​

Case Lifecycle

​

Case types

​

Status transitions

​

Invalid transitions

{
  "error": "invalid_transition",
  "message": "Cannot transition from 'Closed' to 'In Progress'. Closed is a terminal state.",
  "current_status": "Closed",
  "requested_status": "In Progress"
}

​

SLA calculation

​

SLA status

​

Auto-escalation

1. Set to Internal Review status
2. Assigned to the current analyst’s manager
3. Flagged with an escalation reason (“SLA breach”)
4. Logged in the audit trail

​

Closure requirements

1. All alerts are resolved — open alert count must be zero
2. Resolution notes provided — a summary of the investigation outcome

curl -X POST https://api.zenoo.com/v1/cases/cas_xyz789/close \
  -H "Authorization: Bearer your-api-key" \
  -H "Content-Type: application/json" \
  -d '{
    "resolution_notes": "All checks passed. PEP match on UBO reviewed and cleared."
  }'

{
  "error": "closure_blocked",
  "message": "Cannot close case with 2 open alerts. Resolve all alerts first.",
  "open_alerts_count": 2
}

​

Escalation

​

Manual escalation

curl -X POST https://api.zenoo.com/v1/cases/cas_xyz789/escalate \
  -H "Authorization: Bearer your-api-key" \
  -H "Content-Type: application/json" \
  -d '{
    "reason": "Complex corporate structure requires senior review.",
    "escalate_to": "user_manager01"
  }'

​

What happens on escalation

1. Case status changes to Internal Review
2. Case is assigned to the specified manager
3. Email notification sent to the manager
4. Audit trail entry created (CASE_ESCALATION)
5. Escalation date and reason are recorded

​

Risk score recalculation

• An alert is resolved or created
• A risk assessment is approved
• An analyst applies a risk override

​

Next steps

• Entity Lifecycle. How entities relate to cases.
• Alert Management. Alert lifecycle within a case.
• Audit Trail. Track every case event.
• Cases Data Model. Full field reference.