---
title: "Get Case History"
method: GET
path: "/connect/case/history/{id}"
tags: ["Cases"]
---

# Get Case History

`GET /connect/case/history/{id}`

Returns all audit history associated with the given case ID.

## Path parameters

- `id` string, required

## Response `200`

The array of history audit objects. Note that these objects will also contain either the Case fields, Comment fields, Artifact fields, or RelatedEvent fields.

- ModelAuditable[]
  - `createTime` string — The date and time that this object was created. This is a read-only field.
  - `id` string — The ID assigned to this object by the server. This is a read-only field.
  - `kind` string — The kind of object. This is a read-only field.
  - `operation` string — The operation that was applied to the object. This is a read-only field.
  - `updateTime` string — The date and time that this object was last modified. This is a read-only field.
  - `userId` string — The user ID (or API client ID) that initiated this event. This is a read-only field.

## Other responses

- `400` — The provided input object or parameters are malformed or invalid
- `401` — Request was not properly authenticated
- `403` — Insufficient permissions for this request
- `404` — Case not found
- `405` — Case module not configured on server
- `500` — Internal SOC error; review SOC logs

---

[API](https://skmtc.net/security-onion-solutions/apis/security-onion-connect-api.md) · [All operations](https://skmtc.net/security-onion-solutions/apis/security-onion-connect-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/security-onion-solutions/security-onion-connect-api/versions/0576ce393f8d/schema)