Get all field definitions

Base URL
https://{kibana_url}
  • GET /api/cases/field_definitions
  • GET /s/{space_id}/api/cases/field_definitions
Auth

Returns a paginated list of field definitions (field library entries) for the given owner. Requires the Cases feature to be enabled in the space.

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Query parameters

owner union string | string[] required

The application that owns the field definitions (for example cases, observability, or securitySolution). Required.

isGlobal boolean

When true, returns only global field definitions (rendered on every case). When false, returns all definitions. Omit to return all.

page integer · default: 1

The page number to return.

perPage integer · max: 100 · default: 20

The number of items to return. Limited to 100 items.

sortField enum

The field to sort by. When omitted, results are sorted by fieldDefinitionId ascending and sortOrder is ignored.

Values: name owner isGlobal displayOrder
sortOrder enum · default: desc

Determines the sort order.

Values: asc desc

A case-insensitive substring to match against each definition's name and description fields. Definitions where neither field contains the substring are excluded.

Responses

Indicates a successful call.

application/json
fieldDefinitions object[] required
definition string required

The field definition as a YAML string. New definitions are limited to 30 000 characters, but existing definitions created via internal tooling may be longer.

description string

Optional human-readable description of the field's purpose.

displayOrder integer · min: 0

Position of a global field in the case details view. Assigned by the server and changed via the Field Library reorder controls.

fieldDefinitionId string · max length: 36 required

Unique server-assigned identifier for the field definition (UUID). May be UUIDv4 for definitions created through the public API, or UUIDv5 for definitions created by internal migration processes.

isGlobal boolean

When true, this field is rendered in every case regardless of which template the case uses.

name string required

The field name. Must match the name property in the YAML definition and is unique per owner (case-insensitive). Immutable after creation.

owner string · max length: 50 required

The application that owns this field definition.

page integer · min: 1 required

The current page number.

perPage integer · min: 1 · max: 100 required

The number of items per page.

total integer · min: 0 required

The total number of field definitions matching the query (before pagination).

The request is invalid. For example, the owner query parameter is missing or page/perPage are not integers.

application/json
error string
message string
statusCode integer

Authorization information is missing or invalid.

application/json
error string
message string
statusCode integer

The user does not have permission to read field definitions for the owner.

application/json
error string
message string
statusCode integer
Base URL
https://{kibana_url}