---
type: api
title: Add a case comment or alert
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana-serverless/operation/operation-addcasecommentdefaultspace
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana-serverless/operation/operation-addcasecommentdefaultspace
products:
  - Kibana
---

# Add a case comment or alert

- Server: `https://{kibana_url}`

## Paths

- `POST` `/api/cases/{caseId}/comments`
- `POST` `/s/{space_id}/api/cases/{caseId}/comments`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana-serverless/authentication#apikeyauth)

#### Path Parameters

- `caseId` (string)
  The identifier for the case. To retrieve case IDs, use the search cases (`_find)` API. All non-ASCII characters must be URL encoded.

## Description

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you're creating. NOTE: Each case can have a maximum of 1,000 alerts.

## Request Body

`application/json`

One of:
- **Cases_add_alert_comment_request_properties** (`type: alert`)
  Defines properties for case comment requests when type is alert.
  - `alertId` (union) — required
    The alert identifiers. It is required only when `type` is `alert`. You can use an array of strings to add multiple alerts to a case, provided that they all relate to the same rule; `index` must also be an array with the same length or number of elements. Adding multiple alerts in this manner is recommended rather than calling the API multiple times. This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.
    One of: `string[]` or `string`
  - `index` (union) — required
    The alert indices. It is required only when `type` is `alert`. If you are adding multiple alerts to a case, use an array of strings; the position of each index name in the array must match the position of the corresponding alert identifier in the `alertId` array.  This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.
    One of: `string[]` or `string`
  - `owner` (enum) — required
    The application that owns the cases: Stack Management, Observability, or Elastic Security.
    Values: `cases`, `observability`, `securitySolution`
  - `rule` ({}) — required
    The rule that is associated with the alerts. It is required only when `type` is `alert`. This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.
    - `id` (string) — optional
      The rule identifier.
    - `name` (string) — optional
      The rule name.
  - `type` (enum) — required
    The type of comment.
    Values: `alert`
- **Cases_add_user_comment_request_properties** (`type: user`)
  Defines properties for case comment requests when type is user.
  - `comment` (string · max: 30000) — required
    The new comment. It is required only when `type` is `user`.
  - `owner` (enum) — required
    The application that owns the cases: Stack Management, Observability, or Elastic Security.
    Values: `cases`, `observability`, `securitySolution`
  - `type` (enum) — required
    The type of comment.
    Values: `user`

## Responses

#### `200`

Indicates a successful call.

`application/json`

- `assignees` ([] null · max: 10) — nullable
  An array containing users that are assigned to the case.
  - `uid` (string)
    A unique identifier for the user profile. These identifiers can be found by using the suggest user profile API.
- `category` (string) — nullable
  The case category.
- `closed_at` (string) — nullable
- `closed_by` ({}) — nullable
  - `email` (string) — nullable
  - `full_name` (string) — nullable
  - `profile_uid` (string)
  - `username` (string) — nullable
- `comments` ([] union oneOf · max: 10000)
  An array of comment objects for the case.
  - **Cases_alert_comment_response_properties**
    - `alertId` ([] string)
    - `created_at` (string)
    - `created_by` (object)
      - `email` (string) — nullable
      - `full_name` (string) — nullable
      - `profile_uid` (string)
      - `username` (string) — nullable
    - `id` (string)
    - `index` ([] string)
    - `owner` (enum)
      The application that owns the cases: Stack Management, Observability, or Elastic Security.
      Values: `cases`, `observability`, `securitySolution`
    - `pushed_at` (string) — nullable
    - `pushed_by` (object) — nullable
      - `email` (string) — nullable
      - `full_name` (string) — nullable
      - `profile_uid` (string)
      - `username` (string) — nullable
    - `rule` (object)
      - `id` (string) — nullable
        The rule identifier.
      - `name` (string) — nullable
        The rule name.
    - `type` (enum)
      Values: `alert`
    - `updated_at` (string) — nullable
    - `updated_by` (object) — nullable
      - `email` (string) — nullable
      - `full_name` (string) — nullable
      - `profile_uid` (string)
      - `username` (string) — nullable
    - `version` (string)
  - **Cases_event_comment_response_properties**
    - `created_at` (string)
    - `created_by` ({})
      - `email` (string) — nullable
      - `full_name` (string) — nullable
      - `profile_uid` (string)
      - `username` (string) — nullable
    - `eventId` ([] string)
    - `id` (string)
    - `index` ([] string)
    - `owner` (enum)
      The application that owns the cases: Stack Management, Observability, or Elastic Security.
      Values: `cases`, `observability`, `securitySolution`
    - `pushed_at` (string) — nullable
    - `pushed_by` ({}) — nullable
      - `email` (string) — nullable
      - `full_name` (string) — nullable
      - `profile_uid` (string)
      - `username` (string) — nullable
    - `type` (enum)
      Values: `event`
    - `updated_at` (string) — nullable
    - `updated_by` ({}) — nullable
      - `email` (string) — nullable
      - `full_name` (string) — nullable
      - `profile_uid` (string)
      - `username` (string) — nullable
    - `version` (string)
  - **Cases_user_comment_response_properties**
    - `comment` (string)
    - `created_at` (string)
    - `created_by` ({})
      - `email` (string) — nullable
      - `full_name` (string) — nullable
      - `profile_uid` (string)
      - `username` (string) — nullable
    - `id` (string)
    - `owner` (enum)
      The application that owns the cases: Stack Management, Observability, or Elastic Security.
      Values: `cases`, `observability`, `securitySolution`
    - `pushed_at` (string) — nullable
    - `pushed_by` ({}) — nullable
      - `email` (string) — nullable
      - `full_name` (string) — nullable
      - `profile_uid` (string)
      - `username` (string) — nullable
    - `type` (enum)
      Values: `user`
    - `updated_at` (string) — nullable
    - `updated_by` ({}) — nullable
      - `email` (string) — nullable
      - `full_name` (string) — nullable
      - `profile_uid` (string)
      - `username` (string) — nullable
    - `version` (string)
- `connector` (union oneOf)
  - **Cases_connector_properties_none** (`type: .none`)
    Defines properties for connectors when type is `.none`.
    - `fields` (string) — nullable
      An object containing the connector fields. To create a case without a connector, specify null. To update a case to remove the connector, specify null.
    - `id` (string)
      The identifier for the connector. To create a case without a connector, use `none`. To update a case to remove the connector, specify `none`.
    - `name` (string)
      The name of the connector. To create a case without a connector, use `none`. To update a case to remove the connector, specify `none`.
    - `type` (enum)
      The type of connector. To create a case without a connector, use `.none`. To update a case to remove the connector, specify `.none`.
      Values: `.none`
  - **Cases_connector_properties_cases_webhook** (`type: .cases-webhook`)
    Defines properties for connectors when type is `.cases-webhook`.
    - `fields` (string) — nullable
    - `id` (string)
      The identifier for the connector. To retrieve connector IDs, use the find connectors API.
    - `name` (string)
      The name of the connector.
    - `type` (enum)
      The type of connector.
      Values: `.cases-webhook`
  - **Cases_connector_properties_jira** (`type: .jira`)
    Defines properties for connectors when type is `.jira`.
    - `fields` (object)
      An object containing the connector fields. If you want to omit any individual field, specify null as its value.
      - `issueType` (string) — nullable
        The type of issue.
      - `parent` (string) — nullable
        The key of the parent issue, when the issue type is sub-task.
      - `priority` (string) — nullable
        The priority of the issue.
    - `id` (string)
      The identifier for the connector. To retrieve connector IDs, use the find connectors API.
    - `name` (string)
      The name of the connector.
    - `type` (enum)
      The type of connector.
      Values: `.jira`
  - **Cases_connector_properties_resilient** (`type: .resilient`)
    Defines properties for connectors when type is `.resilient`.
    - `fields` (object) — nullable
      An object containing the connector fields. If you want to omit any individual field, specify null as its value.
      - `issueTypes` ([] string)
        The type of incident.
      - `severityCode` (string)
        The severity code of the incident.
    - `id` (string)
      The identifier for the connector.
    - `name` (string)
      The name of the connector.
    - `type` (enum)
      The type of connector.
      Values: `.resilient`
  - **Cases_connector_properties_servicenow** (`type: .servicenow`)
    Defines properties for connectors when type is `.servicenow`.
    - `fields` (object)
      An object containing the connector fields. If you want to omit any individual field, specify null as its value.
      - `category` (string) — nullable
        The category of the incident.
      - `impact` (string) — nullable
        The effect an incident had on business.
      - `severity` (string) — nullable
        The severity of the incident.
      - `subcategory` (string) — nullable
        The subcategory of the incident.
      - `urgency` (string) — nullable
        The extent to which the incident resolution can be delayed.
    - `id` (string)
      The identifier for the connector. To retrieve connector IDs, use the find connectors API.
    - `name` (string)
      The name of the connector.
    - `type` (enum)
      The type of connector.
      Values: `.servicenow`
  - **Cases_connector_properties_servicenow_sir** (`type: .servicenow-sir`)
    Defines properties for connectors when type is `.servicenow-sir`.
    - `fields` (object)
      An object containing the connector fields. If you want to omit any individual field, specify null as its value.
      - `category` (string) — nullable
        The category of the incident.
      - `destIp` (boolean) — nullable
        Indicates whether cases will send a comma-separated list of destination IPs.
      - `malwareHash` (boolean) — nullable
        Indicates whether cases will send a comma-separated list of malware hashes.
      - `malwareUrl` (boolean) — nullable
        Indicates whether cases will send a comma-separated list of malware URLs.
      - `priority` (string) — nullable
        The priority of the issue.
      - `sourceIp` (boolean) — nullable
        Indicates whether cases will send a comma-separated list of source IPs.
      - `subcategory` (string) — nullable
        The subcategory of the incident.
    - `id` (string)
      The identifier for the connector. To retrieve connector IDs, use the find connectors API.
    - `name` (string)
      The name of the connector.
    - `type` (enum)
      The type of connector.
      Values: `.servicenow-sir`
  - **Cases_connector_properties_swimlane** (`type: .swimlane`)
    Defines properties for connectors when type is `.swimlane`.
    - `fields` (object)
      An object containing the connector fields. If you want to omit any individual field, specify null as its value.
      - `caseId` (string) — nullable
        The case identifier for Swimlane connectors.
    - `id` (string)
      The identifier for the connector. To retrieve connector IDs, use the find connectors API.
    - `name` (string)
      The name of the connector.
    - `type` (enum)
      The type of connector.
      Values: `.swimlane`
- `created_at` (string)
- `created_by` ({})
  - `email` (string) — nullable
  - `full_name` (string) — nullable
  - `profile_uid` (string)
  - `username` (string) — nullable
- `customFields` ([] object)
  Custom field values for the case.
  - `key` (string)
    The unique identifier for the custom field. The key value must exist in the case configuration settings.
  - `type` (enum)
    The custom field type. It must match the type specified in the case configuration settings.
    Values: `text`, `toggle`
  - `value` (union string | boolean) — nullable
    The custom field value. If the custom field is required, it cannot be explicitly set to null. However, for cases that existed when the required custom field was added, the default value stored in Elasticsearch is `undefined`. The value returned in the API and user interface in this case is `null`.
- `description` (string)
- `duration` (integer) — nullable
  The elapsed time from the creation of the case to its closure (in seconds). If the case has not been closed, the duration is set to null. If the case was closed after less than half a second, the duration is rounded down to zero.
- `extended_fields` (map string to string)
  The case's stored field values, keyed by storage key (for example `priority_as_keyword`).
- `external_service` ({}) — nullable
  - `connector_id` (string)
  - `connector_name` (string)
  - `external_id` (string)
  - `external_title` (string)
  - `external_url` (string)
  - `pushed_at` (string)
  - `pushed_by` (object) — nullable
    - `email` (string) — nullable
    - `full_name` (string) — nullable
    - `profile_uid` (string)
    - `username` (string) — nullable
- `id` (string)
- `incremental_id` (integer) — nullable
  A monotonically increasing number assigned to each case, unique per space. This value is generated asynchronously after the case is created and may not be present immediately in the response.
- `observables` ([] object)
  Observables attached to the case.
  - `createdAt` (string)
    When the observable was created.
  - `description` (string) — nullable
    An optional description for the observable.
  - `id` (string)
    The observable identifier.
  - `typeKey` (string)
    The observable type key.
  - `updatedAt` (string) — nullable
    When the observable was last updated.
  - `value` (string)
    The observable value.
- `owner` (enum)
  The application that owns the cases: Stack Management, Observability, or Elastic Security.
  Values: `cases`, `observability`, `securitySolution`
- `settings` ({})
  An object that contains the case settings.
  - `extractObservables` (boolean)
    When true, observables (for example, IPs, hashes, and URLs) are automatically extracted from case comments. When omitted on create, the space configuration default is used. Falls back to the owner's default when no space configuration exists: `true` for Security, `false` for Stack and Observability. Precedence: explicit value > template setting > space config > owner default. For owners that do not support observable extraction (currently Observability), an omitted value resolves to `false` regardless of the space configuration.
  - `syncAlerts` (boolean)
    Turns alert syncing on or off.
- `severity` (enum)
  The severity of the case.
  Values: `critical`, `high`, `low`, `medium`
- `status` (enum)
  The status of the case.
  Values: `closed`, `in-progress`, `open`
- `tags` ([] string)
- `title` (string)
- `total_observables` (integer) — nullable
  The number of observables attached to the case.
- `totalAlerts` (integer)
- `totalComment` (integer)
- `totalEvents` (integer)
  The number of events attached to the case.
- `updated_at` (string) — nullable
- `updated_by` ({}) — nullable
  - `email` (string) — nullable
  - `full_name` (string) — nullable
  - `profile_uid` (string)
  - `username` (string) — nullable
- `version` (string)
#### `401`

Authorization information is missing or invalid.

`application/json`

- `error` (string)
- `message` (string)
- `statusCode` (integer)
## Code Examples

#### Console

```console
POST /api/cases/{caseId}/comments
{
  "comment": "A new comment.",
  "owner": "cases",
  "type": "user"
}
```

#### curl

```curl
curl -X POST "https://{kibana_url}/api/cases/{caseId}/comments" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/json" \
  -d '{
  "comment": "A new comment.",
  "owner": "cases",
  "type": "user"
}'
```

## Response Examples

#### The add comment to case API returns a JSON object that contains details about the case and its comments.

```json
{
  "assignees": [],
  "category": "null",
  "closed_at": "null",
  "closed_by": "null",
  "comments": [
    {
      "comment": "A new comment.",
      "created_at": "2022-10-02T00:49:47.716Z",
      "created_by": {
        "email": "null",
        "full_name": "null",
        "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
        "username": "elastic"
      },
      "id": "8af6ac20-74f6-11ea-b83a-553aecdb28b6",
      "owner": "cases",
      "pushed_at": "null",
      "pushed_by": "null",
      "type": "user",
      "updated_at": "null",
      "updated_by": "null",
      "version": "WzIwNDMxLDFd"
    }
  ],
  "connector": {
    "fields": "null",
    "id": "none",
    "name": "none",
    "type": ".none"
  },
  "created_at": "2022-03-24T00:37:03.906Z",
  "created_by": {
    "email": "null",
    "full_name": "null",
    "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
    "username": "elastic"
  },
  "customFields": [
    {
      "key": "d312efda-ec2b-42ec-9e2c-84981795c581",
      "type": "text",
      "value": "Field value"
    },
    {
      "key": "fcc6840d-eb14-42df-8aaf-232201a705ec",
      "type": "toggle",
      "value": true
    }
  ],
  "description": "A case description.",
  "duration": "null",
  "external_service": "null",
  "id": "293f1bc0-74f6-11ea-b83a-553aecdb28b6",
  "observables": [],
  "owner": "cases",
  "settings": {
    "syncAlerts": false
  },
  "severity": "low",
  "status": "open",
  "tags": [
    "tag 1"
  ],
  "title": "Case title 1",
  "total_observables": 0,
  "totalAlerts": 0,
  "totalComment": 1,
  "totalEvents": 0,
  "updated_at": "2022-06-03T00:49:47.716Z",
  "updated_by": {
    "email": "null",
    "full_name": "null",
    "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
    "username": "elastic"
  },
  "version": "WzIzMzgsMV0="
}
```

#### Authorization information is missing or invalid.

```json
{
  "error": "Unauthorized",
  "message": "Unable to authenticate with the provided credentials.",
  "statusCode": 401
}
```