--- title: "Lookup a Case using its ID" method: GET path: "/lookup/{id}" tags: ["Case"] --- # Lookup a Case using its ID `GET /lookup/{id}` Retrieve full case details for a single case by ID (known routing bug — prefer POST /lookup with a single ID instead). ## Path parameters - `id` string, required ## Response `200` Success - CaseLookupResponse — Single case lookup response with full detail. - `status` Status — API response status with code and message. - `status_code` string - `status_message` string - `data` ExternalCase — A case with expanded detail panels (summary, details, log). - `id` string, identity — The identity of a task - `summary` CaseSummaryPanel — Summary panel with case metadata (status, priority, assignee, timestamps). - `id` string, identity — The identity of a task - `status` 'New' | 'InProgress' | 'Dismissed' | 'Resolved' — The Status of the Case - `priority` 'Informational' | 'Moderate' | 'High' — The Priority of the Case - `title` string - `description` string - `assignee` User - `scopes` Scope[], nullable — The user scopes. - `updated_at` string — Last updated timestamp. - `name` string — The scope name. - `id` number — The unique identifier for the scope. - `display_name` string, nullable — The display name. - `description` string, nullable — The scope description. - `created_at` string — The created at timestamp. - `primary_user_id` number, nullable — The primary user id if the user has multiple accounts and this isn't the primary one. - `last_sign_in_at` string, nullable — The last RiskRecon portal sign in timestamp. - `last_name` string — The last Name of the user. - `is_active` boolean — Is the user active? - `first_name` string — The first name of the user. - `eula_accepted_on` string, nullable — The EULA accepted date. - `employee_id` string, nullable — The employee Id. - `email` string — The listed email address of the user. - `customer_id` string, uuid — The customer Id of the user. - `current_sign_in_at` string, nullable — The current sign in timestamp. - `company_id` number, nullable — The company id of the user. This is a legacy field and the customer_id should be used instead. - `cell_phone` string, nullable — The cell phone of the user if available. - `creator` User - `scopes` Scope[], nullable — The user scopes. - `updated_at` string — Last updated timestamp. - `name` string — The scope name. - `id` number — The unique identifier for the scope. - `display_name` string, nullable — The display name. - `description` string, nullable — The scope description. - `created_at` string — The created at timestamp. - `primary_user_id` number, nullable — The primary user id if the user has multiple accounts and this isn't the primary one. - `last_sign_in_at` string, nullable — The last RiskRecon portal sign in timestamp. - `last_name` string — The last Name of the user. - `is_active` boolean — Is the user active? - `first_name` string — The first name of the user. - `eula_accepted_on` string, nullable — The EULA accepted date. - `employee_id` string, nullable — The employee Id. - `email` string — The listed email address of the user. - `customer_id` string, uuid — The customer Id of the user. - `current_sign_in_at` string, nullable — The current sign in timestamp. - `company_id` number, nullable — The company id of the user. This is a legacy field and the customer_id should be used instead. - `cell_phone` string, nullable — The cell phone of the user if available. - `created` string, date-time - `modified` string, date-time - `details` union — Detail panel with alert-specific data. Uses discriminator for signal vs reference alert types. - ReferenceAlertDetails — Detail panel for reference alert cases with document context. - `type` 'reference_details', required — Discriminator - must be 'reference_details' - `documents` DocumentContext[], required - `references` EnrichedReference[] - `id` string, identity — The id of an entity - `type` string - `published` string, date-time - `title` string - `fragment` string - `lang` string - `entities` EnrichedEntityWithType[] - … - `source` EnrichedEntityWithType — Entity reference with type classification. - `id` string, identity — The id of an entity - `name` string - `type` string - SignalAlertDetails — Detail panel for signal alert cases with enriched entity context. - `type` 'signal_details', required — Discriminator - must be 'signal_details' - `entities` EnrichedEntityContext[], required - `id` string, identity — The id of an entity - `name` string - `type` string - `risk_rules` EnrichedRiskRule[] - `name` string - `evidence` string - `criticality` integer - `timestamp` string, date-time - `log` CaseLogPanel[] - `id` string, identity — The identity of a UUID - `author` User - `scopes` Scope[], nullable — The user scopes. - `updated_at` string — Last updated timestamp. - `name` string — The scope name. - `id` number — The unique identifier for the scope. - `display_name` string, nullable — The display name. - `description` string, nullable — The scope description. - `created_at` string — The created at timestamp. - `primary_user_id` number, nullable — The primary user id if the user has multiple accounts and this isn't the primary one. - `last_sign_in_at` string, nullable — The last RiskRecon portal sign in timestamp. - `last_name` string — The last Name of the user. - `is_active` boolean — Is the user active? - `first_name` string — The first name of the user. - `eula_accepted_on` string, nullable — The EULA accepted date. - `employee_id` string, nullable — The employee Id. - `email` string — The listed email address of the user. - `customer_id` string, uuid — The customer Id of the user. - `current_sign_in_at` string, nullable — The current sign in timestamp. - `company_id` number, nullable — The company id of the user. This is a legacy field and the customer_id should be used instead. - `cell_phone` string, nullable — The cell phone of the user if available. - `created` string, date-time - `modified` string, date-time - `comment` string - `changes` Change[] - union — A change event in the case audit log. Uses discriminator for change type. - object — Record of an assignee change on a case. - `type` 'assignee_change' - `old` User - … - `new` User - … - object — Record of a status change on a case. - `type` 'status_change' - `old` 'New' | 'InProgress' | 'Dismissed' | 'Resolved' — The Status of the Case - `new` 'New' | 'InProgress' | 'Dismissed' | 'Resolved' — The Status of the Case - object — Record of a priority change on a case. - `type` 'priority_change' - `old` 'Informational' | 'Moderate' | 'High' — The Priority of the Case - `new` 'Informational' | 'Moderate' | 'High' — The Priority of the Case - object — Record of a title change on a case. - `type` 'title_change' - `old` string - `new` string - object — Record of a description change on a case. - `type` 'description_change' - `old` string - `new` string - object — Record of an external ID change on a case. - `type` 'external_id_change' - `old` string - `new` string ## Other responses - `404` — No such case --- [API](https://skmtc.net/recordedfuture/apis/alert-api.md) · [All operations](https://skmtc.net/recordedfuture/apis/alert-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/recordedfuture/alert-api/revisions/c8c2f68d8b60/schema)