Skip to main content

Working with Clients & Cases

Clients and cases are the two entities you'll touch most. A client is who your organisation works for or investigates — a company or person; a case is a unit of work tied to one or more clients. For a law firm that's typically a legal matter, but a case can equally be a bankruptcy estate, an audit engagement, a compliance review, or any other engagement. This guide walks the full lifecycle — create a client, open a case for them, read and update, list with filters, and attach shared sub-resources — using real requests and responses. For the field-by-field reference and status lifecycles, see The Client and The Case.

If you haven't yet, skim API Conventions (the envelope, X-Scope, pagination) and the Entities concept first — everything here builds on them.

Every request in this guide is scoped

Client and case endpoints are scoped: send both the Authorization and X-Scope headers. New entities are anchored to whatever scope you pass. We omit the headers from the JSON bodies below for brevity, but they're always required.

1. Create a client​

A client is either a company or a person. Only type, displayName, and countryCode are required; the rest is optional and can be filled in later.

curl -X POST "https://api.lexabit.com/clients/v1" \
  -H "Authorization: Bearer $LEXABIT_TOKEN" \
  -H "X-Scope: 42" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "company",
    "displayName": "Acme AS",
    "countryCode": "NO",
    "registrationNumber": "922020175",
    "engagementType": "advisory",
    "status": "active"
  }'

201 Created:

{
  "data": {
    "id": "9b1d7c2a-…",
    "type": "company",
    "displayName": "Acme AS",
    "countryCode": "NO",
    "registrationNumber": "922020175",
    "status": "active",
    "engagementType": "advisory",
    "pepStatus": "unknown",
    "sanctionsStatus": "unknown",
    "conflictCheckStatus": "not_started",
    "createdAt": "2026-07-06T10:15:00Z",
    "updatedAt": "2026-07-06T10:15:00Z"
  },
  "meta": { "requestId": "a1b2…" }
}

Note the compliance fields (pepStatus, sanctionsStatus, conflictCheckStatus, riskClassification, …) — these are read-only here; they're maintained by your organisation's compliance workflows, not set on create.

Creating a person instead​

For an individual, use type: "person" and person fields instead of company ones:

{
  "type": "person",
  "displayName": "Kari Nordmann",
  "countryCode": "NO",
  "nationalId": "13097248022",
  "dateOfBirth": "1972-09-13"
}

2. Open a case for the client​

A case needs a name, the clientId it belongs to, and a caseType:

curl -X POST "https://api.lexabit.com/cases/v1" \
  -H "Authorization: Bearer $LEXABIT_TOKEN" \
  -H "X-Scope: 42" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Acme — 2026 share purchase",
    "clientId": "9b1d7c2a-…",
    "caseType": "m_a",
    "status": "open"
  }'

201 Created:

{
  "data": {
    "id": "c-4410-…",
    "name": "Acme — 2026 share purchase",
    "caseIdDisplay": "M&A-2026-014",
    "caseType": "m_a",
    "status": "open",
    "clientId": "9b1d7c2a-…",
    "openedAt": "2026-07-06T10:20:00Z",
    "createdAt": "2026-07-06T10:20:00Z"
  },
  "meta": { "requestId": "a1c0…" }
}

caseType is one of m_a, bankruptcy, litigation, compliance, due_diligence, or other. status moves through draft → open → on_hold → closed → archived.

3. Read a single client or case​

curl "https://api.lexabit.com/clients/v1/9b1d7c2a-…" \
  -H "Authorization: Bearer $LEXABIT_TOKEN" \
  -H "X-Scope: 42"

Returns the full client object under data. A 404 here almost always means a scope problem, not a missing record — see Permissions → 403 vs 404.

4. List with filtering, sorting, and paging​

List endpoints apply the standard query conventions. List active clients, newest first, 25 per page:

curl "https://api.lexabit.com/clients/v1?filter[status]=active&sort=-createdAt&perPage=25" \
  -H "Authorization: Bearer $LEXABIT_TOKEN" \
  -H "X-Scope: 42"
{
  "data": [ { "id": "9b1d7c2a-…", "displayName": "Acme AS", "status": "active" } ],
  "meta": {
    "requestId": "a1c4…",
    "pagination": { "total": 42, "perPage": 25, "currentPage": 1, "lastPage": 2 }
  }
}

To list the cases for one client, filter cases by clientId:

curl "https://api.lexabit.com/cases/v1?filter[clientId]=9b1d7c2a-…&sort=-openedAt" \
  -H "Authorization: Bearer $LEXABIT_TOKEN" \
  -H "X-Scope: 42"

5. Update​

Use PATCH for a partial update (send only the fields you're changing); PUT replaces the full resource.

curl -X PATCH "https://api.lexabit.com/cases/v1/c-4410-…" \
  -H "Authorization: Bearer $LEXABIT_TOKEN" \
  -H "X-Scope: 42" \
  -H "Content-Type: application/json" \
  -d '{ "status": "on_hold", "notes": "Awaiting due-diligence sign-off." }'

6. Attach shared sub-resources​

Contacts, addresses, profile, media, and invitations attach to any entity through one path shape:

/entitymanagement/v1/{entityType}/{entityId}/{sub-resource}

Add a primary email to the client:

curl -X POST \
  "https://api.lexabit.com/entitymanagement/v1/client/9b1d7c2a-…/contacts" \
  -H "Authorization: Bearer $LEXABIT_TOKEN" \
  -H "X-Scope: 42" \
  -H "Content-Type: application/json" \
  -d '{ "contactType": "email", "contactValue": "post@acme.no", "isPrimary": true }'

The identical call with case in place of client adds the contact to a case. See Entities → shared sub-resources for the full list.

7. Delete​

DELETE soft-deletes (archives) the entity:

curl -X DELETE "https://api.lexabit.com/cases/v1/c-4410-…" \
  -H "Authorization: Bearer $LEXABIT_TOKEN" \
  -H "X-Scope: 42"

A 403 here means your role lacks the delete capability — deletion is an Action-layer check.

Where to go next​