Add case settings

Base URL
https://{kibana_url}
  • POST /api/cases/configure
  • POST /s/{space_id}/api/cases/configure
Auth

Case settings include external connection details, custom fields, and templates. Connectors are used to interface with external systems. You must create a connector before you can use it in your cases. If you set a default connector, it is automatically selected when you create cases in Kibana. If you use the create case API, however, you must still specify all of the connector details. You must have all privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on where you are creating cases.

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Header parameters

kbn-xsrf string required

Cross-site request forgery protection

Request body

closure_type enum required

Indicates whether a case is automatically closed when it is pushed to external systems (close-by-pushing) or not automatically closed (close-by-user).

Values: close-by-pushing close-by-user
connector object required

An object that contains the connector configuration.

fields object required nullable

The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to null.

id string required

The identifier for the connector. If you do not want a default connector, use none. To retrieve connector IDs, use the find connectors API.

name string required

The name of the connector. If you do not want a default connector, use none. To retrieve connector names, use the find connectors API.

type enum required

The type of connector.

Values: .cases-webhook .jira .none .resilient .servicenow .servicenow-sir .swimlane
customFields object[] · min items: 0 · max items: 10

Custom fields case configuration.

defaultValue boolean | string

A default value for the custom field. If the type is text, the default value must be a string. If the type is toggle, the default value must be boolean.

key string · min length: 1 · max length: 36 required

A unique key for the custom field. Must be lower case and composed only of a-z, 0-9, '_', and '-' characters. It is used in API calls to refer to a specific custom field.

label string · min length: 1 · max length: 50 required

The custom field label that is displayed in the case.

type enum required

The type of the custom field.

Values: text toggle
required boolean required

Indicates whether the field is required. If false, the custom field can be set to null or omitted when a case is created or updated.

owner enum required

The application that owns the cases: Stack Management, Observability, or Elastic Security.

Values: cases observability securitySolution
templates object[]
caseFields object
assignees object[] · max items: 10 nullable

An array containing users that are assigned to the case.

uid string required

A unique identifier for the user profile. These identifiers can be found by using the suggest user profile API.

category string · max length: 50

A word or phrase that categorizes the case.

connector object
fields object nullable

The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to null.

id string

The identifier for the connector. If you do not want a default connector, use none. To retrieve connector IDs, use the find connectors API.

name string

The name of the connector. If you do not want a default connector, use none. To retrieve connector names, use the find connectors API.

type enum

The type of connector.

Values: .cases-webhook .jira .none .resilient .servicenow .servicenow-sir .swimlane
customFields object[]

Custom field values in the template.

key string

The unique key for the custom field.

type enum

The type of the custom field.

Values: text toggle
value boolean | string

The default value for the custom field when a case uses the template. If the type is text, the default value must be a string. If the type is toggle, the default value must be boolean.

description string · max length: 30000

The description for the case.

settings object

An object that contains the case settings.

syncAlerts boolean required

Turns alert syncing on or off.

severity enum · default: low

The severity of the case.

Values: critical high low medium
tags string[] · max items: 200

The words and phrases that help categorize cases. It can be an empty array.

title string · max length: 160

A title for the case.

description string

A description for the template.

key string

A unique key for the template. Must be lower case and composed only of a-z, 0-9, '_', and '-' characters. It is used in API calls to refer to a specific template.

name string

The name of the template.

tags string[] · max items: 200

The words and phrases that help categorize templates. It can be an empty array.

Responses

Indicates a successful call.

application/json
closure_type enum

Indicates whether a case is automatically closed when it is pushed to external systems (close-by-pushing) or not automatically closed (close-by-user).

Values: close-by-pushing close-by-user
connector object
fields object nullable

The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to null.

id string

The identifier for the connector. If you do not want a default connector, use none. To retrieve connector IDs, use the find connectors API.

name string

The name of the connector. If you do not want a default connector, use none. To retrieve connector names, use the find connectors API.

type enum

The type of connector.

Values: .cases-webhook .jira .none .resilient .servicenow .servicenow-sir .swimlane
created_at string · format: date-time
created_by object
email string required nullable
full_name string required nullable
profile_uid string
username string required nullable
customFields object[]

Custom fields configuration details.

defaultValue boolean | string

A default value for the custom field. If the type is text, the default value must be a string. If the type is toggle, the default value must be boolean.

key string · min length: 1 · max length: 36

A unique key for the custom field. Must be lower case and composed only of a-z, 0-9, '_', and '-' characters. It is used in API calls to refer to a specific custom field.

label string · min length: 1 · max length: 50

The custom field label that is displayed in the case.

type enum

The type of the custom field.

Values: text toggle
required boolean

Indicates whether the field is required. If false, the custom field can be set to null or omitted when a case is created or updated.

error string nullable
id string
mappings object[]
action_type string
source string
target string
owner enum

The application that owns the cases: Stack Management, Observability, or Elastic Security.

Values: cases observability securitySolution
templates object[]
Same fields as templates
updated_at string · format: date-time nullable
updated_by object nullable
email string required nullable
full_name string required nullable
profile_uid string
username string required nullable
version string

Authorization information is missing or invalid.

application/json
error string
message string
statusCode integer
Base URL
https://{kibana_url}