Create a case template
- Base URL
-
https://{kibana_url}
- POST /api/cases/templates
- POST /s/{space_id}/api/cases/templates
Refer to Spaces for more information.
Creates a case template from a YAML definition. You must have the "Manage templates" sub-privilege for the Cases feature of the owning solution. Set dry_run=true to run the full validation (body, YAML definition, name uniqueness, authorization) without creating anything. Requires the Cases feature to be enabled in the space.
Request body
-
definitionstring · max length: 30000required -
The template definition as a YAML string: case defaults (name, severity, category, tags, assignees, connector, settings) and a
fieldsarray of inline field definitions or$refentries pointing into the owner's field library. Stored field values appear on cases underextended_fieldskeys shaped<field_name>_as_<storage_type>. -
namestring · min length: 1 · max length: 50 -
The template identity name, unique per owner (case-insensitive). May be omitted when the YAML definition provides a case-default title (
name:), which is then used as the identity name. -
ownerrequired -
The application that owns the cases: Stack Management, Observability, or Elastic Security.
-
Values:
casesobservabilitysecuritySolution -
The words and phrases that help categorize templates. It can be an empty array.
Responses
Indicates a successful call. Returns the created template, or {"valid": true} for a dry run.
The request body, YAML definition, or template name is invalid, or a resource limit was exceeded (max 200 templates per owner, max 200 fields per template).
Authorization information is missing or invalid.
The user does not have the manage templates privilege for the owner.