Query parameters

• owner string | array[string]

  A filter to limit the response to a specific set of applications. If this parameter is omitted, the response contains information about all the cases that the user has access to read.

  Values are cases, observability, or securitySolution.

Responses

• 200 application/json

  Indicates a successful call.

  Hide response attributes Show response attributes object

  • closure_type string

    Indicates whether a case is automatically closed when it is pushed to external systems (close-by-pushing) or not automatically closed (close-by-user).

    Values are close-by-pushing or close-by-user.

  • connector object
    Hide connector attributes Show connector attributes object

    • fields object | null

      The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to null.

    • id string

      The identifier for the connector. If you do not want a default connector, use none. To retrieve connector IDs, use the find connectors API.

    • name string

      The name of the connector. If you do not want a default connector, use none. To retrieve connector names, use the find connectors API.

    • type string

      The type of connector.

      Values are .cases-webhook, .jira, .none, .resilient, .servicenow, .servicenow-sir, or .swimlane.

  • created_at string(date-time)
  • created_by object
    Hide created_by attributes Show created_by attributes object

    • email string | null Required
    • full_name string | null Required
    • profile_uid string
    • username string | null Required
  • customFields array[object]

    Custom fields configuration details.

    Hide customFields attributes Show customFields attributes object

    • defaultValue string | boolean

      A default value for the custom field. If the type is text, the default value must be a string. If the type is toggle, the default value must be boolean.

      One of:

      string-1 string boolean-2 boolean
    • key string

      A unique key for the custom field. Must be lower case and composed only of a-z, 0-9, '_', and '-' characters. It is used in API calls to refer to a specific custom field.

      Minimum length is 1, maximum length is 36.

    • label string

      The custom field label that is displayed in the case.

      Minimum length is 1, maximum length is 50.

    • type string

      The type of the custom field.

      Values are text or toggle.

    • required boolean

      Indicates whether the field is required. If false, the custom field can be set to null or omitted when a case is created or updated.

  • error string | null
  • id string
  • mappings array[object]
    Hide mappings attributes Show mappings attributes object

    • action_type string
    • source string
    • target string
  • observableTypes array[object]

    Custom observable type configuration details.

    Hide observableTypes attributes Show observableTypes attributes object

    • key string

      The observable type key.

    • label string

      The observable type label.

  • owner string

    The application that owns the cases: Stack Management, Observability, or Elastic Security.

    Values are cases, observability, or securitySolution.

  • templates array[object] Technical preview
    Hide templates attributes Show templates attributes object

    • caseFields object
      Hide caseFields attributes Show caseFields attributes object

      • assignees array[object] | null

        An array containing users that are assigned to the case.

        Not more than 10 elements.

        Hide assignees attribute Show assignees attribute object

        • uid string Required

          A unique identifier for the user profile. These identifiers can be found by using the suggest user profile API.

      • category string

        A word or phrase that categorizes the case.

        Maximum length is 50.

      • connector object
        Hide connector attributes Show connector attributes object

        • fields object | null

          The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to null.

        • id string

          The identifier for the connector. If you do not want a default connector, use none. To retrieve connector IDs, use the find connectors API.

        • name string

          The name of the connector. If you do not want a default connector, use none. To retrieve connector names, use the find connectors API.

        • type string

          The type of connector.

          Values are .cases-webhook, .jira, .none, .resilient, .servicenow, .servicenow-sir, or .swimlane.

      • customFields array[object] Technical preview

        Custom field values in the template.

        Hide customFields attributes Show customFields attributes object

        • key string

          The unique key for the custom field.

        • type string

          The type of the custom field.

          Values are text or toggle.

        • value string | boolean

          The default value for the custom field when a case uses the template. If the type is text, the default value must be a string. If the type is toggle, the default value must be boolean.

          One of:

          string-1 string boolean-2 boolean
      • description string

        The description for the case.

        Maximum length is 30000.

      • settings object

        An object that contains the case settings.

        Hide settings attributes Show settings attributes object

        • extractObservables boolean

          When true, observables (e.g. IPs, hashes, URLs) are automatically extracted from case comments. Optional; defaults to false when omitted.

        • syncAlerts boolean Required

          Turns alert syncing on or off.

      • severity string

        The severity of the case.

        Values are critical, high, low, or medium.

      • tags array[string]

        The words and phrases that help categorize cases. It can be an empty array.

        Not more than 200 elements. Maximum length of each is 256.

      • title string

        A title for the case.

        Maximum length is 160.

    • description string

      A description for the template.

    • key string

      A unique key for the template. Must be lower case and composed only of a-z, 0-9, '_', and '-' characters. It is used in API calls to refer to a specific template.

    • name string

      The name of the template.

    • tags array[string]

      The words and phrases that help categorize templates. It can be an empty array.

      Not more than 200 elements. Maximum length of each is 256.

  • updated_at string(date-time) | null
  • updated_by object | null
    Hide updated_by attributes Show updated_by attributes object | null

    • email string | null Required
    • full_name string | null Required
    • profile_uid string
    • username string | null Required
  • version string
• 401 application/json

  Authorization information is missing or invalid.

  Hide response attributes Show response attributes object

  • error string
  • message string
  • statusCode integer