---
title: "GET /v1/cases/{caseId}/get-case"
method: GET
path: "/v1/cases/{caseId}/get-case"
---

# GET /v1/cases/{caseId}/get-case

`GET /v1/cases/{caseId}/get-case`

Returns the attributes of a case.

## Path parameters

- `caseId` string, required

## Response `200`

Success

- GetCaseResponse
  - `title` string, password — Response element for GetCase that provides the case title.
  - `caseArn` string — Response element for GetCase that provides the case ARN
  - `description` string, password — Response element for GetCase that provides contents of the case description.
  - `caseStatus` 'Submitted' | 'Acknowledged' | 'Detection and Analysis' | 'Containment, Eradication and Recovery' | 'Post-incident Activities' | 'Ready to Close' | 'Closed' — Response element for GetCase that provides the case status. Options for statuses include <code>Submitted | Detection and Analysis | Eradication, Containment and Recovery | Post-Incident Activities | Closed </code>
  - `engagementType` 'Security Incident' | 'Investigation' — Response element for GetCase that provides the engagement type. Options for engagement type include <code>Active Security Event | Investigations</code>
  - `reportedIncidentStartDate` string, date-time — Response element for GetCase that provides the customer provided incident start date.
  - `actualIncidentStartDate` string, date-time — Response element for GetCase that provides the actual incident start date as identified by data analysis during the investigation.
  - `impactedAwsRegions` ImpactedAwsRegion[] — Response element for GetCase that provides the impacted regions.
    - `region` 'af-south-1' | 'ap-east-1' | 'ap-east-2' | 'ap-northeast-1' | 'ap-northeast-2' | 'ap-northeast-3' | 'ap-south-1' | 'ap-south-2' | 'ap-southeast-1' | 'ap-southeast-2' | 'ap-southeast-3' | 'ap-southeast-4' | 'ap-southeast-5' | 'ap-southeast-6' | 'ap-southeast-7' | 'ca-central-1' | 'ca-west-1' | 'cn-north-1' | 'cn-northwest-1' | 'eu-central-1' | 'eu-central-2' | 'eu-north-1' | 'eu-south-1' | 'eu-south-2' | 'eu-west-1' | 'eu-west-2' | 'eu-west-3' | 'il-central-1' | 'me-central-1' | 'me-south-1' | 'mx-central-1' | 'sa-east-1' | 'us-east-1' | 'us-east-2' | 'us-west-1' | 'us-west-2', required — <p/>
  - `threatActorIpAddresses` ThreatActorIp[] — Response element for GetCase that provides a list of suspicious IP addresses associated with unauthorized activity.
    - `ipAddress` string, password, required — <p/>
    - `userAgent` string — <p/>
  - `pendingAction` 'Customer' | 'None' — Response element for GetCase that identifies the case is waiting on customer input.
  - `impactedAccounts` AWSAccountId[] — Response element for GetCase that provides a list of impacted accounts.
  - `watchers` Watcher[] — Response element for GetCase that provides a list of Watchers added to the case.
    - `email` string, password, required — <p/>
    - `name` string, password — <p/>
    - `jobTitle` string, password — <p/>
  - `createdDate` string, date-time — Response element for GetCase that provides the date the case was created.
  - `lastUpdatedDate` string, date-time — Response element for GetCase that provides the date a case was last modified.
  - `closureCode` 'Investigation Completed' | 'Not Resolved' | 'False Positive' | 'Duplicate' — Response element for GetCase that provides the summary code for why a case was closed.
  - `resolverType` 'AWS' | 'Self' — Response element for GetCase that provides the current resolver types.
  - `impactedServices` AwsService[] — Response element for GetCase that provides a list of impacted services.
  - `caseAttachments` CaseAttachmentAttributes[] — Response element for GetCase that provides a list of current case attachments.
    - `attachmentId` string, required — <p/>
    - `fileName` string, password, required — <p/>
    - `attachmentStatus` 'Verified' | 'Failed' | 'Pending', required — <p/>
    - `creator` string, required — <p/>
    - `createdDate` string, date-time, required — <p/>
  - `closedDate` string, date-time — Response element for GetCase that provides the date a specified case was closed.
  - `caseMetadata` CaseMetadataEntry[] — Case response metadata
    - `key` string, required — The identifier for the metadata field. This key uniquely identifies the type of metadata being stored, such as "severity", "category", or "assignee".
    - `value` string, required — The value associated with the metadata key. This contains the actual data for the metadata field identified by the key.

## Other responses

- `480` — ServiceQuotaExceededException
- `481` — AccessDeniedException
- `482` — ValidationException
- `483` — SecurityIncidentResponseNotActiveException
- `484` — InternalServerException
- `485` — ThrottlingException
- `486` — ConflictException
- `487` — ResourceNotFoundException
- `488` — InvalidTokenException

---

[API](https://skmtc.net/aws/apis/security-ir.md) · [All operations](https://skmtc.net/aws/apis/security-ir/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/aws/security-ir/versions/e22a88ccce95/schema)