Get case information
https://{kibana_url}
- GET /api/cases/{caseId}
- GET /s/{space_id}/api/cases/{caseId}
Refer to Spaces for more information.
Returns case details. The response does not include a comments property; use the find case comments API to retrieve comments. The totalComment field reflects the actual number of user comments on the case. You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're seeking.
Path Parameters
-
caseIdstringrequired -
The identifier for the case. To retrieve case IDs, use the search cases (
_find)API. All non-ASCII characters must be URL encoded.
Responses
Indicates a successful call.
-
assigneesnull · max: 10nullable -
An array containing users that are assigned to the case.
-
uidstringrequired -
A unique identifier for the user profile. These identifiers can be found by using the suggest user profile API.
-
categorystringnullable -
The case category.
-
closed_atstringrequired nullable -
closed_by -
emailstringrequired nullable -
full_namestringrequired nullable -
profile_uidstring -
usernamestringrequired nullable -
connectoroneOfrequired -
fieldsstringrequired nullable -
An object containing the connector fields. To create a case without a connector, specify null. To update a case to remove the connector, specify null.
-
idstringrequired -
The identifier for the connector. To create a case without a connector, use
none. To update a case to remove the connector, specifynone. -
namestringrequired -
The name of the connector. To create a case without a connector, use
none. To update a case to remove the connector, specifynone. -
type -
The type of connector. To create a case without a connector, use
.none. To update a case to remove the connector, specify.none. -
Values:
.none -
fieldsobjectrequired nullable -
An object containing the connector fields. If you want to omit any individual field, specify null as its value.
-
issueTypesstringrequired -
The type of incident.
-
severityCodestringrequired -
The severity code of the incident.
-
idstringrequired -
The identifier for the connector.
-
namestringrequired -
The name of the connector.
-
fieldsobjectrequired -
An object containing the connector fields. If you want to omit any individual field, specify null as its value.
-
categorystringrequired nullable -
The category of the incident.
-
impactstringrequired nullable -
The effect an incident had on business.
-
severitystringrequired nullable -
The severity of the incident.
-
subcategorystringrequired nullable -
The subcategory of the incident.
-
urgencystringrequired nullable -
The extent to which the incident resolution can be delayed.
-
idstringrequired -
The identifier for the connector. To retrieve connector IDs, use the find connectors API.
-
namestringrequired -
The name of the connector.
-
fieldsobjectrequired -
An object containing the connector fields. If you want to omit any individual field, specify null as its value.
-
categorystringrequired nullable -
The category of the incident.
-
destIpbooleanrequired nullable -
Indicates whether cases will send a comma-separated list of destination IPs.
-
malwareHashbooleanrequired nullable -
Indicates whether cases will send a comma-separated list of malware hashes.
-
malwareUrlbooleanrequired nullable -
Indicates whether cases will send a comma-separated list of malware URLs.
-
prioritystringrequired nullable -
The priority of the issue.
-
sourceIpbooleanrequired nullable -
Indicates whether cases will send a comma-separated list of source IPs.
-
subcategorystringrequired nullable -
The subcategory of the incident.
-
idstringrequired -
The identifier for the connector. To retrieve connector IDs, use the find connectors API.
-
namestringrequired -
The name of the connector.
-
fieldsobjectrequired -
An object containing the connector fields. If you want to omit any individual field, specify null as its value.
-
caseIdstringrequired nullable -
The case identifier for Swimlane connectors.
-
idstringrequired -
The identifier for the connector. To retrieve connector IDs, use the find connectors API.
-
namestringrequired -
The name of the connector.
-
created_atstringrequired -
created_by -
emailstringrequired nullable -
full_namestringrequired nullable -
profile_uidstring -
usernamestringrequired nullable -
customFieldsobject -
Custom field values for the case.
-
keystring -
The unique identifier for the custom field. The key value must exist in the case configuration settings.
-
type -
The custom field type. It must match the type specified in the case configuration settings.
-
Values:
texttoggle -
valuestring | booleannullable -
The custom field value. If the custom field is required, it cannot be explicitly set to null. However, for cases that existed when the required custom field was added, the default value stored in Elasticsearch is
undefined. The value returned in the API and user interface in this case isnull. -
descriptionstringrequired -
durationintegerrequired nullable -
The elapsed time from the creation of the case to its closure (in seconds). If the case has not been closed, the duration is set to null. If the case was closed after less than half a second, the duration is rounded down to zero.
-
external_service -
connector_idstring -
connector_namestring -
external_idstring -
external_titlestring -
external_urlstring -
pushed_atstring -
pushed_byobjectnullable -
emailstringnullable -
full_namestringnullable -
profile_uidstring -
usernamestringnullable -
idstringrequired -
incremental_idintegernullable -
A monotonically increasing number assigned to each case, unique per space. This value is generated asynchronously after the case is created and may not be present immediately in the response.
-
observablesobjectrequired -
Observables attached to the case.
-
createdAtstringrequired -
When the observable was created.
-
descriptionstringrequired nullable -
An optional description for the observable.
-
idstringrequired -
The observable identifier.
-
typeKeystringrequired -
The observable type key.
-
updatedAtstringrequired nullable -
When the observable was last updated.
-
valuestringrequired -
The observable value.
-
owner -
The application that owns the cases: Stack Management, Observability, or Elastic Security.
-
Values:
casesobservabilitysecuritySolution -
settings -
An object that contains the case settings.
-
extractObservablesboolean -
When true, observables (for example, IPs, hashes, and URLs) are automatically extracted from case comments. When omitted on create, the space configuration default is used. Falls back to the owner's default when no space configuration exists:
truefor Security,falsefor Stack and Observability. Precedence: explicit value > template setting > space config > owner default. For owners that do not support observable extraction (currently Observability), an omitted value resolves tofalseregardless of the space configuration. -
syncAlertsbooleanrequired -
Turns alert syncing on or off.
-
titlestringrequired -
total_observablesintegerrequired nullable -
The number of observables attached to the case.
-
totalAlertsintegerrequired -
totalCommentintegerrequired -
The number of user comments on the case. Use the find case comments API to retrieve comment content.
-
totalEventsinteger -
The number of events attached to the case.
-
updated_atstringrequired nullable -
updated_by -
emailstringrequired nullable -
full_namestringrequired nullable -
profile_uidstring -
usernamestringrequired nullable -
versionstringrequired
type: .none
Defines properties for connectors when type is .none.
type: .cases-webhook
Defines properties for connectors when type is .cases-webhook.
type: .jira
Defines properties for connectors when type is .jira.
type: .resilient
Defines properties for connectors when type is .resilient.
type: .servicenow
Defines properties for connectors when type is .servicenow.
type: .servicenow-sir
Defines properties for connectors when type is .servicenow-sir.
type: .swimlane
Defines properties for connectors when type is .swimlane.
Authorization information is missing or invalid.
-
errorstring -
messagestring -
statusCodeinteger