List and search Cases

get

https://svc.cipherowl.ai/api/case-management/v1/cases

Returns one page of your organization's Cases with the total row count for the filter set. Filter by lifecycle status or work-queue stage, investigator, network and address, client reference, priority, mute state, and creation or last-modified time windows. Every filter is optional and a valid combination of set filters applies them together (AND); the parameters say which combinations are rejected. Timestamps are RFC 3339 (e.g. 2026-08-01T00:00:00Z), every time window is inclusive at both ends, and bounds are applied at microsecond precision (finer fractions of a second are dropped). Pagination is 1-based page/pageSize. To poll for changes, filter on updatedFrom/updatedTo — see updatedFrom for the overlap rule and for the changes it cannot see.

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Query Params

investigatorId

string

Only Cases assigned to this investigator, matched exactly on the user's
subject id (the value Case.investigatorId returns). Cannot be combined
with queueStage=QUEUE_STAGE_UNASSIGNED.

clientReference

string

Only Cases whose clientReference currently equals this value exactly
(the reference is editable in the console after the Case is opened).

network

string

Only Cases whose address is on this network. Accepts a network key
("ethereum_mainnet"), a common alias ("eth") or a chain class ("evm");
Cases are keyed by chain class, so every spelling that resolves to the
same class returns the same Cases — "ethereum_mainnet", "eth" and "evm"
all return the organization's EVM Cases. An unknown network name is
rejected (INVALID_ARGUMENT). May be used on its own; required whenever
address is set.

address

string

Only the Case(s) for this address; requires network, and address without
network is rejected (INVALID_ARGUMENT). The address is normalized before
matching, so any accepted spelling of it matches (EVM addresses, for
example, match regardless of letter case). An address that is not valid
on the requested network returns an empty page rather than an error.

status

string

enum

Defaults to CASE_STATUS_UNSPECIFIED

Only Cases in this lifecycle status; see CaseStatus for the values.
Omitted or CASE_STATUS_UNSPECIFIED applies no status filter. Use either
status or queueStage, not both — queueStage is the finer-grained view of
the same lifecycle (CASE_STATUS_OPEN covers UNASSIGNED and ASSIGNED,
CASE_STATUS_CLOSED covers CLOSED and ARCHIVED). CASE_STATUS_CLOSED cannot
be combined with excludeClosed.

CASE_STATUS_UNSPECIFIED: No status; as a List Cases filter, any status.
CASE_STATUS_OPEN: Being worked, whether or not an investigator is assigned.
CASE_STATUS_PENDING_APPROVAL: A close request awaits Manager approval.
CASE_STATUS_CLOSED: Closed; archived Cases are Closed too.

Allowed:

createdFrom

date-time

Only Cases created at or after this instant.

createdTo

date-time

Only Cases created at or before this instant; createdFrom must not be
after createdTo.

pageSize

int32

Cases per page, 1 to 100. Omitted or 0 means 50.

queueStage

string

enum

Defaults to QUEUE_STAGE_UNSPECIFIED

Only Cases in this work-queue stage; see QueueStage for the values.
Omitted or QUEUE_STAGE_UNSPECIFIED applies no stage filter. Cannot be
combined with status (use one or the other) or with deletedOnly, and
QUEUE_STAGE_UNASSIGNED cannot be combined with investigatorId.

QUEUE_STAGE_UNSPECIFIED: No stage; as a List Cases filter, any stage.
QUEUE_STAGE_UNASSIGNED: No investigator holds the Case.
QUEUE_STAGE_ASSIGNED: Assigned to an investigator and being worked.
QUEUE_STAGE_WAITING_FOR_APPROVAL: A close request awaits Manager approval.
QUEUE_STAGE_CLOSED: Closed and not archived.
QUEUE_STAGE_ARCHIVED: Closed and archived: the separate Archive view, retained indefinitely
with complete evidence and audit history.

Allowed:

page

int32

Page to return, starting at 1; omitted or 0 returns page 1. Pages beyond
10000 are rejected.

muted

string

enum

Defaults to MUTED_FILTER_UNSPECIFIED

How muted Cases are treated; see MutedFilter for the values. Omitted or
MUTED_FILTER_UNSPECIFIED includes them.

MUTED_FILTER_UNSPECIFIED: Include muted Cases (the default; hides nothing).
MUTED_FILTER_EXCLUDE: Leave muted Cases out.
MUTED_FILTER_INCLUDE: Include muted Cases; the same result as the default.
MUTED_FILTER_ONLY: Only muted Cases.

Allowed:

priority

string

enum

Defaults to CASE_PRIORITY_UNSPECIFIED

Only Cases with exactly this priority. Omitted or CASE_PRIORITY_UNSPECIFIED
applies no priority filter (it does not select Cases without a priority).

Allowed:

deletedOnly

boolean

Return only Cases in the Trash (soft-deleted) instead of active ones.
Requires the Case Management Manager role, which API clients
authenticating with client credentials do not hold: they are denied when
they set it, so leave it unset. Cannot be combined with queueStage.

excludeClosed

boolean

Leave out closed Cases — archived ones included, since a Case is only ever
archived after it is closed. This is the way to ask for every Case still
being worked, whatever its stage; a single status or queueStage value
cannot express that. Cannot be combined with status=CASE_STATUS_CLOSED or
with queueStage QUEUE_STAGE_CLOSED / QUEUE_STAGE_ARCHIVED, which would
describe an empty set.

updatedFrom

date-time

Only Cases last changed at or after this instant (Case.updatedAt). This
is the filter to poll for changes with: request the window since your
previous poll and overlap successive windows slightly, because updatedAt
is stamped when a change starts rather than when it is committed, so a
change that commits after your read is not in that read. Expect to see
the same Case in more than one poll. Combined with
status=CASE_STATUS_CLOSED (or a queueStage) it finds Cases closed, or
changed while closed, since the previous poll, whenever they were
created. It cannot see the
changes that leave updatedAt untouched — a MONITOR_ONLY screening hit, an
intake suppress/resume, a Closure Report status change, and the
asynchronous evidence and artifact progress of the Screening history
(see Case.updatedAt; poll List Screenings for that). updatedFrom must
not be after updatedTo.

updatedTo

date-time

Only Cases last changed at or before this instant.

Response

200A successful response.