> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cases-apis/models.md).

# Models

## The reply object

```json
{"openapi":"3.0.0","info":{"title":"Cases API","version":"Cortex Cloud"},"components":{"schemas":{"reply":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error.","nullable":true}}}}}}}}
```

## The UpdateCase object

```json
{"openapi":"3.0.0","info":{"title":"Cases API","version":"Cortex Cloud"},"components":{"schemas":{"UpdateCase":{"type":"object","properties":{"status_progress":{"type":"string","description":"Status to set on the case. Built-in values: 'New', 'In Progress', 'Resolved'. Values are case-insensitive. Additional custom statuses may be configured per tenant and case domain. If an invalid status is provided, the API will return an error listing the valid options."},"resolve_reason":{"type":"string","description":"Resolution reason when status_progress is set to 'Resolved'. Required when resolving a case. The built-in values listed below may vary per tenant and case domain; additional custom resolution reasons may also be available. If an invalid value is provided, the API will return an error listing the valid options for that specific case.","enum":["Resolved - Known Issue","Resolved - Duplicate Case","Resolved - False Positive","Resolved - Other","Resolved - True Positive","Resolved - Security Testing"]},"resolve_comment":{"type":"string","description":"Free-text comment to add when resolving the case. Only applicable when status_progress is set to 'Resolved'."},"notes":{"type":"string","description":"Free-text notes associated with the case. Can be set independently of status changes."},"user_severity":{"type":"string","description":"User-defined severity override (lowercase). Use an empty string to clear the severity. Allowed values: 'low', 'medium', 'high', 'critical'.","enum":["low","medium","high","critical"]},"assigned_user":{"type":"string","description":"Email address of the user to assign the case to. Must be a valid Cortex XDR user email."},"case_team":{"type":"array","description":"Team members assigned to the case.","items":{"type":"object","properties":{"id":{"type":"string","description":"Identifier of the team member (user email or group id)."},"member_type":{"type":"string","enum":["USER","GROUP"],"description":"Type of the team member."},"team_role":{"type":"string","enum":["OWNER","MEMBER"],"description":"Role of the team member."}}}},"access_mode":{"type":"string","enum":["CASE_SCOPE","TEAM_ONLY"],"description":"Access mode for the case. CASE_SCOPE: standard SBAC. TEAM_ONLY: restrict to case_team members."}},"additionalProperties":{"description":"Custom field values. Use the custom field name as the property key."}}}}}
```

## The Case object

```json
{"openapi":"3.0.0","info":{"title":"Cases API","version":"Cortex Cloud"},"components":{"schemas":{"Case":{"type":"object","properties":{"case_id":{"type":"integer","description":"Unique identifier for the case"},"is_blocked":{"type":"boolean","description":"Indicates if the case is blocked due to RBAC restrictions"},"case_name":{"type":"string","description":"Name of the case"},"creation_time":{"type":"integer","format":"int64","description":"Timestamp of case creation in epoch milliseconds"},"modification_time":{"type":"integer","format":"int64","description":"Timestamp of last modification in epoch milliseconds"},"status_progress":{"type":"string","description":"Current status of the case. Built-in values are 'New', 'In Progress', and 'Resolved'. Additional custom statuses may be configured per tenant and case domain."},"resolve_reason":{"type":"string","nullable":true,"description":"Resolution reason when the case is resolved. Null when the case is not resolved. Built-in values include 'Resolved - Known Issue', 'Resolved - Duplicate Case', 'Resolved - False Positive', 'Resolved - Other', 'Resolved - True Positive', 'Resolved - Security Testing'. Additional values such as 'Resolved - Dismissed', 'Resolved - Fixed', and 'Resolved - Risk Accepted' may be available depending on tenant licensing. Custom resolution reasons may also be configured per tenant and case domain."},"severity":{"type":"string","enum":["info","low","medium","high","critical"],"description":"Severity level of the case (lowercase)"},"description":{"type":"string","nullable":true,"description":"Detailed description of the case. May be null if no description is set."},"assigned_user_mail":{"type":"string","nullable":true,"description":"Email address of the assigned user. Null if no user is assigned."},"assigned_user_pretty_name":{"type":"string","nullable":true,"description":"Display name of the assigned user. Null if no user is assigned."},"issue_count":{"type":"integer","description":"Total number of issues in the case"},"user_severity":{"type":"string","nullable":true,"enum":["low","medium","high","critical"],"description":"User-defined severity override (lowercase). Null if not set. Allowed values: 'low', 'medium', 'high', 'critical'."},"notes":{"type":"string","nullable":true,"description":"Free-text notes associated with the case. Null if not set."},"low_severity_issue_count":{"type":"integer","description":"Number of low severity issues"},"med_severity_issue_count":{"type":"integer","description":"Number of medium severity issues"},"high_severity_issue_count":{"type":"integer","description":"Number of high severity issues"},"critical_severity_issue_count":{"type":"integer","description":"Number of critical severity issues"},"user_count":{"type":"integer","description":"Number of users associated with the case"},"host_count":{"type":"integer","description":"Number of hosts associated with the case"},"resolve_comment":{"type":"string","nullable":true,"description":"Free-text comment provided when resolving the case. Null when the case is not resolved or no comment was provided."},"resolved_timestamp":{"type":"integer","format":"int64","nullable":true,"description":"Timestamp when the case was resolved in epoch milliseconds"},"xdr_url":{"type":"string","description":"URL to view the case in the Cortex console"},"starred":{"type":"boolean","description":"Indicates if the case is starred"},"hosts":{"type":"array","nullable":true,"items":{"type":"string"},"description":"List of hosts associated with the case in format 'hostname:endpoint_id'"},"users":{"type":"array","nullable":true,"items":{"type":"string"},"description":"List of users associated with the case"},"aggregated_score":{"type":"integer","nullable":true,"description":"Combined/aggregated score assigned to the case"},"wildfire_hits":{"type":"integer","description":"Number of WildFire hits"},"mitre_tactics_ids_and_names":{"type":"array","nullable":true,"items":{"type":"string"},"description":"List of MITRE ATT&CK tactics IDs and names"},"mitre_techniques_ids_and_names":{"type":"array","nullable":true,"items":{"type":"string"},"description":"List of MITRE ATT&CK techniques IDs and names"},"issue_categories":{"type":"array","nullable":true,"items":{"type":"string"},"description":"List of issue categories in the case"},"tags":{"type":"array","items":{"type":"string"},"description":"List of tags associated with the case"},"custom_fields":{"type":"object","nullable":true,"additionalProperties":true,"description":"Custom fields for additional metadata"},"asset_ids":{"type":"array","nullable":true,"items":{"type":"string"},"description":"List of asset IDs associated with the case"},"asset_group_ids":{"type":"array","items":{"type":"string"},"description":"List of asset group IDs associated with the case"},"asset_group_names":{"type":"array","items":{"type":"string"},"description":"List of asset group names associated with the case"},"assets":{"type":"array","items":{"$ref":"#/components/schemas/Asset"},"description":"List of asset objects associated with the case"},"case_domain":{"type":"string","description":"Domain associated with the case"},"issue_ids":{"type":"array","nullable":true,"items":{"type":"integer"},"description":"List of issue IDs associated with the case"},"file_artifact_ids":{"type":"object","description":"File artifact IDs associated with the case","properties":{"DATA":{"type":"array","items":{"type":"string"},"description":"List of file artifact hash IDs"},"TOTAL_COUNT":{"type":"integer","description":"Total count of file artifacts"}}},"network_artifact_ids":{"type":"object","description":"Network artifact IDs associated with the case","properties":{"DATA":{"type":"array","items":{"type":"string"},"description":"List of network artifact IDs"},"TOTAL_COUNT":{"type":"integer","description":"Total count of network artifacts"}}},"case_team":{"type":"array","description":"Team members assigned to the case.","items":{"type":"object","properties":{"id":{"type":"string","description":"Identifier of the team member (user email or group id)."},"member_type":{"type":"string","enum":["USER","GROUP"],"description":"Type of the team member."},"team_role":{"type":"string","enum":["OWNER","MEMBER"],"description":"Role of the team member."}}}},"access_mode":{"type":"string","enum":["CASE_SCOPE","TEAM_ONLY"],"description":"Access mode for the case. CASE_SCOPE: standard SBAC. TEAM_ONLY: restrict to case_team members."}}},"Asset":{"type":"object","description":"Asset object associated with a case","properties":{"asset_id":{"type":"string","description":"Unique identifier for the asset"},"asset_name":{"type":"string","description":"Name of the asset"},"asset_type":{"type":"string","description":"Type of the asset"},"asset_region":{"type":"string","description":"Cloud region where the asset is located"},"asset_group_ids":{"type":"array","items":{"type":"integer"},"description":"List of asset group IDs"},"asset_provider":{"type":"string","description":"Cloud provider"},"asset_account":{"type":"string","description":"Cloud account identifier"},"asset_category":{"type":"string","description":"Category of the asset"},"asset_cloud_account_name":{"type":"string","description":"Cloud account name"},"asset_external_provider_id":{"type":"string","description":"External provider ID for the asset"},"asset_tags":{"type":"object","additionalProperties":{"type":"string"},"description":"Key-value tags associated with the asset"},"asset_group_names":{"type":"array","items":{"type":"string"},"description":"Names of the asset groups this asset belongs to"}}}}}}
```

## The Asset object

```json
{"openapi":"3.0.0","info":{"title":"Cases API","version":"Cortex Cloud"},"components":{"schemas":{"Asset":{"type":"object","description":"Asset object associated with a case","properties":{"asset_id":{"type":"string","description":"Unique identifier for the asset"},"asset_name":{"type":"string","description":"Name of the asset"},"asset_type":{"type":"string","description":"Type of the asset"},"asset_region":{"type":"string","description":"Cloud region where the asset is located"},"asset_group_ids":{"type":"array","items":{"type":"integer"},"description":"List of asset group IDs"},"asset_provider":{"type":"string","description":"Cloud provider"},"asset_account":{"type":"string","description":"Cloud account identifier"},"asset_category":{"type":"string","description":"Category of the asset"},"asset_cloud_account_name":{"type":"string","description":"Cloud account name"},"asset_external_provider_id":{"type":"string","description":"External provider ID for the asset"},"asset_tags":{"type":"object","additionalProperties":{"type":"string"},"description":"Key-value tags associated with the asset"},"asset_group_names":{"type":"array","items":{"type":"string"},"description":"Names of the asset groups this asset belongs to"}}}}}}
```

## The CaseArtifact object

```json
{"openapi":"3.0.0","info":{"title":"Cases API","version":"Cortex Cloud"},"components":{"schemas":{"CaseArtifact":{"type":"object","properties":{"case_id":{"type":"integer","description":"Case ID for which the artifacts are fetched"},"network_artifacts":{"type":"object","properties":{"DATA":{"type":"array","items":{"$ref":"#/components/schemas/Artifact"}},"TOTAL_COUNT":{"type":"integer"}}},"file_artifacts":{"type":"object","properties":{"DATA":{"type":"array","items":{"$ref":"#/components/schemas/Artifact"}},"TOTAL_COUNT":{"type":"integer"}}}}},"Artifact":{"type":"object","properties":{"artifact_id":{"type":"string","description":"Unique identifier for the artifact"},"file_name":{"type":"string","description":"File name for the artifact"},"file_sha256":{"type":"string","description":"File sha256 for the artifact"},"file_signature_status":{"type":"string","description":"File signature for the artifact"},"file_wildfire_verdict":{"type":"string","description":"File wildfire verdict for the artifact"},"is_malicious":{"type":"boolean","description":"Indicates if the artifact is malicious"},"is_manual":{"type":"boolean","description":"Indicates if the artifact is manual"},"is_process":{"type":"boolean","description":"Indicates if the artifact is related to a process"},"low_confidence":{"type":"boolean","description":"Indicates the artifact confidence"},"type":{"type":"string","description":"Type of the artifact"}}}}}}
```

## The Artifact object

```json
{"openapi":"3.0.0","info":{"title":"Cases API","version":"Cortex Cloud"},"components":{"schemas":{"Artifact":{"type":"object","properties":{"artifact_id":{"type":"string","description":"Unique identifier for the artifact"},"file_name":{"type":"string","description":"File name for the artifact"},"file_sha256":{"type":"string","description":"File sha256 for the artifact"},"file_signature_status":{"type":"string","description":"File signature for the artifact"},"file_wildfire_verdict":{"type":"string","description":"File wildfire verdict for the artifact"},"is_malicious":{"type":"boolean","description":"Indicates if the artifact is malicious"},"is_manual":{"type":"boolean","description":"Indicates if the artifact is manual"},"is_process":{"type":"boolean","description":"Indicates if the artifact is related to a process"},"low_confidence":{"type":"boolean","description":"Indicates the artifact confidence"},"type":{"type":"string","description":"Type of the artifact"}}}}}}
```

## The CaseSchemaField object

```json
{"openapi":"3.0.0","info":{"title":"Cases API","version":"Cortex Cloud"},"components":{"schemas":{"CaseSchemaField":{"type":"object","description":"Describes a single field in the cases schema","properties":{"field_name":{"type":"string","description":"Internal field name used to identify the case field"},"field_pretty_name":{"type":"string","description":"Human-readable display name for the field"},"data_type":{"type":"string","description":"Data type of the field value (e.g. TEXT, INT, TIMESTAMP, BOOLEAN, ARRAY, JSON)"}}}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cases-apis/models.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.