---
title: "Get a case"
method: GET
path: "/v2/{tenant_slug}/cases/{case_id}"
tags: ["Cases"]
---

# Get a case

`GET /v2/{tenant_slug}/cases/{case_id}`

Retrieve full details for a single fraud case.

## Path parameters

- `tenant_slug` string, required — Tenant DNS slug (lowercase letters, digits, and hyphens; 3-100 characters).
- `case_id` string, required — Unique case identifier returned by `GET /cases`.

## Response `200`

Successful Response

- APIResponseCaseSingleResponse
  - `data` CaseSingleResponse, required
    - `case_id` string, required — Unique case identifier used in `/cases/{case_id}` paths
    - `tenant_id` string, uuid, required — Identifier of the tenant that owns this case
    - `website_account_id` string — Identifier of the end user's website account; defaults to `UNKNOWN` when the account cannot be resolved
    - `session_id` string, required — Identifier of the user session this case originated from
    - `unique_id` string, uuid, required — Opaque record identifier; clients should use `case_id` for all references
    - `end_user_is_blocked` boolean, required — True when the end user account associated with this case is blocked from accessing services
    - `status` 'OPEN' | 'CLOSED', required
    - `created_at` string, date-time, required — Time the case was opened (RFC 3339 / ISO 8601 UTC)
    - `updated_at` string, date-time, nullable — Time of the most recent case update (RFC 3339 / ISO 8601 UTC); null when the case has never been updated
    - `current_state` CaseState
      - `state_id` string, uuid, required — Stable identifier for this state snapshot, unique within the case
      - `case_status` 'OPEN' | 'CLOSED', required
      - `session_status` 'ACTIVE' | 'FINISHED', required
      - `score` integer, required — Risk score captured by this snapshot, on a 1-5 scale (1=lowest risk, 5=highest risk)
      - `changed_at` string, date-time, required — Time this state change was recorded (RFC 3339 / ISO 8601 UTC)
      - `changed_by` string — Identifier of the actor that triggered this state change. Use `system` for automated transitions; otherwise the user_id of the operator.
      - `reason` string, required — Human-readable explanation of why the state changed
    - `state_history` CaseState[], nullable — All prior state snapshots for this case ordered chronologically (oldest first)
      - `state_id` string, uuid, required — Stable identifier for this state snapshot, unique within the case
      - `case_status` 'OPEN' | 'CLOSED', required
      - `session_status` 'ACTIVE' | 'FINISHED', required
      - `score` integer, required — Risk score captured by this snapshot, on a 1-5 scale (1=lowest risk, 5=highest risk)
      - `changed_at` string, date-time, required — Time this state change was recorded (RFC 3339 / ISO 8601 UTC)
      - `changed_by` string — Identifier of the actor that triggered this state change. Use `system` for automated transitions; otherwise the user_id of the operator.
      - `reason` string, required — Human-readable explanation of why the state changed
    - `details` CaseDetails, required
      - `overall_risk_score` integer, required — Aggregate risk score across all fraud signals, on a 1-5 scale (1=lowest risk, 5=highest risk)
      - `fraud_labels` FraudLabels[], required — All fraud categories detected for this case; must contain at least the `primary_fraud_label`
      - `primary_fraud_label` 'Bot' | 'Synthetic' | 'Account Takeover' | 'Organic', required
      - `summary` string, nullable, required — Natural-language summary of the detected fraud signals; null when no summary is available
      - `highlights` string[] — Short bullet points highlighting the strongest fraud signals contributing to the score
      - `recommended_action` 'MONITOR' | 'CHALLENGE' | 'BLOCK' | 'ESCALATE'
    - `fraud_occurrences` object — Fraud occurrences for this case, keyed by `occurrence_id`. Entries follow the detailed fraud occurrence shape.

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not Found
- `422` — Request Validation Failed
- `500` — Internal Server Error

---

[API](https://skmtc.net/urbanfox/apis/urbanfox-customer-api.md) · [All operations](https://skmtc.net/urbanfox/apis/urbanfox-customer-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/urbanfox/urbanfox-customer-api/revisions/e99fd9028c60/schema)