Reference

Docs

Casewright is a self-hosted, immutable case desk. You stay in control of your data; the cryptographic packet is the only artifact that ever leaves your server.

How packet reproducibility works

Every packet is a revision with three SHA-256 artifacts: PDF, ZIP, manifest.
The hashes are computed at generation time and stored in the database alongside the input facts.
Run Reproduce on any revision and the server recomputes the hashes from the current fact ledger.
Match = nobody changed the inputs. Mismatch = somebody did, and the audit log tells you who.

Role / permission matrix

Held = the role can perform the action. The server is the source of truth; this is a UI aid.

Action	Owner / Admin	Case Manager	Reviewer	Approver	Auditor
Upload evidence	●	●	●	○	○
Add fact	●	●	●	○	○
Accept or dispute fact	●	●	●	○	○
Link evidence to fact	●	●	●	○	○
Run evaluation	●	●	●	○	○
Resolve finding	●	●	●	○	○
Add charge line	●	●	○	○	○
Propose charge from AI	●	●	●	○	○
Send charge to review	●	●	●	○	○
Approve charge	●	○	○	●	○
Reject charge	●	○	○	●	○
Reopen charge	●	●	●	○	○
Add deadline	●	●	○	○	○
Confirm deadline	●	●	●	○	○
Generate immutable packet	●	○	○	●	○
Reproduce + verify packet	●	●	●	●	●
Record correspondence	●	●	●	○	○
Record submission	●	●	○	●	○
Record outcome	●	●	●	○	○
AI: classify evidence	●	●	●	○	○
AI: extract entities	●	●	●	○	○
AI: explain differences	●	●	●	○	○
AI: suggest missing evidence	●	●	●	○	○
AI: build chronology	●	●	●	○	○
AI: draft cover letter	●	●	●	○	○
Accept AI proposal	●	●	●	○	○
Reject AI proposal	●	●	●	○	○

Webhook API (outbound)

Configure endpoints at /app/settings/webhooks. Each delivery is signed with HMAC-SHA256.

POST your-endpoint

x-casewright-signature — HMAC-SHA256 hex of the body, keyed by your endpoint secret.
x-casewright-timestamp — Unix seconds.
x-casewright-event — event kind (e.g. packet.created).
x-casewright-event-id — idempotency key.

Event kinds

packet.created — a new immutable packet was generated.
submission.recorded — a submission event was recorded.
outcome.recorded — an outcome event was recorded.

Retry policy

5xx / network → retry up to 3 times (1s, 2s, 4s).
4xx → no retry (client error).
2xx → mark delivered, stop.

Config reference

All configuration env vars. Defaults shown are dev defaults.

Var	Default	Purpose
APP_PORT	4060	Listen port (dev server).
DATABASE_URL	—	Postgres connection string.
SESSION_SECRET	—	32+ byte signing key for session cookies.
AI_ENABLED	false	Master AI switch. Off-by-default keeps the data on this server.
IMAP_SECRET_KEY	LICENSE_PRIVATE_KEY	AES-256-GCM key for IMAP password at rest.

Your licence

One payment, already made. Every feature is included — unlimited cases, unlimited users, immutable packets, the full audit trail — with no tier to compare against, nothing to upgrade to, and nothing that expires. If a licence ever stops covering new releases, the version you have installed keeps working exactly as it does today.

AI assistance is optional and runs on your own key against an endpoint you configure. No request allowance is bundled, because nothing here meters AI usage — your provider bills you directly.

Loading…