Returns cases scoped to the caller’s domain, hydrated with threat events and behavioral drifts.
Domain-scoped API key. Generate and manage keys from the API Keys
page in Settings. Pass via the X-API-Key header.
Filter by user email
Lifecycle state of a case:
discover — Vetted by the AI judge, ready for triagepending_investigation — Swiped; investigation pendinginvestigating — Investigation underwayenforced — An enforcement action has been takenclosed — Case closeddiscover, pending_investigation, investigating, enforced, closed Threat classification assigned to a case
data_exfiltration, insider_threat, privilege_escalation, policy_violation, account_compromise, sabotage, financial_fraud x <= 200