Search cases
- Base URL
-
https://{kibana_url}
- GET /api/cases/_find
- GET /s/{space_id}/api/cases/_find
Refer to Spaces for more information.
You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases you're seeking.
Query parameters
-
assigneesstring | string -
Filters the returned cases by assignees. Valid values are
noneor unique identifiers for the user profiles. These identifiers can be found by using the suggest user profile API. -
fromstring -
Returns only cases that were created after a specific date. The date must be specified as a KQL data range or date match expression.
-
Example:
now-1d -
owneroneOf -
A filter to limit the response to a specific set of applications. If this parameter is omitted, the response contains information about all the cases that the user has access to read.
-
Values:
casesobservabilitysecuritySolution -
reportersstring | string -
Filters the returned cases by the user name of the reporter.
-
Example:
elastic -
searchstring -
An Elasticsearch simple_query_string query that filters the objects in the response.
-
Example:
Case title 1 -
searchFieldsoneOf -
The fields to perform the simple_query_string parsed query against.
-
Values:
descriptiontitle -
sortField· default: createdAt -
Determines which field is used to sort the results.
-
Values:
createdAtupdatedAtclosedAttitlecategorystatusseverity -
Filters the returned cases by tags.
-
Example:
tag-1
Responses
Indicates a successful call.
-
casesobject · max items: 10000 -
customFieldsobjectdeprecated -
Deprecated. Use
extended_fieldsinstead. Custom field values for the case. -
keystring -
The unique identifier for the custom field. The key value must exist in the case configuration settings.
-
type -
The custom field type. It must match the type specified in the case configuration settings.
-
Values:
texttoggle -
valuestring | booleannullable -
The custom field value. If the custom field is required, it cannot be explicitly set to null. However, for cases that existed when the required custom field was added, the default value stored in Elasticsearch is
undefined. The value returned in the API and user interface in this case isnull. -
durationintegerrequired nullable -
The elapsed time from the creation of the case to its closure (in seconds). If the case has not been closed, the duration is set to null. If the case was closed after less than half a second, the duration is rounded down to zero.
-
extended_fieldsmap string to string -
The case's stored field values, keyed by storage key (for example
priority_as_keyword). -
extended_fields_labelsmap string to string -
A read-only, response-only map from active field definition storage keys to their human-readable labels. Entries reflect currently applicable global and template field definitions — not every stored
extended_fieldskey is guaranteed a label, because values retained after switching templates may have no matching current definition. Only populated by the get case and search cases endpoints; absent on create, update, push, and comment responses. Including this field in a write request returns a 400 error. -
incremental_idintegernullable -
A monotonically increasing number assigned to each case, unique per space. This value is generated asynchronously after the case is created and may not be present immediately in the response.
-
ownerrequired -
The application that owns the cases: Stack Management, Observability, or Elastic Security.
-
Values:
casesobservabilitysecuritySolution -
settingsobjectrequired -
An object that contains the case settings.
-
extractObservablesboolean -
When true, observables (for example, IPs, hashes, and URLs) are automatically extracted from case comments. When omitted on create, the space configuration default is used. Falls back to the owner's default when no space configuration exists:
truefor Security,falsefor Stack and Observability. Precedence: explicit value > template setting > space config > owner default. For owners that do not support observable extraction (currently Observability), an omitted value resolves tofalseregardless of the space configuration.