Create a case template
https://{kibana_url}
- POST /api/cases/templates
Creates a case template from a YAML definition. You must have the "Manage templates" sub-privilege for the Cases feature of the owning solution. Set dry_run=true to run the full validation (body, YAML definition, name uniqueness, authorization) without creating anything. Requires the Cases feature to be enabled in the space.
Query Parameters
-
dry_runboolean · default: false When true, validates the request without creating the template and returns
{"valid": true}.
Request
-
definitionstring · max: 30000required -
The template definition as a YAML string: case defaults (name, severity, category, tags, assignees, connector, settings) and a
fieldsarray of inline field definitions or$refentries pointing into the owner's field library. Stored field values appear on cases underextended_fieldskeys shaped<field_name>_as_<storage_type>. -
descriptionstring · max: 1000 -
A description of the template.
-
isEnabledboolean · default: true -
Disabled templates are hidden from the case creation flow.
-
namestring · min: 1 · max: 50 -
The template identity name, unique per owner (case-insensitive). May be omitted when the YAML definition provides a case-default title (
name:), which is then used as the identity name. -
owner -
The application that owns the cases: Stack Management, Observability, or Elastic Security.
-
Values:
casesobservabilitysecuritySolution -
The words and phrases that help categorize templates. It can be an empty array.
Responses
Indicates a successful call. Returns the created template, or {"valid": true} for a dry run.
A case template (v2).
-
The username of the template author.
-
definitionobjectrequired -
The parsed template definition.
-
definitionStringstring · max: 30000required -
The raw YAML definition string.
-
deletedAtstringrequired nullable -
The date the template was soft-deleted, or null if active.
-
descriptionstring · max: 30000 -
A human-readable description of the template.
-
fieldCountinteger -
The number of fields defined in the template.
-
fieldDefinitionsobject -
Metadata about each field defined in the template.
-
isDefaultboolean -
Whether this is the default template for its owner.
-
isEnabledboolean -
Whether the template is enabled.
-
isLatestbooleanrequired -
Whether this is the latest version of the template.
-
lastUsedAtstring -
The date the template was last used to create a case.
-
latestVersionintegerrequired -
The latest version number of this template.
-
namestring · max: 100required -
The display name of the template.
-
ownerstring · max: 50required -
The owning solution (e.g. cases, observability, securitySolution).
-
The words and phrases that help categorize templates. It can be an empty array.
-
templateIdstring · max: 36required -
The unique identifier of the template, shared across all versions.
-
templateVersionintegerrequired -
The version number of this template revision.
-
usageCountinteger -
The number of times this template has been used to create a case.
Returned instead of the template when the request was sent with dry_run=true.
The request body, YAML definition, or template name is invalid, or a resource limit was exceeded (max 200 templates per owner, max 200 fields per template).
-
errorstring -
messagestring -
statusCodeinteger
Authorization information is missing or invalid.
-
errorstring -
messagestring -
statusCodeinteger
The user does not have the manage templates privilege for the owner.
-
errorstring -
messagestring -
statusCodeinteger
A template with the same name already exists for the owner.
-
errorstring -
messagestring -
statusCodeinteger