Update a case template

Server: https://{kibana_url}

PUT /api/cases/templates/{template_id}
PUT /s/{space_id}/api/cases/templates/{template_id}

Refer to Spaces for more information.

Fully replaces a case template. Every accepted update creates a new template version; previous versions stay retrievable with the version query parameter of the get template API, and cases keep the version they were created with. You must have the "Manage templates" sub-privilege for the Cases feature of the owning solution. Set dry_run=true to run the full validation without writing. Requires the Cases feature to be enabled in the space.

Path Parameters

template_id string · max: 36 required: The identifier for the template.

Query Parameters

dry_run boolean · default: false: When true, validates the request without updating the template and returns {"valid": true}.

Request

Responses

Indicates a successful call. Returns the new template version, or {"valid": true} for a dry run.

application/json

One of:

A case template (v2).

author string · max: 1000: The username of the template author.
definition object required: The parsed template definition.
definitionString string · max: 30000 required: The raw YAML definition string.
deletedAt string required nullable: The date the template was soft-deleted, or null if active.
description string · max: 30000: A human-readable description of the template.
fieldCount integer: The number of fields defined in the template.
fieldDefinitions [] object: Metadata about each field defined in the template.
isDefault boolean: Whether this is the default template for its owner.
isEnabled boolean: Whether the template is enabled.
isLatest boolean required: Whether this is the latest version of the template.
lastUsedAt string: The date the template was last used to create a case.
latestVersion integer required: The latest version number of this template.
name string · max: 100 required: The display name of the template.
owner string · max: 50 required: The owning solution (e.g. cases, observability, securitySolution).
tags [] object · max: 200: The words and phrases that help categorize templates. It can be an empty array.
templateId string · max: 36 required: The unique identifier of the template, shared across all versions.
templateVersion integer required: The version number of this template revision.
usageCount integer: The number of times this template has been used to create a case.

The request body, YAML definition, or template name is invalid, or a resource limit was exceeded (max 200 fields per template).

application/json

Authorization information is missing or invalid.

application/json

The user does not have the manage templates privilege for the owner.

application/json

The template was not found.

application/json

A template with the same name already exists for the owner.

application/json

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

PUT /api/cases/templates/{template_id}
{
  "definition": "name: Security incident\nseverity: high\ntags: [security]\nfields:\n  - name: priority\n    label: Priority\n    type: keyword\n    control: SELECT_BASIC\n    metadata:\n      options: [low, medium, high]\n      default: medium\n",
  "description": "Default template for security incidents.",
  "isEnabled": true,
  "name": "Security incident",
  "owner": "cases",
  "tags": [
    "security"
  ]
}

curl Shell

curl -X PUT "https://{kibana_url}/api/cases/templates/{template_id}" \
  -H "Content-Type: application/json" \
  -d '{
  "definition": "name: Security incident\nseverity: high\ntags: [security]\nfields:\n  - name: priority\n    label: Priority\n    type: keyword\n    control: SELECT_BASIC\n    metadata:\n      options: [low, medium, high]\n      default: medium\n",
  "description": "Default template for security incidents.",
  "isEnabled": true,
  "name": "Security incident",
  "owner": "cases",
  "tags": [
    "security"
  ]
}'

Response

{
  "valid": true
}

{
  "error": "Bad Request",
  "message": "A template cannot define more than 200 fields.",
  "statusCode": 400
}

{
  "error": "Unauthorized",
  "message": "Unable to authenticate with the provided credentials.",
  "statusCode": 401
}

{
  "error": "Forbidden",
  "message": "Unauthorized to access cases",
  "statusCode": 403
}

{
  "error": "Not Found",
  "message": "Saved object [cases-template/9da1ea2a-09f8-4d0e-bf9d-09bf8c9d0f42] not found",
  "statusCode": 404
}

{
  "error": "Conflict",
  "message": "Template name \u0022Security incident\u0022 already exists for owner \u0022cases\u0022",
  "statusCode": 409
}

Path Parameters

Query Parameters

Request { definition , description , isEnabled , name , owner , tags , }

Responses

Request