Get case information
- Base URL
-
https://{kibana_url}
- GET /api/cases/{caseId}
Returns case details. The response does not include a comments property; use the find case comments API to retrieve comments. The totalComment field reflects the actual number of user comments on the case. You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're seeking.
Responses
Indicates a successful call.
-
customFieldsobject -
Custom field values for the case.
-
keystring -
The unique identifier for the custom field. The key value must exist in the case configuration settings.
-
type -
The custom field type. It must match the type specified in the case configuration settings.
-
Values:
texttoggle -
valuestring | booleannullable -
The custom field value. If the custom field is required, it cannot be explicitly set to null. However, for cases that existed when the required custom field was added, the default value stored in Elasticsearch is
undefined. The value returned in the API and user interface in this case isnull. -
durationintegerrequired nullable -
The elapsed time from the creation of the case to its closure (in seconds). If the case has not been closed, the duration is set to null. If the case was closed after less than half a second, the duration is rounded down to zero.
-
incremental_idintegernullable -
A monotonically increasing number assigned to each case, unique per space. This value is generated asynchronously after the case is created and may not be present immediately in the response.
-
ownerrequired -
The application that owns the cases: Stack Management, Observability, or Elastic Security.
-
Values:
casesobservabilitysecuritySolution -
totalCommentintegerrequired -
The number of user comments on the case. Use the find case comments API to retrieve comment content.