ediscoveryCase resource type

Namespace: microsoft.graph.security

Important

APIs under the /beta version in Microsoft Graph are subject to change. Use of these APIs in production applications is not supported. To determine whether an API is available in v1.0, use the Version selector.

In the context of eDiscovery, contains custodians, holds, searches, review sets, and exports. For details, see Overview of Microsoft Purview eDiscovery (Premium).

Methods

Method	Return type	Description
List	microsoft.graph.security.ediscoveryCase collection	Get a list of the ediscoveryCase objects and their properties.
Create	microsoft.graph.security.ediscoveryCase	Create a new ediscoveryCase object.
Get	microsoft.graph.security.ediscoveryCase	Read the properties and relationships of an ediscoveryCase object.
Update	microsoft.graph.security.ediscoveryCase	Update the properties of an ediscoveryCase object.
Delete	None	Delete an ediscoveryCase object.
Close	None	Close an ediscoveryCase object.
Reopen	None	Reopen an ediscoveryCase object.
List custodians	microsoft.graph.security.ediscoveryCustodian collection	Get the ediscoveryCustodian resources from the custodians navigation property.
Create custodian	microsoft.graph.security.ediscoveryCustodian	Create a new ediscoveryCustodian object.
List legal holds	microsoft.graph.security.ediscoveryHoldPolicy collection	Get the ediscoveryHoldPolicy resources from the legalHolds navigation property.
Create hold policy	microsoft.graph.security.ediscoveryHoldPolicy	Create a new ediscoveryHoldPolicy object.
List noncustodial data sources	microsoft.graph.security.ediscoveryNoncustodialDataSource collection	Get the ediscoveryNoncustodialDataSource resources from the noncustodialDataSources navigation property.
Create noncustodial data source	microsoft.graph.security.ediscoveryNoncustodialDataSource	Create a new ediscoveryNoncustodialDataSource object.
List operations	microsoft.graph.security.caseOperation collection	Get the caseOperation resources from the operations navigation property.
List review sets	microsoft.graph.security.ediscoveryReviewSet collection	Get the ediscoveryReviewSet resources from the reviewSets navigation property.
Create review set	microsoft.graph.security.ediscoveryReviewSet	Create a new ediscoveryReviewSet object.
List searches	microsoft.graph.security.ediscoverySearch collection	Get the ediscoverySearch resources from the searches navigation property.
Create search	microsoft.graph.security.ediscoverySearch	Create a new ediscoverySearch object.
List tags	microsoft.graph.security.ediscoveryReviewTag collection	Get the ediscoveryReviewTag resources from the tags navigation property.
Create review tag	microsoft.graph.security.ediscoveryReviewTag	Create a new ediscoveryReviewTag object.

Properties

Property	Type	Description
closedBy	microsoft.graph.identitySet	The user who closed the case.
closedDateTime	DateTimeOffset	The date and time when the case was closed. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z
createdBy	microsoft.graph.identitySet	The user who created the case.
createdDateTime	DateTimeOffset	The date and time when the entity was created. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z
description	String	The case description.
displayName	String	The case name.
externalId	String	The external case number for customer reference.
id	String	The ID for the eDiscovery case. Read-only.
lastModifiedBy	microsoft.graph.identitySet	The last user who modified the case.
lastModifiedDateTime	DateTimeOffset	The latest date and time when the case was modified. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z
status	microsoft.graph.security.caseStatus	The case status. Possible values are unknown, active, pendingDelete, closing, closed, and closedWithError. For details, see the following table.

caseStatus values

Member	Description
unknown	Case status is unknown.
active	Case is active.
pendingDelete	Case was deleted, but the delete has not been fully transacted.
closing	Case was closed, but the operation has not been fully transacted.
closed	The case is closed.
closedWithError	The case is closed, but there were errors releasing holds in the case.

Relationships

Relationship	Type	Description
custodians	microsoft.graph.security.ediscoveryCustodian collection	Returns a list of case ediscoveryCustodian objects for this case.
legalHolds	microsoft.graph.security.ediscoveryHoldPolicy collection	Returns a list of case eDiscoveryHoldPolicy objects for this case.
noncustodialDataSources	microsoft.graph.security.ediscoveryNoncustodialDataSource collection	Returns a list of case ediscoveryNoncustodialDataSource objects for this case.
operations	microsoft.graph.security.caseOperation collection	Returns a list of case caseOperation objects for this case.
reviewSets	microsoft.graph.security.ediscoveryReviewSet collection	Returns a list of eDiscoveryReviewSet objects in the case.
searches	microsoft.graph.security.ediscoverySearch collection	Returns a list of eDiscoverySearch objects associated with this case.
settings	microsoft.graph.security.ediscoveryCaseSettings	Returns a list of eDIscoverySettings objects in the case.
tags	microsoft.graph.security.ediscoveryReviewTag collection	Returns a list of ediscoveryReviewTag objects associated to this case.

JSON representation

The following JSON representation shows the resource type.

{
  "@odata.type": "#microsoft.graph.security.ediscoveryCase",
  "id": "String (identifier)",
  "displayName": "String",
  "description": "String",
  "createdDateTime": "String (timestamp)",
  "lastModifiedBy": {
    "@odata.type": "microsoft.graph.identitySet"
  },
  "lastModifiedDateTime": "String (timestamp)",
  "status": "String",
  "closedBy": {
    "@odata.type": "microsoft.graph.identitySet"
  },
  "closedDateTime": "String (timestamp)",
  "externalId": "String"
}