List cases
Returns cases hydrated with threat events and behavioral drifts, scoped to the caller’s domain.
Side effect: Any discover case included in the response is
automatically claimed — it transitions to pending_investigation
and an investigation record is created. Repeated polling of the
same case is safe; already-claimed cases are not double-counted.
Documentation Index
Fetch the complete documentation index at: https://docs.truu.ai/llms.txt
Use this file to discover all available pages before exploring further.
Authorizations
Domain-scoped API key. Generate and manage keys from the API Keys page in Settings.
Accepted in two forms:
X-API-Key: <key>header (preferred)Authorization: Bearer <key>header (also accepted)
Query Parameters
Filter by user email
Lifecycle state of a case:
discover— Vetted by the AI judge, ready for triagepending_investigation— Swiped; investigation pendinginvestigating— Investigation underwayenforced— An enforcement action has been takenclosed— Case closed
Case classification from the AI judge (Predict / inference pipeline).
Known values: threat, insider_threat, identity_vulnerability.
Older or demo rows may still carry legacy strings until backfilled.
x <= 200Case id from the last item of the previous page.

