---
title: "Update Case"
method: PUT
path: "/connect/case/"
tags: ["Cases"]
---

# Update Case

`PUT /connect/case/`

Updates an existing case with a provided case object as input.

## Request body

- ModelCase
  - `assigneeId` string — The user ID that is assigned to work on this case.
  - `category` string — A category is a way to group similar cases together and can be arbitrary values, or static values, depending on how the system if configured.
  - `completeTime` string — The date and time that the case was completed. A case is completed when the status is changed to 'closed'. This is a read-only field.
  - `createTime` string — The date and time that this object was created. This is a read-only field.
  - `description` string — The full description of the case.
  - `id` string — The ID assigned to this object by the server. This is a read-only field.
  - `kind` string — The kind of object. This is a read-only field.
  - `operation` string — The operation that was applied to the object. This is a read-only field.
  - `pap` string — The Permissiable Actions Protocol value.
  - `priority` integer — The priority of the case. Lower values typically represent increasing importance.
  - `severity` string — The serverity of the case. Typical values are: critical, high, medium, low
  - `startTime` string — The date and time that the case status was changed to 'in progress'. This is a read-only field.
  - `status` string — The state of the case. Typical values are: new, in progress, closed
  - `tags` string[] — A tag is another way to group similar cases together and can be arbitrary values, or static values, depending on how the system if configured.
  - `template` string — A case ID representing the case to use as a template when creating this case. The template case fields will be copied into the new case.
  - `title` string — The brief case title or summary
  - `tlp` string — The Traffic Light Protocol value.
  - `updateTime` string — The date and time that this object was last modified. This is a read-only field.
  - `userId` string — The user ID (or API client ID) that initiated this event. This is a read-only field.

## Response `200`

Outputs the case object.

- ModelCase
  - `assigneeId` string — The user ID that is assigned to work on this case.
  - `category` string — A category is a way to group similar cases together and can be arbitrary values, or static values, depending on how the system if configured.
  - `completeTime` string — The date and time that the case was completed. A case is completed when the status is changed to 'closed'. This is a read-only field.
  - `createTime` string — The date and time that this object was created. This is a read-only field.
  - `description` string — The full description of the case.
  - `id` string — The ID assigned to this object by the server. This is a read-only field.
  - `kind` string — The kind of object. This is a read-only field.
  - `operation` string — The operation that was applied to the object. This is a read-only field.
  - `pap` string — The Permissiable Actions Protocol value.
  - `priority` integer — The priority of the case. Lower values typically represent increasing importance.
  - `severity` string — The serverity of the case. Typical values are: critical, high, medium, low
  - `startTime` string — The date and time that the case status was changed to 'in progress'. This is a read-only field.
  - `status` string — The state of the case. Typical values are: new, in progress, closed
  - `tags` string[] — A tag is another way to group similar cases together and can be arbitrary values, or static values, depending on how the system if configured.
  - `template` string — A case ID representing the case to use as a template when creating this case. The template case fields will be copied into the new case.
  - `title` string — The brief case title or summary
  - `tlp` string — The Traffic Light Protocol value.
  - `updateTime` string — The date and time that this object was last modified. This is a read-only field.
  - `userId` string — The user ID (or API client ID) that initiated this event. This is a read-only field.

## Other responses

- `400` — The provided input object or parameters are malformed or invalid
- `401` — Request was not properly authenticated
- `403` — Insufficient permissions for this request
- `404` — Case not found
- `405` — Case module not configured on server
- `500` — Internal SOC error; review SOC logs

---

[API](https://skmtc.net/security-onion-solutions/apis/security-onion-connect-api.md) · [All operations](https://skmtc.net/security-onion-solutions/apis/security-onion-connect-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/security-onion-solutions/security-onion-connect-api/versions/0576ce393f8d/schema)