CLOSED"
        ],
        "default": "CASE_STATUS_UNSPECIFIED",
        "description": "CaseStatus is the Case's lifecycle status. A Case is Open while it is being\nworked (assigned to an investigator or not), Pending Approval while a close\nrequest awaits a Manager's decision, and Closed once it has been closed —\neither directly from Open, or by a Manager approving the close request\n(a rejected request returns the Case to Open). Reopening a Closed Case\nreturns it to Open, unassigned. Archiving, muting and the Trash are flags\nbeside the status, not statuses: an archived Case is still Closed.\nQueueStage is the finer-grained work-queue view of the same lifecycle.\n\n - CASE_STATUS_UNSPECIFIED: No status; as a List Cases filter, any status.\n - CASE_STATUS_OPEN: Being worked, whether or not an investigator is assigned.\n - CASE_STATUS_PENDING_APPROVAL: A close request awaits Manager approval.\n - CASE_STATUS_CLOSED: Closed; archived Cases are Closed too."
      },
      "case_managementv1GetCaseResponse": {
        "type": "object",
        "properties": {
          "case": {
            "allOf": [
              {
                "$ref": "#/components/schemas/case_managementv1Case"
              }
            ],
            "description": "The requested Case."
          },
          "screeningRoute": {
            "allOf": [
              {
                "$ref": "#/components/schemas/v1ScreeningRoute"
              }
            ],
            "description": "The address's current screening route — the Case that holds it and any\nintake suppression in force; see ScreeningRoute. Absent when the address\ncurrently has no route."
          }
        },
        "description": "GetCaseResponse is one Case with its address's current screening route."
      },
      "v1CasePriority": {
        "type": "string",
        "enum": [
          "CASE_PRIORITY_UNSPECIFIED",
          "CASE_PRIORITY_CRITICAL",
          "CASE_PRIORITY_HIGH",
          "CASE_PRIORITY_MEDIUM",
          "CASE_PRIORITY_LOW"
        ],
        "default": "CASE_PRIORITY_UNSPECIFIED",
        "description": "CasePriority is the optional triage priority of a Case, from CRITICAL down\nto LOW. A Case with no priority set carries no priority field at all, so\nCASE_PRIORITY_UNSPECIFIED is never a value a response returns; as a List\nCases filter it means any priority."
      },
      "v1ClosureDisposition": {
        "type": "string",
        "enum": [
          "CLOSURE_DISPOSITION_UNSPECIFIED",
          "CLOSURE_DISPOSITION_FALSE_POSITIVE",
          "CLOSURE_DISPOSITION_NO_ACTION",
          "CLOSURE_DISPOSITION_ENHANCED_MONITORING",
          "CLOSURE_DISPOSITION_SAR_FILED"
        ],
        "default": "CLOSURE_DISPOSITION_UNSPECIFIED",
        "description": "ClosureDisposition is the outcome recorded when a Case is closed, alongside\nthe free-text disposition note the closing user writes.\n\n - CLOSURE_DISPOSITION_FALSE_POSITIVE: The screening risk did not hold up under investigation.\n - CLOSURE_DISPOSITION_NO_ACTION: The risk is real or plausible but requires no further action.\n - CLOSURE_DISPOSITION_ENHANCED_MONITORING: The Subject warrants continued heightened attention.\n - CLOSURE_DISPOSITION_SAR_FILED: A suspicious activity report was filed for this Case."
      },
      "v1ClosureReportStatus": {
        "type": "string",
        "enum": [
          "CLOSURE_REPORT_STATUS_UNSPECIFIED",
          "CLOSURE_REPORT_STATUS_PENDING",
          "CLOSURE_REPORT_STATUS_AVAILABLE",
          "CLOSURE_REPORT_STATUS_FAILED"
        ],
        "default": "CLOSURE_REPORT_STATUS_UNSPECIFIED",
        "description": "ClosureReportStatus is the render state of the Closure Report, the document\ngenerated in the background when a Case is closed. Rendering never affects\nthe Case itself: a Pending or Failed report leaves the Case Closed, and a\nFailed report can be rendered again.\n\n - CLOSURE_REPORT_STATUS_PENDING: The report is still being rendered.\n - CLOSURE_REPORT_STATUS_AVAILABLE: The report is ready.\n - CLOSURE_REPORT_STATUS_FAILED: Rendering failed; the Case stays Closed and the report can be retried."
      },
      "v1ScreeningRoute": {
        "type": "object",
        "properties": {
          "currentCaseId": {
            "type": "string",
            "description": "Case that currently holds the address's screening route: the Case you\nfetched, or a newer one. Where the next hit goes is decided when it\narrives. If intake is suppressed, suppression wins whatever this Case's\nstate: FULL records the hit as suppressed and adds nothing; MONITOR_ONLY\nadds it to this Case even if the Case is closed, archived or deleted.\nOtherwise a Case that is not yet closed and still inside its aggregation\nwindow takes the hit, and a Case that has since been closed, archived or\ndeleted, or whose window has lapsed, sends it to a new successor Case.\nRead it as the route at the time of this read, not as a promise about\nwhere the next hit lands."
          },
          "suppression": {
            "allOf": [
              {
                "$ref": "#/components/schemas/v1ScreeningSuppression"
              }
            ],
            "description": "Suppression in force for the address; absent when automatic screening\nintake is active."
          }
        },
        "description": "ScreeningRoute is an address's current screening route: the Case that\nholds it and any suppression in force."
      },
      "v1ScreeningSuppression": {
        "type": "object",
        "properties": {
          "mode": {
            "allOf": [
              {
                "$ref": "#/components/schemas/v1ScreeningSuppressionMode"
              }
            ],
            "description": "How hits are suppressed; see ScreeningSuppressionMode."
          },
          "suppressedBy": {
            "type": "string",
            "description": "Subject id of the Manager who set the suppression."
          },
          "reason": {
            "type": "string",
            "description": "Reason given when the suppression was set."
          },
          "suppressedAt": {
            "type": "string",
            "format": "date-time",
            "description": "When the suppression was set."
          }
        },
        "description": "ScreeningSuppression is a Manager's standing instruction to stop automatic\nscreening hits for an address from driving Case workflow."
      },
      "v1ScreeningSuppressionMode": {
        "type": "string",
        "enum": [
          "SCREENING_SUPPRESSION_MODE_UNSPECIFIED",
          "SCREENING_SUPPRESSION_MODE_FULL",
          "SCREENING_SUPPRESSION_MODE_MONITOR_ONLY"
        ],
        "default": "SCREENING_SUPPRESSION_MODE_UNSPECIFIED",
        "description": "ScreeningSuppressionMode is how automatic screening intake for an address\nis suppressed once a Manager has suppressed it.\n\n - SCREENING_SUPPRESSION_MODE_FULL: New screening hits are acknowledged as suppressed and neither open a\nCase nor add to one, whatever the routed Case's state.\n - SCREENING_SUPPRESSION_MODE_MONITOR_ONLY: New screening hits still add Screenings and evidence to the routed Case\n— whatever its state, even closed, archived or deleted — but never move\nits status and never open a successor."
      }
    }
  }
}
```