Get the fields applicable to a case

Base URL
https://{kibana_url}
  • GET /api/cases/fields
Auth

Returns the fields you can write to a case's extended_fields when creating a case for the given owner. Includes the owner's global (library-wide) fields and, when templateId is supplied, that template's fields. Migrated legacy custom fields appear as global fields. Requires the Cases feature to be enabled in the space.

Query parameters

owner string · max length: 30 required

The application that owns the cases (for example cases, observability, or securitySolution).

Example: cases
templateId string · max length: 36

The identifier of a template to include the template's fields in the response.

Responses

Indicates a successful call.

application/json
fields object[] required
control string required

The UI control for the field, such as INPUT_TEXT, INPUT_NUMBER, SELECT_BASIC, TOGGLE, or MARKDOWN.

defaultValue string

The default value, as a string, when the field definition declares one.

displayOnly boolean required

When true the field is display-only (for example a MARKDOWN block): it is returned so the full form shape is visible, but it holds no value and its key cannot be written to extended_fields.

isGlobal boolean required

Whether the field is a global (library-wide) definition.

key string required

The storage key to write in the case extended_fields map. Follows the <field_name>_as_<storage_type> convention (for example priority_as_keyword).

label string required

The human-readable label. Falls back to name when no label is authored.

name string required

The field name as authored in the field definition.

options string[]

The allowed values for SELECT_BASIC, RADIO_GROUP, and CHECKBOX_GROUP fields.

type string required

The storage type: keyword, integer, long, boolean, or date.

required boolean required

Whether a value must be supplied at write time.

requiredOnClose boolean required

Whether the field must be filled before the case can be closed.

source enum required

Where the field comes from: global for a library-wide (isGlobal) definition writable on any case, or template for a field contributed by the applied template.

Values: global template

The request is invalid, for example when the templateId does not exist for the owner or its definition is invalid.

application/json
error string
message string
statusCode integer

Authorization information is missing or invalid.

application/json
error string
message string
statusCode integer

The user does not have access to the requested owner.

application/json
error string
message string
statusCode integer
Base URL
https://{kibana_url}