Create a case
- Base URL
-
https://{kibana_url}
- POST /api/cases
- POST /s/{space_id}/api/cases
Refer to Spaces for more information.
You must have all privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're creating.
Request body
-
customFieldsobject · min items: 0 · max items: 10 -
Custom field values for a case. Any optional custom fields that are not specified in the request are set to null.
-
keystringrequired -
The unique identifier for the custom field. The key value must exist in the case configuration settings.
-
typerequired -
The custom field type. It must match the type specified in the case configuration settings.
-
Values:
texttoggle -
valuestring | booleanrequired nullable -
The custom field value. If the custom field is required, it cannot be explicitly set to null. However, for cases that existed when the required custom field was added, the default value stored in Elasticsearch is
undefined. The value returned in the API and user interface in this case isnull. -
extended_fieldsmap string to string · max properties: 500 -
Case field values keyed by storage key. Keys follow the
<field_name>_as_<storage_type>convention (for examplepriority_as_keyword) and map to the owner's global (library-wide) fields plus, when a template is applied to the case, that template's fields. On update, the keys provided are merged into the stored map; unlisted keys are left untouched. To discover the writable keys, use the get case fields API (GET /api/cases/fields). -
<string>string · max length: 30000 -
ownerrequired -
The application that owns the cases: Stack Management, Observability, or Elastic Security.
-
Values:
casesobservabilitysecuritySolution -
The words and phrases that help categorize cases. It can be an empty array.
-
templateobjectnullable -
A case template to create the case from. Requires the
xpack.cases.templates.enabledsetting. The server applies the template's case defaults (severity, category, tags, assignees, settings, connector) and its field defaults intoextended_fields; any value explicitly provided in the request wins over the template default. Whenversionis omitted, the latest version of the template is resolved and pinned on the case. To discover a template's fields before creating a case, use the get case fields API (GET /api/cases/fields).
Responses
Indicates a successful call.
-
customFieldsobject -
Custom field values for the case.
-
keystring -
The unique identifier for the custom field. The key value must exist in the case configuration settings.
-
type -
The custom field type. It must match the type specified in the case configuration settings.
-
Values:
texttoggle -
valuestring | booleannullable -
The custom field value. If the custom field is required, it cannot be explicitly set to null. However, for cases that existed when the required custom field was added, the default value stored in Elasticsearch is
undefined. The value returned in the API and user interface in this case isnull. -
durationintegerrequired nullable -
The elapsed time from the creation of the case to its closure (in seconds). If the case has not been closed, the duration is set to null. If the case was closed after less than half a second, the duration is rounded down to zero.
-
extended_fieldsmap string to string -
The case's stored field values, keyed by storage key (for example
priority_as_keyword). -
incremental_idintegernullable -
A monotonically increasing number assigned to each case, unique per space. This value is generated asynchronously after the case is created and may not be present immediately in the response.
-
ownerrequired -
The application that owns the cases: Stack Management, Observability, or Elastic Security.
-
Values:
casesobservabilitysecuritySolution