Update a case template

Base URL: https://{kibana_url}

PUT /api/cases/templates/{template_id}

Fully replaces a case template. Every accepted update creates a new template version; previous versions stay retrievable with the version query parameter of the get template API, and cases keep the version they were created with. You must have the "Manage templates" sub-privilege for the Cases feature of the owning solution. Set dry_run=true to run the full validation without writing. Requires the Cases feature to be enabled in the space.

Authentication

Api key

Authorization: <value>

These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64AccessApiKey

Basic

Authorization: Basic <credentials>

One of:

A case template (v2).

author string · max length: 1000: The username of the template author.
definition object required: The parsed template definition.
definitionString string · max length: 30000 required: The raw YAML definition string.
deletedAt string · format: date-time required nullable: The date the template was soft-deleted, or null if active.
description string · max length: 30000: A human-readable description of the template.
fieldCount integer: The number of fields defined in the template.
fieldDefinitions object[]: Metadata about each field defined in the template.
isDefault boolean: Whether this is the default template for its owner.
isEnabled boolean: Whether the template is enabled.
isLatest boolean required: Whether this is the latest version of the template.
lastUsedAt string · format: date-time: The date the template was last used to create a case.
latestVersion integer required: The latest version number of this template.
name string · max length: 100 required: The display name of the template.
owner string · max length: 50 required: The owning solution (e.g. cases, observability, securitySolution).
tags string[] · max items: 200: The words and phrases that help categorize templates. It can be an empty array.
templateId string · max length: 36 required: The unique identifier of the template, shared across all versions.
templateVersion integer required: The version number of this template revision.
usageCount integer: The number of times this template has been used to create a case.

The request body, YAML definition, or template name is invalid, or a resource limit was exceeded (max 200 fields per template).

application/json

Authorization information is missing or invalid.

application/json

The user does not have the manage templates privilege for the owner.

application/json

The template was not found.

application/json

A template with the same name already exists for the owner.

application/json

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

PUT kbn:/api/cases/templates/9da1ea2a-09f8-4d0e-bf9d-09bf8c9d0f42
{
  "definition": "name: Security incident\nseverity: high\ntags: [security]\nfields:\n  - name: priority\n    label: Priority\n    type: keyword\n    control: SELECT_BASIC\n    metadata:\n      options: [low, medium, high]\n      default: medium\n",
  "description": "Default template for security incidents.",
  "isEnabled": true,
  "name": "Security incident",
  "owner": "cases",
  "tags": [
    "security"
  ]
}

Generated from the API spec

curl Shell

curl -X PUT "${KIBANA_URL}/api/cases/templates/9da1ea2a-09f8-4d0e-bf9d-09bf8c9d0f42" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "definition": "name: Security incident\nseverity: high\ntags: [security]\nfields:\n  - name: priority\n    label: Priority\n    type: keyword\n    control: SELECT_BASIC\n    metadata:\n      options: [low, medium, high]\n      default: medium\n",
    "description": "Default template for security incidents.",
    "isEnabled": true,
    "name": "Security incident",
    "owner": "cases",
    "tags": [
      "security"
    ]
  }'

Generated from the API spec

Response

{
  "valid": true
}

{
  "error": "Bad Request",
  "message": "A template cannot define more than 200 fields.",
  "statusCode": 400
}

{
  "error": "Unauthorized",
  "message": "Unable to authenticate with the provided credentials.",
  "statusCode": 401
}

{
  "error": "Forbidden",
  "message": "Unauthorized to access cases",
  "statusCode": 403
}

{
  "error": "Not Found",
  "message": "Saved object [cases-template/9da1ea2a-09f8-4d0e-bf9d-09bf8c9d0f42] not found",
  "statusCode": 404
}

{
  "error": "Conflict",
  "message": "Template name \u0022Security incident\u0022 already exists for owner \u0022cases\u0022",
  "statusCode": 409
}

Update a case template

Authentication

Path parameters

Query parameters

Request body

Responses

Authentication

Path parameters

Query parameters

Request body { }

Responses

Request body