---
type: api
title: Add case settings
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4493/api/doc/kibana/operation/operation-setcaseconfigurationdefaultspace
resource: https://www.elastic.co/elastic/docs-builder/docs/4493/api/doc/kibana/operation/operation-setcaseconfigurationdefaultspace
products:
  - Kibana
---

# Add case settings

- Server: `https://{kibana_url}`

## Paths

- `POST` `/api/cases/configure`
- `POST` `/s/{space_id}/api/cases/configure`

## Description

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Case settings include external connection details, custom fields, and templates. Connectors are used to interface with external systems. You must create a connector before you can use it in your cases. If you set a default connector, it is automatically selected when you create cases in Kibana. If you use the create case API, however, you must still specify all of the connector details. You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on where you are creating cases.

## Authentication

- Api key: `Authorization: <value>`
  These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: `Authorization: ApiKey base64AccessApiKey`
- Basic: `Authorization: Basic <credentials>`

## Header parameters

- `kbn-xsrf` (string) — required
  Cross-site request forgery protection

## Request body

`application/json`

- `closure_type` (enum) — required
  Indicates whether a case is automatically closed when it is pushed to external systems (`close-by-pushing`) or not automatically closed (`close-by-user`).
  Values: `close-by-pushing`, `close-by-user`
- `connector` (object) — required
  An object that contains the connector configuration.
  - `fields` (object) — required — nullable
    The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to `null`.
  - `id` (string) — required
    The identifier for the connector. If you do not want a default connector, use `none`. To retrieve connector IDs, use the find connectors API.
  - `name` (string) — required
    The name of the connector. If you do not want a default connector, use `none`. To retrieve connector names, use the find connectors API.
  - `type` (enum) — required
    The type of connector.
    Values: `.cases-webhook`, `.jira`, `.none`, `.resilient`, `.servicenow`, `.servicenow-sir`, `.swimlane`
- `customFields` (object[] · min items: 0 · max items: 10) — optional — deprecated
  Custom fields case configuration. Deprecated. Use the field library (`/api/cases/field_definitions`) to manage field definitions and `extended_fields` on case create/update to set field values.
  - `defaultValue` (boolean | string) — optional
    A default value for the custom field. If the `type` is `text`, the default value must be a string. If the `type` is `toggle`, the default value must be boolean.
  - `key` (string · min length: 1 · max length: 36) — required
    A unique key for the custom field. Must be lower case and composed only of a-z, 0-9, '_', and '-' characters. It is used in API calls to refer to a specific custom field.
  - `label` (string · min length: 1 · max length: 50) — required
    The custom field label that is displayed in the case.
  - `type` (enum) — required
    The type of the custom field.
    Values: `text`, `toggle`
  - `required` (boolean) — required
    Indicates whether the field is required. If `false`, the custom field can be set to null or omitted when a case is created or updated.
- `extractObservables` (boolean) — optional
  Indicates whether observables (for example, IPs, hashes, and URLs) are automatically extracted from case comments and events. When omitted, defaults to the owner's default: `true` for Security, `false` for Stack and Observability. For owners that do not support observable extraction (currently Observability), setting this to `true` has no effect on case creation; new cases for those owners always use `false`.
- `owner` (enum) — required
  The application that owns the cases: Stack Management, Observability, or Elastic Security.
  Values: `cases`, `observability`, `securitySolution`
- `templates` (object[]) — optional — deprecated
  Configuration-embedded templates. Deprecated: use the templates API (`GET /api/cases/templates`) and case `extended_fields` instead.
  - `caseFields` (object) — optional
    - `assignees` (object[] · max items: 10) — optional — nullable
      An array containing users that are assigned to the case.
      - `uid` (string) — required
        A unique identifier for the user profile. These identifiers can be found by using the suggest user profile API.
    - `category` (string · max length: 50) — optional
      A word or phrase that categorizes the case.
    - `connector` (object) — optional
      - `fields` (object) — optional — nullable
        The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to `null`.
      - `id` (string) — optional
        The identifier for the connector. If you do not want a default connector, use `none`. To retrieve connector IDs, use the find connectors API.
      - `name` (string) — optional
        The name of the connector. If you do not want a default connector, use `none`. To retrieve connector names, use the find connectors API.
      - `type` (enum) — optional
        The type of connector.
        Values: `.cases-webhook`, `.jira`, `.none`, `.resilient`, `.servicenow`, `.servicenow-sir`, `.swimlane`
    - `customFields` (object[]) — optional
      Custom field values in the template.
      - `key` (string) — optional
        The unique key for the custom field.
      - `type` (enum) — optional
        The type of the custom field.
        Values: `text`, `toggle`
      - `value` (boolean | string) — optional
        The default value for the custom field when a case uses the template. If the `type` is `text`, the default value must be a string. If the `type` is `toggle`, the default value must be boolean.
    - `description` (string · max length: 30000) — optional
      The description for the case.
    - `settings` (object) — optional
      An object that contains the case settings.
      - `extractObservables` (boolean) — optional
        When true, observables (for example, IPs, hashes, and URLs) are automatically extracted from case comments. When omitted on create, the space configuration default is used. Falls back to the owner's default when no space configuration exists: `true` for Security, `false` for Stack and Observability. Precedence: explicit value > template setting > space config > owner default. For owners that do not support observable extraction (currently Observability), an omitted value resolves to `false` regardless of the space configuration.
      - `syncAlerts` (boolean) — required
        Turns alert syncing on or off.
    - `severity` (enum) — optional
      The severity of the case.
      Values: `critical`, `high`, `low`, `medium`
    - `tags` (string[] · max items: 200) — optional
      The words and phrases that help categorize cases. It can be an empty array.
    - `title` (string · max length: 160) — optional
      A title for the case.
  - `description` (string) — optional
    A description for the template.
  - `key` (string) — optional
    A unique key for the template. Must be lower case and composed only of a-z, 0-9, '_', and '-' characters. It is used in API calls to refer to a specific template.
  - `name` (string) — optional
    The name of the template.
  - `tags` (string[] · max items: 200) — optional
    The words and phrases that help categorize templates. It can be an empty array.
- `workflowTags` (string[] · max items: 100) — optional
  Workflow tags that limit which workflows appear in Cases workflow selectors. An empty array shows all workflows.

## Responses

#### `200`

Indicates a successful call.

`application/json`

- `closure_type` (enum)
  Indicates whether a case is automatically closed when it is pushed to external systems (`close-by-pushing`) or not automatically closed (`close-by-user`).
  Values: `close-by-pushing`, `close-by-user`
- `connector` (object)
  - `fields` (object) — nullable
    The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to `null`.
  - `id` (string)
    The identifier for the connector. If you do not want a default connector, use `none`. To retrieve connector IDs, use the find connectors API.
  - `name` (string)
    The name of the connector. If you do not want a default connector, use `none`. To retrieve connector names, use the find connectors API.
  - `type` (enum)
    The type of connector.
    Values: `.cases-webhook`, `.jira`, `.none`, `.resilient`, `.servicenow`, `.servicenow-sir`, `.swimlane`
- `created_at` (string · format: date-time)
- `created_by` (object)
  - `email` (string) — nullable
  - `full_name` (string) — nullable
  - `profile_uid` (string)
  - `username` (string) — nullable
- `customFields` (object[]) — deprecated
  Custom fields configuration details. Deprecated. Use the field library (`/api/cases/field_definitions`) to manage field definitions and `extended_fields` on case create/update to set field values.
  - `defaultValue` (boolean | string)
    A default value for the custom field. If the `type` is `text`, the default value must be a string. If the `type` is `toggle`, the default value must be boolean.
  - `key` (string · min length: 1 · max length: 36)
    A unique key for the custom field. Must be lower case and composed only of a-z, 0-9, '_', and '-' characters. It is used in API calls to refer to a specific custom field.
  - `label` (string · min length: 1 · max length: 50)
    The custom field label that is displayed in the case.
  - `type` (enum)
    The type of the custom field.
    Values: `text`, `toggle`
  - `required` (boolean)
    Indicates whether the field is required. If `false`, the custom field can be set to null or omitted when a case is created or updated.
- `error` (string) — nullable
- `extractObservables` (boolean)
  Indicates whether observables (for example, IPs, hashes, and URLs) are automatically extracted from case comments and events.
- `id` (string)
- `mappings` (object[])
  - `action_type` (string)
  - `source` (string)
  - `target` (string)
- `observableTypes` (object[])
  Custom observable type configuration details.
  - `key` (string)
    The observable type key.
  - `label` (string)
    The observable type label.
- `owner` (enum)
  The application that owns the cases: Stack Management, Observability, or Elastic Security.
  Values: `cases`, `observability`, `securitySolution`
- `templates` (object[]) — deprecated
  Configuration-embedded templates. Deprecated: use the templates API (`GET /api/cases/templates`) and case `extended_fields` instead.
  Same fields as `templates`
- `updated_at` (string · format: date-time) — nullable
- `updated_by` (object) — nullable
  - `email` (string) — nullable
  - `full_name` (string) — nullable
  - `profile_uid` (string)
  - `username` (string) — nullable
- `version` (string)
- `workflowTags` (string[] · max items: 100)
  Workflow tags that limit which workflows appear in Cases workflow selectors. An empty array shows all workflows.
#### `401`

Authorization information is missing or invalid.

`application/json`

- `error` (string)
- `message` (string)
- `statusCode` (integer)
## Code examples

#### Console

```console
POST kbn:/api/cases/configure
{
  "closure_type": "close-by-user",
  "connector": {
    "fields": "null",
    "id": "5e656730-e1ca-11ec-be9b-9b1838238ee6",
    "name": "my-jira-connector",
    "type": ".jira"
  },
  "customFields": [
    {
      "defaultValue": "My custom field default value.",
      "key": "d312efda-ec2b-42ec-9e2c-84981795c581",
      "label": "my-text-field",
      "type": "text",
      "required": false
    }
  ],
  "owner": "cases",
  "templates": [
    {
      "caseFields": {
        "assignees": [
          {
            "uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0"
          }
        ],
        "category": "Default-category",
        "customFields": [
          {
            "key": "d312efda-ec2b-42ec-9e2c-84981795c581",
            "type": "text",
            "value": "A text field value for the template."
          }
        ],
        "description": "A default description for cases.",
        "tags": [
          "Default case tag"
        ],
        "title": "Default case title"
      },
      "description": "A description of the template.",
      "key": "505932fe-ee3a-4960-a661-c781b5acdb05",
      "name": "template-1",
      "tags": [
        "Template tag 1"
      ]
    }
  ],
  "workflowTags": [
    "soc-triage"
  ]
}
```

#### curl

```curl
curl -X POST "${KIBANA_URL}/api/cases/configure" \
  -H "kbn-xsrf: true" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "closure_type": "close-by-user",
    "connector": {
      "fields": "null",
      "id": "5e656730-e1ca-11ec-be9b-9b1838238ee6",
      "name": "my-jira-connector",
      "type": ".jira"
    },
    "customFields": [
      {
        "defaultValue": "My custom field default value.",
        "key": "d312efda-ec2b-42ec-9e2c-84981795c581",
        "label": "my-text-field",
        "type": "text",
        "required": false
      }
    ],
    "owner": "cases",
    "templates": [
      {
        "caseFields": {
          "assignees": [
            {
              "uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0"
            }
          ],
          "category": "Default-category",
          "customFields": [
            {
              "key": "d312efda-ec2b-42ec-9e2c-84981795c581",
              "type": "text",
              "value": "A text field value for the template."
            }
          ],
          "description": "A default description for cases.",
          "tags": [
            "Default case tag"
          ],
          "title": "Default case title"
        },
        "description": "A description of the template.",
        "key": "505932fe-ee3a-4960-a661-c781b5acdb05",
        "name": "template-1",
        "tags": [
          "Template tag 1"
        ]
      }
    ],
    "workflowTags": [
      "soc-triage"
    ]
  }'
```

## Response examples

#### This is an example response for case settings.

```json
{
  "closure_type": "close-by-user",
  "connector": {
    "fields": "null",
    "id": "5e656730-e1ca-11ec-be9b-9b1838238ee6",
    "name": "my-jira-connector",
    "type": ".jira"
  },
  "created_at": "2024-07-01T17:07:17.767Z",
  "created_by": {
    "email": "null,",
    "full_name": "null",
    "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
    "username": "elastic"
  },
  "customFields": [
    {
      "defaultValue": "My custom field default value.",
      "key": "d312efda-ec2b-42ec-9e2c-84981795c581",
      "label": "my-text-field",
      "type": "text",
      "required": false
    }
  ],
  "error": "null",
  "extractObservables": true,
  "id": "4a97a440-e1cd-11ec-be9b-9b1838238ee6",
  "mappings": [
    {
      "action_type": "overwrite",
      "source": "title",
      "target": "summary"
    },
    {
      "action_type": "overwrite",
      "source": "description",
      "target": "description"
    },
    {
      "action_type": "append",
      "source": "comments",
      "target": "comments"
    },
    {
      "action_type": "overwrite",
      "source": "tags",
      "target": "labels"
    }
  ],
  "owner": "cases",
  "templates": [
    {
      "caseFields": {
        "assignees": [
          {
            "uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0"
          }
        ],
        "category": "Default-category",
        "customFields": [
          {
            "key": "d312efda-ec2b-42ec-9e2c-84981795c581",
            "type": "text",
            "value": "A text field value for the template."
          }
        ],
        "description": "A default description for cases.",
        "tags": [
          "Default case tag"
        ],
        "title": "Default case title"
      },
      "description": "A description of the template.",
      "key": "505932fe-ee3a-4960-a661-c781b5acdb05",
      "name": "template-1",
      "tags": [
        "Template tag 1"
      ]
    }
  ],
  "updated_at": "null",
  "updated_by": "null",
  "version": "WzIwNzMsMV0=",
  "workflowTags": [
    "soc-triage"
  ]
}
```

#### Authorization information is missing or invalid.

```json
{
  "error": "Unauthorized",
  "message": "Unable to authenticate with the provided credentials.",
  "statusCode": 401
}
```