To get details for a single case or alert, call the interface with an external or internal ID.

GET http://edqserver:8001/edq/cm/getcase/{id}[?sourcedata=true]

The following table lists the supported input properties for this call:

The following table lists the output properties displayed for each case:

Unset values are omitted. The extended attributes, which are included in the JSON object, are derived from the definitions in the system flags.xml file in the oedq_local_home/casemanagement directory..

The timestamps are returned in the ISO format, which is YYYY-MM-DDTHH:MM:SS.mmmZ

If the sourcedata flag is set to true, and the result is for an alert, the output properties also include the sourcedata and relationships attributes.

The following table lists the output properties that are displayed for the sourcedata attribute:

The following table lists the output properties that are displayed for the relationship attribute:

The sourcedata object is an array of input objects, each containing the input stream name and label, and the associated attribute labels, along with the source records.

The following is an example of the relationship and source data from a simple alert:

"relationships": [
  {
    "inputname": "workdata 1",
    "recordid": 77,
    "relatedinputname": "refdata 1",
    "relatedrecordid": 199342,
    "rulename": "MatchRule1",
    "priorityscore": 0
  }
],
"sourcedata": [
  {
    "inputname": "refdata 1",
    "label": "refdata",
    "labels": {
      "ID": "ID",
      "TITLE": "TITLE",
      "FIRSTNAME": "FIRSTNAME",
      "LASTNAME": "LASTNAME",
      "TELEPHONE": "TELEPHONE",
      "NewAttribute": "AGE",
      "NewAttribute1": "type"
    },
    "records": [
      {
        "recordid": 199342,
        "data": {
          "ID": 48,
          "TITLE": "Doctor",
          "FIRSTNAME": "Riaz",
          "LASTNAME": "Audoire",
          "TELEPHONE": "05305 937614",
          "NewAttribute": 67,
          "NewAttribute1": "I"
        }
      }
    ]
  },
  {
    "inputname": "workdata 1",
    "label": "workdata",
    "labels": {
      "ID": "ID",
      "TITLE": "TITLE",
      "FIRSTNAME": "FIRSTNAME",
      "LASTNAME": "LASTNAME",
      "TELEPHONE": "TELEPHONE",
      "NewAttribute": "AGE",
      "NewAttribute1": "type"
    },
    "records": [
      {
        "recordid": 77,
        "data": {
          "ID": 48,
          "TITLE": "Doctor",
          "FIRSTNAME": "Riaz",
          "LASTNAME": "Audoire",
          "TELEPHONE": "05305 937614",
          "NewAttribute": 3,
          "NewAttribute1": "I"
        }
      }
    ]
  }
]

Use runfilter to run a saved case management filter or report. The retrieved results are generated and displayed in JSON format. The filter results are limited according to the same rules as in the Case Management application. This call returns a limited number of results, along with indications of the total number of results available. You can specify the limit. The default limit is 100.

To execute a saved case management filter or report, use the following interface:

GET http://edqserver:8001/edq/cm/runfilter?filter=NAME[&global=true][&limit=100][&sql=false]

You can also create a JSON object that describes the filter you want to execute and then send it in the request body of the REST call using an HTTP POST. For example,

POST http://edqserver:8001/edq/cm/runfilter
{
  "filter": "string",
  "global": true,
  "limit": 50,
  "sourcedata": true
}

The following table lists the supported input properties for runfilter:

orderby: ["source", "description desc", "extendedattribute4 asc"]

When this code runs successfully, the details of the case are generated and displayed in JSON format:

{
  "version": 1,
  "report": false,
  "count": 1000,
  "more": true,
  "cases": [
     array of case/alert details
   ]
}

The count and more attributes reflect the values seen in the UI. For example, if a filter shows 100 items, 196 total on server, then count = 196 and more = false. If a filter shows 100 items, > 1,000 on server, then count = 1000 and more = true.

For a report execution, the result is a JSON object with the following structure:

{
  "version": 1,
  "report": true,
  "xlabels": [array of X axis labels],
  "ylabels": [array of Y axis labels],
  "scores":  [2 dimensional array of row/col values]
}

Reporting supports multiple items on each axis so the elements in the label arrays are arrays of strings.

To update case or alert details you need to create a JSON object that specifies the details that you want to change.

For example,

POST http://edqserver:8001/edq/cm/update

The payload to the request is a JSON object with the attributes listed in the following table:

The following table lists the attributes that each object in the updates array can contain:

The statechange object can contain these objects:

{
  "updates": [
    {
      "id": "ECS-234",
      "assigneduser": "john.sheridan",
      "priority": 3,
      "statechange": {
        "transition": "toMatch",
        "comment": "Updated by API call"
      }
    }
  ]
}

The result of a successful call (status 200) is an object with a status array containing the results of each individual case/alert update. Each status object contains these attributes:

The following is an example error response:

{ "status": [
    { "ok": false,
      "reason": "unknown_user",
      "message": "Unknown user \"tamie.grindy\""
    }
  ]
}

To add comments to one or more cases or alerts you need to create a JSON object that specifies the case/alert comment definitions.

For example,

POST /edq/cm/addcomments

The payload to the request is a JSON object with the attributes listed in the following table:

The following table lists the attributes that each object in the comments array can contain:

The result of a successful call (status 200) is an object with a status array containing the results of each individual case/alert update.

The user making the call must have the case management bulk delete permission. To delete cases or alerts create a JSON object that includes the array of IDs of case/alert that you want to delete and then send it in the request body of the REST call using an HTTP POST. For example,

POST http://edqserver:8001/edq/cm/deletecases
{ "deleteemptycases": true,
  "ids": [
     1213423,
	 454344,
	 "X1-123",
	 "X1-456"
  ]
}

The payload to the POST is a JSON object with the following attributes:

The result of a successful call is an object with the following attribute:

The user making the call must have the case management bulk delete permission. To delete cases or alerts in bulk using a filter, create a JSON object that includes the filter name and then send it in the request body of the REST call using an HTTP POST. Use the following interface:

POST http://edqserver:8001/edq/cm/bulkdelete

The payload to the POST is a JSON object with the following attributes:

The bulk deletion runs asynchronously. The result to the call is a JSON object containing a key corresponding to the execution.

{
  "executionkey":"a279513d1ea44b0198094ac31ae68258"
}

You can use the key to poll for execution completion. See Checking the Execution Status of a Bulk Operation.

If you want to cancel the bulk delete operation, use the bulkoperation method. See Canceling a Bulk Operation.

The user making the call must have the case management bulk update permission, as well as any permissions defined with transitions used in state change definitions.

To update cases or alerts in bulk using a filter, create a JSON object that includes the filter name and then send it in the request body of the REST call using an HTTP POST. Use the following interface:

POST http://edqserver:8001/edq/cm/bulkupdate

The payload to the POST is a JSON object with the following attributes:

The object used with assignment has these attributes:

The edits object can have these attributes:

For example

{ "filter": {
    "source": "WFP",
    "type": "alert",
    "state": ["one", "two"]
  },
 
  "statechanges": {
    "one": {
      "transition": "toThree",
      "comment": "one to three"
    }
  },
 
  "edits": {
    "description": "Alert description",
    "priority": 1,
    "extendedattribute3": "string 3",
    "extendedattribute1": true,
    "permission": "CMPermission1",
    "stateexpiry": "2024-12-10T00:00:00Z"
  },
 
  "assignment": {
    "groups": ["Administrators"],
    "users": ["user1", null]
  }
}

The bulk update operation runs asynchronously. The result to the call is a JSON object containing a key corresponding to the execution.

"executionkey":"a279513d1ea44b0198094ac31ae68258"

You can use the key to poll for execution completion. See Checking the Execution Status of a Bulk Operation.

The result object returned with the execution status when complete has these attributes:

If you want to cancel the bulk update operation, use the bulkoperation method. See Canceling a Bulk Operation.

To run a a case management report, using a generic filter, use the following interface:

http://edqserver:8001/edq/cm/report

The payload to the POST is a JSON object with the attributes listed in the following table:

The xaxis and yaxis attributes specify the attributes used to form the X and Y axis. The attribute names are as used in filter definitions. If an aggregation definition is supplied, the corresponding axis must have a single numeric flag or date attribute. If the aggregation attribute is set to null, no aggregation is performed and the axis contains discrete values.

The aggregation definition for a numeric flag has the attributes listed in the following table:

The aggregation definition for a date has these attributes:

The user must have the Export to Excel case management permission.

To initiate an asynchronous operation to export cases and alerts to a file or URL, use the following interface:

POST http://edqserver:8001/edq/cm/export

Supported output formats are JSON, JSON lines, XLSX and CSV. The payload to the POST is a JSON object that includes the following attributes:

The destination object is required and contains these attributes:

The result to the call is a JSON object containing a key corresponding to the execution.

"executionkey":"a279513d1ea44b0198094ac31ae68258"

You can use the key to poll for execution completion. See Checking the Execution Status of a Bulk Operation.

When the export is completed, a trigger is run with the /casemanagement/export path. The single argument passed to the trigger is an object with the following attributes:

The following is an example trigger that sends the output file in an email attachment:

addLibrary("usercache");
addLibrary("mail");
addLibrary("logging");
 
function getPath() {
  return "/casemanagement/export"
}
 
function run(path, id, env, status) {
  if (!status.failed && !status.cancelled) {
    logger.log(Level.INFO, "CM: {0}: {1} exported {2} to {3} ({4})", status.label, usercache.getUser(status.userid).userName, status.count, status.location, status.format)
 
    var mh  = Mail.open({enabled : true});
    var msg = mh.newMessage("An export from cm")
       
    msg.text = "Export complete"
    msg.addTo("someuser@example.com")
    msg.type = "text/plain";
    msg.addAttachment(status.location, "application/jsonl")
    msg.send()
  }
}

If you want to cancel the bulk export operation, use the bulkoperation method. See Canceling a Bulk Operation.

The filter used with the runfilter, bulkdelete, bulkupdate and export APIs can be the name of a global filter or a JSON map defining the search conditions. These conditions can include any of the standard and extended attributes that are supported in the Case Management UI. Note that, currently, searches using case comments and transitions are not supported.

The runfilter payload supports an additional orderby attribute, which is an an array of strings that define the order by columns for the query.

The available attributes in the filter map are listed in the following table:

For filter attributes that have timestamp values, see Filtering with dates.

For filtering using extended attributes, see Filtering extended attributes.

For an attribute test that has a Yes in the Can be negated? column, you can invert the test by adding a boolean attribute with the filter name suffixed with "negated". For example the following filter settings select all alerts with no permission set:

"type": "alert",
"permission": null,
"permissionnegated": true

{ "source": ["Screening", "Test"],
  "sourceattributes": {
    "Screening": [
      { "input": "workdata",
	    "attribute": "firstname",
	    "value": "j%"
      },
      { "input": "workdata",
        "attribute": "lastname",
        "value": ["kirk", "doohan"]
      }
    ],
    "Test": [
      { "input": "Relationships",
        "attribute": "Rule Name",
        "value": "R0012 or R002%",
        "negated": true
      },
      { "input": "Watchlist",
        "attribute": "dob",
        "value": { "from": "1990-01-01T00:00:00Z", "to": "2023-11-21T12:34:56Z" }
      }
    ]
  }
}

"createdwhen": null
"createdwhen": "2023-10-11T12:34:56Z"
"createdwhen": ["2023-10-11T12:34:56Z", "2024-01-08T11:01:12Z"]
"createdwhen": {"from": "2023-01-01T00:00:00Z", "to": "2024-12-31T23:59:59Z"}

"extendedattribute1": null,
"extendedattribute2": true,
"extendedattribute3": "string",
"extendedattribute4": ["monday", "tuesday"],
"extendedattribute5": 20,
"extendedattribute6": [2,4,5,8,37.4],
"extendedattribute7": {"from": 10, "to": 55, "inclusive": true]

You can cancel a bulk operation such as update, delete or export using the following interface:

DELETE http://edqserver:8001/edq/cm/bulkoperation/EXECUTIONKEY

The payload to the POST call is a JSON object containing an executionkey attribute that specifies the execution key that was returned by the call that initiated the bulk operation.

The result is a JSON object containing a cancelled attribute, which is set to true if the operation was not completed when the cancel request was received.

You can check the status of bulk operations such as update, delete or export using the execution key that you get as a result when the call runs. The status of a completed execution is available for one hour after completion.

To get the status of a bulk operation, use the following interface:

GET http://edqserver:8001/edq/cm/bulkstatus/EXECUTIONKEY

The EXECUTIONKEY component of the URL is the key returned from a previous bulk delete call. If the key is not known, the request fails with 404 error.

The payload to the POST is a JSON object with the following attributes:

For example:

{
  "complete": true,
  "failed": false,
  "start": "2022-08-24T17:34:44.990Z",
  "end": "2022-08-24T17:34:45.448Z",
  "result": {
    "count": 20
  }
}

To execute multiple saved filters and report timing, use the following interface:

POST http://edqserver:8001/edq/cm/filtertest?[?sql=false]

The payload to the POST is a JSON object that includes the following attributes:

For example:

{
  "tests": [
    { "filter": "NAME1", "global": true, "count": 50 },
    { "filter": "NAME2", "global": true, "count": 50 },
    ...
  ]
}

The result of the call is a JSON object:

{
  duration: total duration of tests in milliseconds,
  results: [
    { "filter": "NAME1", "global": true, "count": 50, "xids": [internal execution ids for each invocation] },
    ...
  ]
}

The filter, global and count attributes in the results array elements reflect the values in the input object. xids are the internal execution IDs for each execution of the filter.