# Get a verification case.


Returns one verification case by id, with its accepted credentials and requested attributes: one of the calling organization's own, or any other organization's, which the caller may launch with POST /b2b/v1/verification-cases/{caseId}/sessions. A case id is not a secret (it is in every QR code the case produces), so holding it is what it takes to read and run the case. Another organization's case reads in the same shape, without its owner's `reference_id` and `description`, and only while it is not archived. Requires the deepcredentials.verify scope.

Endpoint: GET /b2b/v1/verification-cases/{caseId}
Version: 1.0.0
Security: BearerAuth

## Security:

  - `BearerAuth` (unknown)
    http bearer JWT

## Path parameters:

  - `caseId` (string, required)

## Header parameters:

  - `X-Org-Id` (string, required)
    Organization the call is acting on. The authenticated service user must be a member of this organization in DeepAdmin; otherwise the request returns 404.

  - `X-Environment` (string, required)
    Environment the call is scoped to. Resources are isolated per environment.

## Response 200:

  - `200` (unknown)
    Success response

## Response 200 fields (application/json):

  - `archived_at` (string)
    When the case was archived; absent while it is not. An archived case cannot be launched or changed until restored.

  - `created_at` (string, required)
    When the case was created (RFC3339).

  - `credential_definition_ids` (array, required)
    The credential definitions the case accepts. With several, the holder presents any one of them.

  - `environments` (array, required)
    Environments the case runs in ("beta", "production"): those where every credential it accepts is enabled. A launch in any other environment is refused with case_not_available.

  - `id` (string, required)
    Case id: launch it at POST /b2b/v1/verification-cases/{caseId}/sessions. UUID v4 identifier.
    Example: 550e8400-e29b-41d4-a716-446655440000

  - `launchable_versions` (array, required)
    Older versions a launch pinning them may still run, while the owner keeps them open (a migration window); ascending. Empty means only the current version launches.

  - `name` (string, required)
    Case name, as shown in the portal.

  - `presentation` (object, required)
    What the holder reads: the headline of the verification screen and the reason shown in the wallet. Not part of the contract: changing it never moves the version.

  - `presentation.purpose` (array)
    Why the verification asks, one entry per language, at most 1000 characters each. It travels with the request, and in the swiyu Sandbox is published with it in the swiyu trust registry, where anyone can read it. A launch may give a different reason for one run (not published).

  - `presentation.purpose.locale` (string, required)
    Language of the text: "de", "fr", "it" or "en".

  - `presentation.purpose.name` (string, required)
    The text in this language.

  - `presentation.title` (array)
    Headline of the verification screen, one entry per language ("de", "fr", "it", "en"). Without one, the case name is shown. In the swiyu Sandbox it is also the published name of the verification.

  - `reference_id` (string)
    Your own key for what the case guards (a door, a zone), when you gave one. Unique within your organization. Absent on another organization's case: the key is the owner's bookkeeping.

  - `requested_attributes` (array, required)
    The attributes the case asks for, each bound to a claim in every accepted credential, with what a presented value must satisfy under `constraints`.

  - `requested_attributes.bindings` (object)
    The claim this attribute reads in each accepted credential, keyed by credential definition id. Required on a write: every accepted credential needs one.

  - `requested_attributes.constraints` (object)
    What a presented value must satisfy. Absent: the attribute is only asked for. A value that fails a constraint closes the session as failed (attribute_value_rejected) and nothing disclosed is kept.

  - `requested_attributes.constraints.max` (any)
    Inclusive upper bound, in the same forms as `min`. `today-18y` as `max` of a birth date means at least 18 years old.

  - `requested_attributes.constraints.min` (any)
    Inclusive lower bound: a number, or for a date an ISO date (`2000-01-01`) or a date relative to the day of verification (`today`, `today-18y`, `today+30d`, `today-6m`).

  - `requested_attributes.constraints.values` (array)
    Allowed values: strings for string and enum attributes, booleans for a boolean attribute.

  - `requested_attributes.id` (string, required)
    The attribute's own id: a session answers with it in `attributes`, whichever credential the holder presented. Letters, digits, _ and -.

  - `requested_attributes.label` (string)
    Display name of the attribute, for your staff: shown on the kiosk result and the session detail in the portal, not to the holder. Optional; without one the bound claim's label is shown.

  - `requested_attributes.sensitive` (boolean)
    True when a bound claim is marked sensitive in its credential definition. Read-only.

  - `requested_attributes.value_type` (string)
    Value type of the attribute ("string", "integer", "number", "boolean", "date", "enum", "image/jpeg"). Optional on writes: taken from the bound claims, which must all have the same type. It decides which constraints the attribute can carry.

  - `updated_at` (string, required)
    When the case was last changed (RFC3339).

  - `version` (integer, required)
    Version of the contract (credentials, attributes, constraints); moves on every change of one of them, never on a rename. Pin it with case_version when launching.

## Response 400:

  - `400` (unknown)
    Invalid request. Common causes: missing or malformed X-Org-Id / X-Environment headers, or a missing required field in the request body.

## Response 400 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.

## Response 401:

  - `401` (unknown)
    Unauthenticated. The Bearer token failed validation (signature, issuer, audience, or expiry).

## Response 401 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.

## Response 403:

  - `403` (unknown)
    Permission denied. The token does not carry the scope required by this endpoint. Check the `scope` claim on the token you received from the DeepCloud SSO token endpoint.

## Response 403 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.

## Response 404:

  - `404` (unknown)
    Resource not found. Either the resource ID is unknown, or the X-Org-Id you supplied is not an organization the authenticated service user is a member of.

## Response 404 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.

## Response 429:

  - `429` (unknown)
    Rate limit exceeded.

## Response 429 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.

## Response 500:

  - `500` (unknown)
    Internal server error.

## Response 500 fields (application/json):

  - `code` (string, required)
    Machine-readable error code.

  - `message` (string, required)
    Human-readable error description.

  - `details` (object)
    Optional structured data with additional context.