Elastic Stack (ELK Stack) Cases API is one of 132 APIs that Elastic Stack (ELK Stack) publishes on the APIs.io network, described by a machine-readable OpenAPI specification.
Tagged areas include Cases. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, and an API reference.
This API exposes
29 operations
across 20 paths,
and defines 77 schemas.
It is described by OpenAPI 3.2.0.
Requests are made against a single base URL, https://{kibana_url}.
The identity and technical contract details declared by the specification.
Cases_add_case_comment_request
The add comment to case API request body varies depending on whether you are adding an alert or a comment.
Cases_case_severity
string
The severity of the case.
Cases_alert_response_properties
object
3 properties
Cases_applicable_fields_response
object
The fields a caller may apply to a case's extendedfields. When no template is in scope, this is the owner's global (library-wide) fields; when a template is ap…
1 property
1 required
Cases_alert_identifiers
The alert identifiers. It is required only when type is alert. You can use an array of strings to add multiple alerts to a case, provided that they all relate…
Cases_case_status
string
The status of the case.
Cases_user_comment_response_properties
object
11 properties
1 required
Cases_update_case_comment_request
The update case comment API request body varies depending on whether you are updating an alert or a comment.
Cases_connector_properties_jira
object
Defines properties for connectors when type is .jira.
4 properties
4 required
Cases_payload_tags
object
1 property
Cases_connector_properties_servicenow_sir
object
Defines properties for connectors when type is .servicenow-sir.
4 properties
4 required
Cases_connector_properties_servicenow
object
Defines properties for connectors when type is .servicenow.
4 properties
4 required
Cases_update_alert_comment_request_properties
object
Defines properties for case comment requests when type is alert.
7 properties
7 required
Cases_related_case
object
Summary of a case returned when listing cases that contain a given alert. This is a subset of the full case response.
6 properties
6 required
Cases_owner
string
The application that owns the cases: Stack Management, Observability, or Elastic Security.
Cases_searchFieldsType
string
The fields to perform the simplequerystring parsed query against.
Cases_update_case_configuration_request
object
You can update settings such as the closure type, custom fields, templates, and the default connector for cases.
5 properties
1 required
Cases_add_user_comment_request_properties
object
Defines properties for case comment requests when type is user.
3 properties
3 required
Cases_payload_user_comment
object
1 property
Cases_case_observable
object
A single observable attached to a case.
6 properties
6 required
Cases_update_case_request
object
The update case API request body varies depending on the type of connector.
1 property
1 required
Cases_rule
object
The rule that is associated with the alerts. It is required only when type is alert. This functionality is in technical preview and may be changed or removed i…
2 properties
Cases_payload_connector
object
1 property
Cases_template_tags
array
The words and phrases that help categorize templates. It can be an empty array.
Cases_alert_indices
The alert indices. It is required only when type is alert. If you are adding multiple alerts to a case, use an array of strings; the position of each index nam…
Cases_payload_title
object
1 property
Cases_case_tags
array
The words and phrases that help categorize cases. It can be an empty array.
Cases_closure_types
string
Indicates whether a case is automatically closed when it is pushed to external systems (close-by-pushing) or not automatically closed (close-by-user).
Cases_create_case_request
object
The create case API request body varies depending on the type of connector.
11 properties
6 required
Cases_case_categories
array
Cases_case_response_closed_by_properties
objectnull
4 properties
3 required
Cases_payload_create_case
object
9 properties
Cases_add_alert_comment_request_properties
object
Defines properties for case comment requests when type is alert.
5 properties
5 required
Cases_case_response_properties
object
28 properties
23 required
Cases_template_dry_run_response
object
Returned instead of the template when the request was sent with dryrun=true.
1 property
1 required
Cases_alert_comment_response_properties
object
13 properties
1 required
Cases_payload_settings
object
1 property
Cases_connector_properties_swimlane
object
Defines properties for connectors when type is .swimlane.
4 properties
4 required
Cases_case_response_get_case
object
Case details returned by the get case API. The comments property is not included in the response. Use the find case comments API to retrieve comments. totalCom…
27 properties
22 required
Cases_payload_pushed
object
1 property
Cases_event_comment_response_properties
object
12 properties
1 required
Cases_payload_severity
object
1 property
Cases_get_case_templates_response
object
Response returned by the get all case templates API.
4 properties
4 required
Cases_case_response_pushed_by_properties
objectnull
4 properties
3 required
Cases_case_response_updated_by_properties
objectnull
4 properties
3 required
Cases_attachment_totals
object
Counts of alerts, events, and user comments attached to a case.
3 properties
3 required
Cases_connector_properties_none
object
Defines properties for connectors when type is .none.
4 properties
4 required
Cases_case_response_created_by_properties
object
4 properties
3 required
Cases_connector_properties_resilient
object
Defines properties for connectors when type is .resilient.
4 properties
4 required
Cases_connector_properties_cases_webhook
object
Defines properties for connectors when type is .cases-webhook.
4 properties
4 required
Cases_response_4xx
object
3 properties
Cases_connector_types
string
The type of connector.
Cases_find_comments_response
object
4 properties
4 required
Cases_payload_assignees
object
1 property
Cases_case_description
string
The description for the case.
Cases_payload_description
object
1 property
Cases_assignees
arraynull
An array containing users that are assigned to the case.
Cases_template_v2_response
object
A case template (v2).
18 properties
9 required
Cases_set_case_configuration_request
object
External connection details, such as the closure type and default connector for cases.
5 properties
3 required
Cases_add_case_file_request
object
Defines the file that will be attached to the case. Optional parameters will be generated automatically from the file metadata if not defined.
2 properties
1 required
Cases_payload_alert_comment
object
1 property
Cases_case_category
string
A word or phrase that categorizes the case.
Cases_external_service
objectnull
7 properties
Cases_payload_delete
objectnull
If the action is delete and the type is deletecase, the payload is nullable.
Cases_template_write_request
object
The body for creating or fully replacing a case template. Server-managed attributes (author, usage statistics, field summaries, version flags) are computed and…
6 properties
2 required
Cases_user_actions_find_response_properties
object
9 properties
9 required
Cases_case_title
string
A title for the case.
Cases_update_user_comment_request_properties
object
Defines properties for case comment requests when type is user.
5 properties
5 required
Cases_case_close_sync_reason
The close reason to sync to attached alerts when closing the case. Can be one of following predefined reasons: [falsepositive, duplicate, truepositive, benignp…
Cases_searchFieldsTypeArray
array
Cases_settings
object
An object that contains the case settings.
2 properties
1 required
Cases_payload_status
object
1 property
The full machine-readable OpenAPI contract behind this narrative.
Other APIs Elastic Stack (ELK Stack) publishes across the network.
