Add a case comment or alert

Base URL: https://{kibana_url}

POST /api/cases/{caseId}/comments
POST /s/{space_id}/api/cases/{caseId}/comments

Refer to Spaces for more information.

You must have all privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're creating. NOTE: Each case can have a maximum of 1,000 alerts.

Authentication

Api key

Authorization: <value>

These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64AccessApiKey

Basic

Authorization: Basic <credentials>

Path parameters

Header parameters

Request body

One of:

type: alert

Defines properties for case comment requests when type is alert.

type enum required: The type of comment.; Values: alert
alertId union oneOf required: The alert identifiers. It is required only when type is alert. You can use an array of strings to add multiple alerts to a case, provided that they all relate to the same rule; index must also be an array with the same length or number of elements. Adding multiple alerts in this manner is recommended rather than calling the API multiple times. This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.; One of: string[] or string
index union oneOf required: The alert indices. It is required only when type is alert. If you are adding multiple alerts to a case, use an array of strings; the position of each index name in the array must match the position of the corresponding alert identifier in the alertId array. This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.; One of: string[] or string
owner enum required: The application that owns the cases: Stack Management, Observability, or Elastic Security.; Values: cases observability securitySolution
rule object required: The rule that is associated with the alerts. It is required only when type is alert. This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.

Responses

Indicates a successful call.

application/json

assignees object[] · max items: 10 nullable: An array containing users that are assigned to the case.
category string nullable: The case category.
closed_at string · format: date-time required nullable
closed_by object required nullable
comments union oneOf[] · max items: 10000 required: An array of comment objects for the case.; One of:
connector union oneOf required: One of: (determined by type)
created_at string · format: date-time required
created_by object required
customFields object[]: Custom field values for the case.
description string required
duration integer required nullable: The elapsed time from the creation of the case to its closure (in seconds). If the case has not been closed, the duration is set to null. If the case was closed after less than half a second, the duration is rounded down to zero.
extended_fields map string to string: The case's stored field values, keyed by storage key (for example priority_as_keyword).
external_service object required nullable
id string required
incremental_id integer nullable: A monotonically increasing number assigned to each case, unique per space. This value is generated asynchronously after the case is created and may not be present immediately in the response.
observables object[] required: Observables attached to the case.
owner enum required: The application that owns the cases: Stack Management, Observability, or Elastic Security.; Values: cases observability securitySolution
settings object required: An object that contains the case settings.
severity enum required: The severity of the case.; Values: critical high low medium
status enum required: The status of the case.; Values: closed in-progress open
tags string[] required
title string required
total_observables integer required nullable: The number of observables attached to the case.
totalAlerts integer required
totalComment integer required
totalEvents integer: The number of events attached to the case.
updated_at string · format: date-time required nullable
updated_by object required nullable
version string required

Authorization information is missing or invalid.

application/json

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST kbn:/api/cases/9c235210-6834-11ea-a78c-6ffb38a34414/comments
{
  "comment": "A new comment.",
  "owner": "cases",
  "type": "user"
}

Generated from the API spec

curl Shell

curl -X POST "${KIBANA_URL}/api/cases/9c235210-6834-11ea-a78c-6ffb38a34414/comments" \
  -H "kbn-xsrf: true" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "comment": "A new comment.",
    "owner": "cases",
    "type": "user"
  }'

Generated from the API spec

Response

{
  "assignees": [],
  "category": "null",
  "closed_at": "null",
  "closed_by": "null",
  "comments": [
    {
      "comment": "A new comment.",
      "created_at": "2022-10-02T00:49:47.716Z",
      "created_by": {
        "email": "null",
        "full_name": "null",
        "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
        "username": "elastic"
      },
      "id": "8af6ac20-74f6-11ea-b83a-553aecdb28b6",
      "owner": "cases",
      "pushed_at": "null",
      "pushed_by": "null",
      "type": "user",
      "updated_at": "null",
      "updated_by": "null",
      "version": "WzIwNDMxLDFd"
    }
  ],
  "connector": {
    "fields": "null",
    "id": "none",
    "name": "none",
    "type": ".none"
  },
  "created_at": "2022-03-24T00:37:03.906Z",
  "created_by": {
    "email": "null",
    "full_name": "null",
    "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
    "username": "elastic"
  },
  "customFields": [
    {
      "key": "d312efda-ec2b-42ec-9e2c-84981795c581",
      "type": "text",
      "value": "Field value"
    },
    {
      "key": "fcc6840d-eb14-42df-8aaf-232201a705ec",
      "type": "toggle",
      "value": true
    }
  ],
  "description": "A case description.",
  "duration": "null",
  "external_service": "null",
  "id": "293f1bc0-74f6-11ea-b83a-553aecdb28b6",
  "observables": [],
  "owner": "cases",
  "settings": {
    "syncAlerts": false
  },
  "severity": "low",
  "status": "open",
  "tags": [
    "tag 1"
  ],
  "title": "Case title 1",
  "total_observables": 0,
  "totalAlerts": 0,
  "totalComment": 1,
  "totalEvents": 0,
  "updated_at": "2022-06-03T00:49:47.716Z",
  "updated_by": {
    "email": "null",
    "full_name": "null",
    "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
    "username": "elastic"
  },
  "version": "WzIzMzgsMV0="
}

{
  "error": "Unauthorized",
  "message": "Unable to authenticate with the provided credentials.",
  "statusCode": 401
}