Create a case

Base URL
https://{kibana_url}
  • POST /api/cases
Auth

You must have all privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're creating.

Header parameters

kbn-xsrf string required

Cross-site request forgery protection

Request body

assignees object[] · max items: 10 nullable

An array containing users that are assigned to the case.

uid string required

A unique identifier for the user profile. These identifiers can be found by using the suggest user profile API.

category string · max length: 50

A word or phrase that categorizes the case.

connector union oneOf required
One of:

Defines properties for connectors when type is .none.

type enum required

The type of connector. To create a case without a connector, use .none. To update a case to remove the connector, specify .none.

Values: .none
fields string required nullable

An object containing the connector fields. To create a case without a connector, specify null. To update a case to remove the connector, specify null.

id string required

The identifier for the connector. To create a case without a connector, use none. To update a case to remove the connector, specify none.

name string required

The name of the connector. To create a case without a connector, use none. To update a case to remove the connector, specify none.

customFields object[] · min items: 0 · max items: 10

Custom field values for a case. Any optional custom fields that are not specified in the request are set to null.

key string required

The unique identifier for the custom field. The key value must exist in the case configuration settings.

type enum required

The custom field type. It must match the type specified in the case configuration settings.

Values: text toggle
value union string | boolean required nullable

The custom field value. If the custom field is required, it cannot be explicitly set to null. However, for cases that existed when the required custom field was added, the default value stored in Elasticsearch is undefined. The value returned in the API and user interface in this case is null.

description string · max length: 30000 required

The description for the case.

extended_fields map string to string · max properties: 500

Case field values keyed by storage key. Keys follow the <field_name>_as_<storage_type> convention (for example priority_as_keyword) and map to the owner's global (library-wide) fields plus, when a template is applied to the case, that template's fields. On update, the keys provided are merged into the stored map; unlisted keys are left untouched. To discover the writable keys, use the get case fields API (GET /api/cases/fields).

<string> string · max length: 30000
owner enum required

The application that owns the cases: Stack Management, Observability, or Elastic Security.

Values: cases observability securitySolution
settings object required

An object that contains the case settings.

extractObservables boolean

When true, observables (e.g. IPs, hashes, URLs) are automatically extracted from case comments. Optional; defaults to false when omitted.

syncAlerts boolean required

Turns alert syncing on or off.

severity enum

The severity of the case.

Values: critical high low medium
tags string[] · max items: 200 required

The words and phrases that help categorize cases. It can be an empty array.

template object nullable

A case template to create the case from. Requires the xpack.cases.templates.enabled setting. The server applies the template's case defaults (severity, category, tags, assignees, settings, connector) and its field defaults into extended_fields; any value explicitly provided in the request wins over the template default. When version is omitted, the latest version of the template is resolved and pinned on the case. To discover a template's fields before creating a case, use the get case fields API (GET /api/cases/fields).

id string required

The template identifier. Retrieve template ids with GET /api/cases/templates.

version integer · min: 1

The template version to apply. Omit to use (and pin) the latest version.

title string · max length: 160 required

A title for the case.

Responses

Indicates a successful call.

application/json
assignees object[] · max items: 10 nullable

An array containing users that are assigned to the case.

uid string required

A unique identifier for the user profile. These identifiers can be found by using the suggest user profile API.

category string nullable

The case category.

closed_at string · format: date-time required nullable
closed_by object required nullable
email string required nullable
full_name string required nullable
profile_uid string
username string required nullable
comments union oneOf[] · max items: 10000 required

An array of comment objects for the case.

One of:
type enum required
Values: alert
alertId string[]
created_at string · format: date-time
created_by object
email string required nullable
full_name string required nullable
profile_uid string
username string required nullable
id string
index string[]
owner enum

The application that owns the cases: Stack Management, Observability, or Elastic Security.

Values: cases observability securitySolution
pushed_at string · format: date-time nullable
pushed_by object nullable
email string required nullable
full_name string required nullable
profile_uid string
username string required nullable
rule object
id string nullable

The rule identifier.

name string nullable

The rule name.

updated_at string · format: date-time nullable
updated_by object nullable
email string required nullable
full_name string required nullable
profile_uid string
username string required nullable
version string
connector union oneOf required
One of: (determined by type)
type: .none

Defines properties for connectors when type is .none.

type enum required

The type of connector. To create a case without a connector, use .none. To update a case to remove the connector, specify .none.

Values: .none
fields string required nullable

An object containing the connector fields. To create a case without a connector, specify null. To update a case to remove the connector, specify null.

id string required

The identifier for the connector. To create a case without a connector, use none. To update a case to remove the connector, specify none.

name string required

The name of the connector. To create a case without a connector, use none. To update a case to remove the connector, specify none.

created_at string · format: date-time required
created_by object required
email string required nullable
full_name string required nullable
profile_uid string
username string required nullable
customFields object[]

Custom field values for the case.

key string

The unique identifier for the custom field. The key value must exist in the case configuration settings.

type enum

The custom field type. It must match the type specified in the case configuration settings.

Values: text toggle
value union string | boolean nullable

The custom field value. If the custom field is required, it cannot be explicitly set to null. However, for cases that existed when the required custom field was added, the default value stored in Elasticsearch is undefined. The value returned in the API and user interface in this case is null.

description string required
duration integer required nullable

The elapsed time from the creation of the case to its closure (in seconds). If the case has not been closed, the duration is set to null. If the case was closed after less than half a second, the duration is rounded down to zero.

extended_fields map string to string

The case's stored field values, keyed by storage key (for example priority_as_keyword).

external_service object required nullable
connector_id string
connector_name string
external_id string
external_title string
external_url string
pushed_at string · format: date-time
pushed_by object nullable
email string nullable
full_name string nullable
profile_uid string
username string nullable
id string required
incremental_id integer nullable

A monotonically increasing number assigned to each case, unique per space. This value is generated asynchronously after the case is created and may not be present immediately in the response.

observables object[] required

Observables attached to the case.

createdAt string · format: date-time required

When the observable was created.

description string required nullable

An optional description for the observable.

id string required

The observable identifier.

typeKey string required

The observable type key.

updatedAt string · format: date-time required nullable

When the observable was last updated.

value string required

The observable value.

owner enum required

The application that owns the cases: Stack Management, Observability, or Elastic Security.

Values: cases observability securitySolution
settings object required

An object that contains the case settings.

extractObservables boolean

When true, observables (e.g. IPs, hashes, URLs) are automatically extracted from case comments. Optional; defaults to false when omitted.

syncAlerts boolean required

Turns alert syncing on or off.

severity enum required

The severity of the case.

Values: critical high low medium
status enum required

The status of the case.

Values: closed in-progress open
tags string[] required
title string required
total_observables integer required nullable

The number of observables attached to the case.

totalAlerts integer required
totalComment integer required
totalEvents integer

The number of events attached to the case.

updated_at string · format: date-time required nullable
updated_by object required nullable
email string required nullable
full_name string required nullable
profile_uid string
username string required nullable
version string required

Authorization information is missing or invalid.

application/json
error string
message string
statusCode integer
Base URL
https://{kibana_url}