GET/v1/cases
List the CRA cases
Returns the account's cases under Article 14 of the Cyber Resilience Act, an
actively exploited vulnerability or a severe incident, newest first, each with
its state, product, vulnerability identifiers and the stage whose stored deadline
comes next. A token limited to one product lists that product's cases only.
Deadlines are dates and times; the answer says nothing about whether one has
passed. Pages hold limit cases; next_cursor reads the next page, sent as
cursor with the same filters, and is null on the last. Requires the scope
cases:read.
Scope: cases:read
Parameters
| Parameter | In | Type | Description |
|---|---|---|---|
product_id | query | string (uuid) | Only the cases of this product. With a token limited to another product, the list is empty. |
closed | query | boolean | True for the cases that are closed or dismissed only, false for the others only. Leaving it out lists both. |
limit | query | integer | The most cases a page holds. |
cursor | query | string | The `next_cursor` of the page before. |
Responses
200 A page of the cases the token sees. CaseList
{
"cases": [
{
"id": "7b1c2e8a-4f0d-4c55-9a3e-2d6f1b0c9e41",
"type": "exploited_vulnerability",
"state": "early_warning_submitted",
"product_id": "2d244e39-9353-4652-b8bb-fde203139229",
"cve": "CVE-2026-12345",
"euvd_id": null,
"advisory_id": "GHSA-abcd-efgh-ijkl",
"detected_at": "2026-10-12T06:25:31Z",
"became_aware_at": "2026-10-12T06:25:31Z",
"next_deadline": {
"stage": "notification",
"due_at": "2026-10-15T06:25:31Z"
}
}
],
"next_cursor": "MTc2MDI1MDMzMTAwMDAwMC43YjFjMmU4YS00ZjBkLTRjNTUtOWEzZS0yZDZmMWIwYzllNDE"
}400 A query parameter is not one the list takes, or the cursor is not one this API gave. Problem
{
"type": "about:blank",
"title": "Bad Request",
"status": 400,
"detail": "limit is a whole number from 1 to 100."
}Example
curl --fail-with-body -sS \
-H "Authorization: Bearer $BITHIVE_TOKEN" \
"https://app.bithive-it.com/v1/cases"