Create a case

Server: https://{kibana_url}

POST /api/cases
POST /s/{space_id}/api/cases

Refer to Spaces for more information.

You must have all privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're creating.

Request

assignees [] null · max: 10 nullable: An array containing users that are assigned to the case.
category string · max: 50: A word or phrase that categorizes the case.
connector union oneOf required: One of:
customFields [] object · min: 0 · max: 10: Custom field values for a case. Any optional custom fields that are not specified in the request are set to null.
description string · max: 30000 required: The description for the case.
extended_fields object: Case field values keyed by storage key. Keys follow the <field_name>_as_<storage_type> convention (for example priority_as_keyword) and map to the owner's global (library-wide) fields plus, when a template is applied to the case, that template's fields. On update, the keys provided are merged into the stored map; unlisted keys are left untouched. To discover the writable keys, use the get case fields API (GET /api/cases/fields).
owner enum required: The application that owns the cases: Stack Management, Observability, or Elastic Security.; Values: cases observability securitySolution
settings {} required: An object that contains the case settings.
severity enum: The severity of the case.; Values: critical high low medium
tags [] object · max: 200 required: The words and phrases that help categorize cases. It can be an empty array.
template object nullable: A case template to create the case from. Requires the xpack.cases.templates.enabled setting. The server applies the template's case defaults (severity, category, tags, assignees, settings, connector) and its field defaults into extended_fields; any value explicitly provided in the request wins over the template default. When version is omitted, the latest version of the template is resolved and pinned on the case. To discover a template's fields before creating a case, use the get case fields API (GET /api/cases/fields).
title string · max: 160 required: A title for the case.

Responses

Indicates a successful call.

application/json

Authorization information is missing or invalid.

application/json

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST /api/cases
{
  "connector": {
    "fields": {
      "issueType": "10006",
      "parent": "null",
      "priority": "High"
    },
    "id": "131d4448-abe0-4789-939d-8ef60680b498",
    "name": "My connector",
    "type": ".jira"
  },
  "customFields": [
    {
      "key": "d312efda-ec2b-42ec-9e2c-84981795c581",
      "type": "text",
      "value": "My field value"
    }
  ],
  "description": "A case description.",
  "owner": "cases",
  "settings": {
    "extractObservables": false,
    "syncAlerts": true
  },
  "tags": [
    "tag-1"
  ],
  "title": "Case title 1"
}

curl Shell

curl -X POST "https://{kibana_url}/api/cases" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/json" \
  -d '{
  "connector": {
    "fields": {
      "issueType": "10006",
      "parent": "null",
      "priority": "High"
    },
    "id": "131d4448-abe0-4789-939d-8ef60680b498",
    "name": "My connector",
    "type": ".jira"
  },
  "customFields": [
    {
      "key": "d312efda-ec2b-42ec-9e2c-84981795c581",
      "type": "text",
      "value": "My field value"
    }
  ],
  "description": "A case description.",
  "owner": "cases",
  "settings": {
    "extractObservables": false,
    "syncAlerts": true
  },
  "tags": [
    "tag-1"
  ],
  "title": "Case title 1"
}'

Response

{
  "assignees": [],
  "closed_at": "null",
  "closed_by": "null",
  "comments": [],
  "connector": {
    "fields": {
      "issueType": "10006",
      "parent": "null",
      "priority": "High"
    },
    "id": "131d4448-abe0-4789-939d-8ef60680b498",
    "name": "My connector",
    "type": ".jira"
  },
  "created_at": "2022-10-13T15:33:50.604Z",
  "created_by": {
    "email": "null",
    "full_name": "null",
    "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
    "username": "elastic"
  },
  "customFields": [
    {
      "key": "d312efda-ec2b-42ec-9e2c-84981795c581",
      "type": "text",
      "value": "My field value"
    },
    {
      "key": "fcc6840d-eb14-42df-8aaf-232201a705ec",
      "type": "toggle",
      "value": "null"
    }
  ],
  "description": "A case description.",
  "duration": "null",
  "external_service": "null",
  "id": "66b9aa00-94fa-11ea-9f74-e7e108796192",
  "observables": [],
  "owner": "cases",
  "settings": {
    "extractObservables": false,
    "syncAlerts": true
  },
  "severity": "low",
  "status": "open",
  "tags": [
    "tag 1"
  ],
  "title": "Case title 1",
  "total_observables": 0,
  "totalAlerts": 0,
  "totalComment": 0,
  "totalEvents": 0,
  "updated_at": "null",
  "updated_by": "null",
  "version": "WzUzMiwxXQ=="
}

{
  "error": "Unauthorized",
  "message": "Unable to authenticate with the provided credentials.",
  "statusCode": 401
}

Request { assignees , category , connector , customFields , description , extended_fields , owner , settings , severity , tags , template , title , }

Responses

Request