---
type: api
title: Update cases
description: You must have `all` privileges for the **Cases** feature in the  **Management**, **Observability**, or **Security** section of the Kibana  feature privileges, depending on the owner of the case you're updating.
url: https://www.elastic.co/elastic/docs-builder/docs/4493/api/doc/kibana/v0/operation/operation-updatecasedefaultspace
resource: https://www.elastic.co/elastic/docs-builder/docs/4493/api/doc/kibana/v0/operation/operation-updatecasedefaultspace
products:
  - Kibana
---

# Update cases

- Server: `https://{kibana_url}`

## Paths

- `PATCH` `/api/cases`

## Description

You must have `all` privileges for the **Cases** feature in the  **Management**, **Observability**, or **Security** section of the Kibana  feature privileges, depending on the owner of the case you're updating.

## Authentication

- Api key: `Authorization: <value>`
  These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: `Authorization: ApiKey base64AccessApiKey`
- Basic: `Authorization: Basic <credentials>`

## Header parameters

- `kbn-xsrf` (string) — required
  Cross-site request forgery protection

## Request body

`application/json`

- `cases` (object[] · min items: 1 · max items: 100) — required
  An array containing one or more case objects.
  - `assignees` (object[] · max items: 10) — optional — nullable
    An array containing users that are assigned to the case.
    - `uid` (string) — required
      A unique identifier for the user profile. These identifiers can be found by using the suggest user profile API.
  - `category` (string · max length: 50) — optional
    A word or phrase that categorizes the case.
  - `closeReason` (union oneOf) — optional
    The close reason to sync to attached alerts when closing the case. Can be one of following predefined reasons: [false_positive, duplicate, true_positive, benign_positive, automated_closure, other] or a custom reason provided by the user.
    Values: `false_positive`, `duplicate`, `true_positive`, `benign_positive`, `automated_closure`, `other`
  - `connector` (union oneOf) — optional
    - **Create or update case request properties for no connector**
      Defines properties for connectors when type is `.none`.
      - `type` (enum) — required
        The type of connector. To create a case without a connector, use `.none`. To update a case to remove the connector, specify `.none`.
        Values: `.none`
      - `fields` (string) — required — nullable
        An object containing the connector fields. To create a case without a connector, specify null. To update a case to remove the connector, specify null.
      - `id` (string) — required
        The identifier for the connector. To create a case without a connector, use `none`. To update a case to remove the connector, specify `none`.
      - `name` (string) — required
        The name of the connector. To create a case without a connector, use `none`. To update a case to remove the connector, specify `none`.
    - **Create or upate case request properties for Cases Webhook connector**
      Defines properties for connectors when type is `.cases-webhook`.
      - `type` (enum) — required
        The type of connector.
        Values: `.cases-webhook`
      - `fields` (string) — required — nullable
      - `id` (string) — required
        The identifier for the connector. To retrieve connector IDs, use the find connectors API.
      - `name` (string) — required
        The name of the connector.
    - **Create or update case request properties for a Jira connector**
      Defines properties for connectors when type is `.jira`.
      - `type` (enum) — required
        The type of connector.
        Values: `.jira`
      - `fields` (object) — required
        An object containing the connector fields. If you want to omit any individual field, specify null as its value.
        - `issueType` (string) — required — nullable
          The type of issue.
        - `parent` (string) — required — nullable
          The key of the parent issue, when the issue type is sub-task.
        - `priority` (string) — required — nullable
          The priority of the issue.
      - `id` (string) — required
        The identifier for the connector. To retrieve connector IDs, use the find connectors API.
      - `name` (string) — required
        The name of the connector.
    - **Create case request properties for a IBM Resilient connector**
      Defines properties for connectors when type is `.resilient`.
      - `type` (enum) — required
        The type of connector.
        Values: `.resilient`
      - `fields` (object) — required — nullable
        An object containing the connector fields. If you want to omit any individual field, specify null as its value.
        - `issueTypes` (string[]) — required
          The type of incident.
        - `severityCode` (string) — required
          The severity code of the incident.
      - `id` (string) — required
        The identifier for the connector.
      - `name` (string) — required
        The name of the connector.
    - **Create case request properties for a ServiceNow ITSM connector**
      Defines properties for connectors when type is `.servicenow`.
      - `type` (enum) — required
        The type of connector.
        Values: `.servicenow`
      - `fields` (object) — required
        An object containing the connector fields. If you want to omit any individual field, specify null as its value.
        - `category` (string) — required — nullable
          The category of the incident.
        - `impact` (string) — required — nullable
          The effect an incident had on business.
        - `severity` (string) — required — nullable
          The severity of the incident.
        - `subcategory` (string) — required — nullable
          The subcategory of the incident.
        - `urgency` (string) — required — nullable
          The extent to which the incident resolution can be delayed.
      - `id` (string) — required
        The identifier for the connector. To retrieve connector IDs, use the find connectors API.
      - `name` (string) — required
        The name of the connector.
    - **Create case request properties for a ServiceNow SecOps connector**
      Defines properties for connectors when type is `.servicenow-sir`.
      - `type` (enum) — required
        The type of connector.
        Values: `.servicenow-sir`
      - `fields` (object) — required
        An object containing the connector fields. If you want to omit any individual field, specify null as its value.
        - `category` (string) — required — nullable
          The category of the incident.
        - `destIp` (boolean) — required — nullable
          Indicates whether cases will send a comma-separated list of destination IPs.
        - `malwareHash` (boolean) — required — nullable
          Indicates whether cases will send a comma-separated list of malware hashes.
        - `malwareUrl` (boolean) — required — nullable
          Indicates whether cases will send a comma-separated list of malware URLs.
        - `priority` (string) — required — nullable
          The priority of the issue.
        - `sourceIp` (boolean) — required — nullable
          Indicates whether cases will send a comma-separated list of source IPs.
        - `subcategory` (string) — required — nullable
          The subcategory of the incident.
      - `id` (string) — required
        The identifier for the connector. To retrieve connector IDs, use the find connectors API.
      - `name` (string) — required
        The name of the connector.
    - **Create case request properties for a Swimlane connector**
      Defines properties for connectors when type is `.swimlane`.
      - `type` (enum) — required
        The type of connector.
        Values: `.swimlane`
      - `fields` (object) — required
        An object containing the connector fields. If you want to omit any individual field, specify null as its value.
        - `caseId` (string) — required — nullable
          The case identifier for Swimlane connectors.
      - `id` (string) — required
        The identifier for the connector. To retrieve connector IDs, use the find connectors API.
      - `name` (string) — required
        The name of the connector.
  - `customFields` (object[] · min items: 0 · max items: 10) — optional
    Custom field values for a case. Any optional custom fields that are not specified in the request are set to null.
    - `key` (string) — required
      The unique identifier for the custom field. The key value must exist in the case configuration settings.
    - `type` (enum) — required
      The custom field type. It must match the type specified in the case configuration settings.
      Values: `text`, `toggle`
    - `value` (union string | boolean) — required — nullable
      The custom field value. If the custom field is required, it cannot be explicitly set to null. However, for cases that existed when the required custom field was added, the default value stored in Elasticsearch is `undefined`. The value returned in the API and user interface in this case is `null`.
  - `description` (string · max length: 30000) — optional
    The description for the case.
  - `extended_fields` (map string to string · max properties: 500) — optional
    Case field values keyed by storage key. Keys follow the `<field_name>_as_<storage_type>` convention (for example `priority_as_keyword`) and map to the owner's global (library-wide) fields plus, when a template is applied to the case, that template's fields. On update, the keys provided are merged into the stored map; unlisted keys are left untouched. To discover the writable keys, use the get case fields API (`GET /api/cases/fields`).
    Map values (string · max length: 30000)
  - `id` (string · max length: 30000) — required
    The identifier for the case.
  - `settings` (object) — optional
    An object that contains the case settings.
    - `extractObservables` (boolean) — optional
      When true, observables (e.g. IPs, hashes, URLs) are automatically extracted from case comments. Optional; defaults to false when omitted.
    - `syncAlerts` (boolean) — required
      Turns alert syncing on or off.
  - `severity` (enum) — optional
    The severity of the case.
    Values: `critical`, `high`, `low`, `medium`
  - `status` (enum) — optional
    The status of the case.
    Values: `closed`, `in-progress`, `open`
  - `tags` (string[] · max items: 200) — optional
    The words and phrases that help categorize cases. It can be an empty array.
  - `title` (string · max length: 160) — optional
    A title for the case.
  - `version` (string) — required
    The current version of the case. To determine this value, use the get case or search cases (`_find`) APIs.

## Responses

#### `200`

Indicates a successful call.

`application/json`

Type: `object[]`

An array; each item has these fields:

- `assignees` (object[] · max items: 10) — nullable
  An array containing users that are assigned to the case.
  - `uid` (string)
    A unique identifier for the user profile. These identifiers can be found by using the suggest user profile API.
- `category` (string) — nullable
  The case category.
- `closed_at` (string · format: date-time) — nullable
- `closed_by` (object) — nullable
  - `email` (string) — nullable
  - `full_name` (string) — nullable
  - `profile_uid` (string)
  - `username` (string) — nullable
- `comments` (union oneOf[] · max items: 10000)
  An array of comment objects for the case.
  - **Add case comment response properties for alerts**
    - `type` (enum)
      Values: `alert`
    - `alertId` (string[])
    - `created_at` (string · format: date-time)
    - `created_by` (object)
      - `email` (string) — nullable
      - `full_name` (string) — nullable
      - `profile_uid` (string)
      - `username` (string) — nullable
    - `id` (string)
    - `index` (string[])
    - `owner` (enum)
      The application that owns the cases: Stack Management, Observability, or Elastic Security.
      Values: `cases`, `observability`, `securitySolution`
    - `pushed_at` (string · format: date-time) — nullable
    - `pushed_by` (object) — nullable
      - `email` (string) — nullable
      - `full_name` (string) — nullable
      - `profile_uid` (string)
      - `username` (string) — nullable
    - `rule` (object)
      - `id` (string) — nullable
        The rule identifier.
      - `name` (string) — nullable
        The rule name.
    - `updated_at` (string · format: date-time) — nullable
    - `updated_by` (object) — nullable
      - `email` (string) — nullable
      - `full_name` (string) — nullable
      - `profile_uid` (string)
      - `username` (string) — nullable
    - `version` (string)
  - **Case response properties for event comments**
    - `type` (enum)
      Values: `event`
    - `created_at` (string · format: date-time)
    - `created_by` (object)
      - `email` (string) — nullable
      - `full_name` (string) — nullable
      - `profile_uid` (string)
      - `username` (string) — nullable
    - `eventId` (string[])
    - `id` (string)
    - `index` (string[])
    - `owner` (enum)
      The application that owns the cases: Stack Management, Observability, or Elastic Security.
      Values: `cases`, `observability`, `securitySolution`
    - `pushed_at` (string · format: date-time) — nullable
    - `pushed_by` (object) — nullable
      - `email` (string) — nullable
      - `full_name` (string) — nullable
      - `profile_uid` (string)
      - `username` (string) — nullable
    - `updated_at` (string · format: date-time) — nullable
    - `updated_by` (object) — nullable
      - `email` (string) — nullable
      - `full_name` (string) — nullable
      - `profile_uid` (string)
      - `username` (string) — nullable
    - `version` (string)
  - **Case response properties for user comments**
    - `type` (enum)
      Values: `user`
    - `comment` (string)
    - `created_at` (string · format: date-time)
    - `created_by` (object)
      - `email` (string) — nullable
      - `full_name` (string) — nullable
      - `profile_uid` (string)
      - `username` (string) — nullable
    - `id` (string)
    - `owner` (enum)
      The application that owns the cases: Stack Management, Observability, or Elastic Security.
      Values: `cases`, `observability`, `securitySolution`
    - `pushed_at` (string · format: date-time) — nullable
    - `pushed_by` (object) — nullable
      - `email` (string) — nullable
      - `full_name` (string) — nullable
      - `profile_uid` (string)
      - `username` (string) — nullable
    - `updated_at` (string · format: date-time) — nullable
    - `updated_by` (object) — nullable
      - `email` (string) — nullable
      - `full_name` (string) — nullable
      - `profile_uid` (string)
      - `username` (string) — nullable
    - `version` (string)
- `connector` (union oneOf)
  - **Create or update case request properties for no connector** (`type: .none`)
    Defines properties for connectors when type is `.none`.
    - `type` (enum)
      The type of connector. To create a case without a connector, use `.none`. To update a case to remove the connector, specify `.none`.
      Values: `.none`
    - `fields` (string) — nullable
      An object containing the connector fields. To create a case without a connector, specify null. To update a case to remove the connector, specify null.
    - `id` (string)
      The identifier for the connector. To create a case without a connector, use `none`. To update a case to remove the connector, specify `none`.
    - `name` (string)
      The name of the connector. To create a case without a connector, use `none`. To update a case to remove the connector, specify `none`.
  - **Create or upate case request properties for Cases Webhook connector** (`type: .cases-webhook`)
    Defines properties for connectors when type is `.cases-webhook`.
    - `type` (enum)
      The type of connector.
      Values: `.cases-webhook`
    - `fields` (string) — nullable
    - `id` (string)
      The identifier for the connector. To retrieve connector IDs, use the find connectors API.
    - `name` (string)
      The name of the connector.
  - **Create or update case request properties for a Jira connector** (`type: .jira`)
    Defines properties for connectors when type is `.jira`.
    - `type` (enum)
      The type of connector.
      Values: `.jira`
    - `fields` (object)
      An object containing the connector fields. If you want to omit any individual field, specify null as its value.
      - `issueType` (string) — nullable
        The type of issue.
      - `parent` (string) — nullable
        The key of the parent issue, when the issue type is sub-task.
      - `priority` (string) — nullable
        The priority of the issue.
    - `id` (string)
      The identifier for the connector. To retrieve connector IDs, use the find connectors API.
    - `name` (string)
      The name of the connector.
  - **Create case request properties for a IBM Resilient connector** (`type: .resilient`)
    Defines properties for connectors when type is `.resilient`.
    - `type` (enum)
      The type of connector.
      Values: `.resilient`
    - `fields` (object) — nullable
      An object containing the connector fields. If you want to omit any individual field, specify null as its value.
      - `issueTypes` (string[])
        The type of incident.
      - `severityCode` (string)
        The severity code of the incident.
    - `id` (string)
      The identifier for the connector.
    - `name` (string)
      The name of the connector.
  - **Create case request properties for a ServiceNow ITSM connector** (`type: .servicenow`)
    Defines properties for connectors when type is `.servicenow`.
    - `type` (enum)
      The type of connector.
      Values: `.servicenow`
    - `fields` (object)
      An object containing the connector fields. If you want to omit any individual field, specify null as its value.
      - `category` (string) — nullable
        The category of the incident.
      - `impact` (string) — nullable
        The effect an incident had on business.
      - `severity` (string) — nullable
        The severity of the incident.
      - `subcategory` (string) — nullable
        The subcategory of the incident.
      - `urgency` (string) — nullable
        The extent to which the incident resolution can be delayed.
    - `id` (string)
      The identifier for the connector. To retrieve connector IDs, use the find connectors API.
    - `name` (string)
      The name of the connector.
  - **Create case request properties for a ServiceNow SecOps connector** (`type: .servicenow-sir`)
    Defines properties for connectors when type is `.servicenow-sir`.
    - `type` (enum)
      The type of connector.
      Values: `.servicenow-sir`
    - `fields` (object)
      An object containing the connector fields. If you want to omit any individual field, specify null as its value.
      - `category` (string) — nullable
        The category of the incident.
      - `destIp` (boolean) — nullable
        Indicates whether cases will send a comma-separated list of destination IPs.
      - `malwareHash` (boolean) — nullable
        Indicates whether cases will send a comma-separated list of malware hashes.
      - `malwareUrl` (boolean) — nullable
        Indicates whether cases will send a comma-separated list of malware URLs.
      - `priority` (string) — nullable
        The priority of the issue.
      - `sourceIp` (boolean) — nullable
        Indicates whether cases will send a comma-separated list of source IPs.
      - `subcategory` (string) — nullable
        The subcategory of the incident.
    - `id` (string)
      The identifier for the connector. To retrieve connector IDs, use the find connectors API.
    - `name` (string)
      The name of the connector.
  - **Create case request properties for a Swimlane connector** (`type: .swimlane`)
    Defines properties for connectors when type is `.swimlane`.
    - `type` (enum)
      The type of connector.
      Values: `.swimlane`
    - `fields` (object)
      An object containing the connector fields. If you want to omit any individual field, specify null as its value.
      - `caseId` (string) — nullable
        The case identifier for Swimlane connectors.
    - `id` (string)
      The identifier for the connector. To retrieve connector IDs, use the find connectors API.
    - `name` (string)
      The name of the connector.
- `created_at` (string · format: date-time)
- `created_by` (object)
  - `email` (string) — nullable
  - `full_name` (string) — nullable
  - `profile_uid` (string)
  - `username` (string) — nullable
- `customFields` (object[])
  Custom field values for the case.
  - `key` (string)
    The unique identifier for the custom field. The key value must exist in the case configuration settings.
  - `type` (enum)
    The custom field type. It must match the type specified in the case configuration settings.
    Values: `text`, `toggle`
  - `value` (union string | boolean) — nullable
    The custom field value. If the custom field is required, it cannot be explicitly set to null. However, for cases that existed when the required custom field was added, the default value stored in Elasticsearch is `undefined`. The value returned in the API and user interface in this case is `null`.
- `description` (string)
- `duration` (integer) — nullable
  The elapsed time from the creation of the case to its closure (in seconds). If the case has not been closed, the duration is set to null. If the case was closed after less than half a second, the duration is rounded down to zero.
- `extended_fields` (map string to string)
  The case's stored field values, keyed by storage key (for example `priority_as_keyword`).
- `external_service` (object) — nullable
  - `connector_id` (string)
  - `connector_name` (string)
  - `external_id` (string)
  - `external_title` (string)
  - `external_url` (string)
  - `pushed_at` (string · format: date-time)
  - `pushed_by` (object) — nullable
    - `email` (string) — nullable
    - `full_name` (string) — nullable
    - `profile_uid` (string)
    - `username` (string) — nullable
- `id` (string)
- `incremental_id` (integer) — nullable
  A monotonically increasing number assigned to each case, unique per space. This value is generated asynchronously after the case is created and may not be present immediately in the response.
- `observables` (object[])
  Observables attached to the case.
  - `createdAt` (string · format: date-time)
    When the observable was created.
  - `description` (string) — nullable
    An optional description for the observable.
  - `id` (string)
    The observable identifier.
  - `typeKey` (string)
    The observable type key.
  - `updatedAt` (string · format: date-time) — nullable
    When the observable was last updated.
  - `value` (string)
    The observable value.
- `owner` (enum)
  The application that owns the cases: Stack Management, Observability, or Elastic Security.
  Values: `cases`, `observability`, `securitySolution`
- `settings` (object)
  An object that contains the case settings.
  - `extractObservables` (boolean)
    When true, observables (e.g. IPs, hashes, URLs) are automatically extracted from case comments. Optional; defaults to false when omitted.
  - `syncAlerts` (boolean)
    Turns alert syncing on or off.
- `severity` (enum)
  The severity of the case.
  Values: `critical`, `high`, `low`, `medium`
- `status` (enum)
  The status of the case.
  Values: `closed`, `in-progress`, `open`
- `tags` (string[])
- `title` (string)
- `total_observables` (integer) — nullable
  The number of observables attached to the case.
- `totalAlerts` (integer)
- `totalComment` (integer)
- `totalEvents` (integer)
  The number of events attached to the case.
- `updated_at` (string · format: date-time) — nullable
- `updated_by` (object) — nullable
  - `email` (string) — nullable
  - `full_name` (string) — nullable
  - `profile_uid` (string)
  - `username` (string) — nullable
- `version` (string)
#### `401`

Authorization information is missing or invalid.

`application/json`

- `error` (string)
- `message` (string)
- `statusCode` (integer)
## Code examples

#### Console

```console
PATCH kbn:/api/cases
{
  "cases": [
    {
      "connector": {
        "fields": {
          "issueType": "10006",
          "parent": "null",
          "priority": "null"
        },
        "id": "131d4448-abe0-4789-939d-8ef60680b498",
        "name": "My connector",
        "type": ".jira"
      },
      "customFields": [
        {
          "key": "fcc6840d-eb14-42df-8aaf-232201a705ec",
          "type": "toggle",
          "value": false
        },
        {
          "key": "d312efda-ec2b-42ec-9e2c-84981795c581",
          "type": "text",
          "value": "My new field value"
        }
      ],
      "description": "A case description.",
      "id": "a18b38a0-71b0-11ea-a0b2-c51ea50a58e2",
      "settings": {
        "extractObservables": false,
        "syncAlerts": true
      },
      "tags": [
        "tag-1"
      ],
      "version": "WzIzLDFd"
    }
  ]
}
```

#### curl

```curl
curl -X PATCH "${KIBANA_URL}/api/cases" \
  -H "kbn-xsrf: true" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "cases": [
      {
        "connector": {
          "fields": {
            "issueType": "10006",
            "parent": "null",
            "priority": "null"
          },
          "id": "131d4448-abe0-4789-939d-8ef60680b498",
          "name": "My connector",
          "type": ".jira"
        },
        "customFields": [
          {
            "key": "fcc6840d-eb14-42df-8aaf-232201a705ec",
            "type": "toggle",
            "value": false
          },
          {
            "key": "d312efda-ec2b-42ec-9e2c-84981795c581",
            "type": "text",
            "value": "My new field value"
          }
        ],
        "description": "A case description.",
        "id": "a18b38a0-71b0-11ea-a0b2-c51ea50a58e2",
        "settings": {
          "extractObservables": false,
          "syncAlerts": true
        },
        "tags": [
          "tag-1"
        ],
        "version": "WzIzLDFd"
      }
    ]
  }'
```

## Response examples

#### This is an example response when the case description, tags, and connector were updated.

```json
[
  {
    "assignees": [],
    "category": "null",
    "closed_at": "null",
    "closed_by": "null",
    "comments": [],
    "connector": {
      "fields": {
        "issueType": "10006",
        "parent": "null",
        "priority": "null"
      },
      "id": "131d4448-abe0-4789-939d-8ef60680b498",
      "name": "My connector",
      "type": ".jira"
    },
    "created_at": "2023-10-13T09:16:17.416Z",
    "created_by": {
      "email": "null",
      "full_name": "null",
      "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
      "username": "elastic"
    },
    "customFields": [
      {
        "key": "d312efda-ec2b-42ec-9e2c-84981795c581",
        "type": "text",
        "value": "My new field value"
      },
      {
        "key": "fcc6840d-eb14-42df-8aaf-232201a705ec",
        "type": "toggle",
        "value": false
      }
    ],
    "description": "A case description.",
    "duration": "null",
    "external_service": {
      "connector_id": "05da469f-1fde-4058-99a3-91e4807e2de8",
      "connector_name": "Jira",
      "external_id": "10003",
      "external_title": "IS-4",
      "external_url": "https://hms.atlassian.net/browse/IS-4",
      "pushed_at": "2023-10-13T09:20:40.672Z",
      "pushed_by": {
        "email": "null",
        "full_name": "null",
        "username": "elastic"
      }
    },
    "id": "66b9aa00-94fa-11ea-9f74-e7e108796192",
    "observables": [],
    "owner": "cases",
    "settings": {
      "extractObservables": false,
      "syncAlerts": true
    },
    "severity": "low",
    "status": "open",
    "tags": [
      "tag-1"
    ],
    "title": "Case title 1",
    "total_observables": 0,
    "totalAlerts": 0,
    "totalComment": 0,
    "totalEvents": 0,
    "updated_at": "2023-10-13T09:48:33.043Z",
    "updated_by": {
      "email": "null",
      "full_name": "null",
      "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
      "username": "elastic"
    },
    "version": "WzU0OCwxXQ=="
  }
]
```

#### Authorization information is missing or invalid.

```json
{
  "error": "Unauthorized",
  "message": "Unable to authenticate with the provided credentials.",
  "statusCode": 401
}
```