Kibana cases API
Cases are used to open and track issues. You can add assignees and tags to your cases, set their severity and status, and add alerts, comments, and visualizations. You can also send cases to external incident management systems by configuring connectors.
Kibana cases API is one of 60 APIs that Kibana publishes on the APIs.io network, described by a machine-readable OpenAPI specification.
Tagged areas include cases. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, and authentication docs.
This API exposes 22 operations across 16 paths, and defines 72 schemas. It is described by OpenAPI 3.0.3.
Requests are made against a single base URL, https://{kibana_url}.
22 operations
16 paths
72 schemas
3 DELETE11 GET3 PATCH5 POST
Metadata
The identity and technical contract details declared by the specification.
Authentication & Security 2
Kibana cases API declares
2 security schemes
for authenticating requests.
An API key is passed in the header as Authorization (apiKeyAuth).
It accepts HTTP basic authentication (basicAuth).
By default, every request must be authenticated.
apiKeyAuth— These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64A…
Paths & Operations 22
Across 16 paths, the API surfaces 22 operations — 3 DELETE, 11 GET, 3 PATCH, 5 POST. Each is listed below with its method, path, parameters, and response codes.
cases 22
Cases are used to open and track issues. You can add assignees and tags to your cases, set their severity and status, and add alerts, comments, and visualizations. You can also se…
DELETE
/api/cases
Delete cases
PATCH
/api/cases
Update cases
POST
/api/cases
Create a case
GET
/api/cases/_find
Search cases
GET
/api/cases/{caseId}
Get case information
GET
/api/cases/{caseId}/alerts
Get all alerts for a case
DELETE
/api/cases/{caseId}/comments
Delete all case comments and alerts
PATCH
/api/cases/{caseId}/comments
Update a case comment or alert
POST
/api/cases/{caseId}/comments
Add a case comment or alert
GET
/api/cases/{caseId}/comments/_find
Find case comments
DELETE
/api/cases/{caseId}/comments/{commentId}
Delete a case comment or alert
GET
/api/cases/{caseId}/comments/{commentId}
Get a case comment or alert
POST
/api/cases/{caseId}/connector/{connectorId}/_push
Push a case to an external service
POST
/api/cases/{caseId}/files
Attach a file to a case
GET
/api/cases/{caseId}/user_actions/_find
Find case activity
GET
/api/cases/alerts/{alertId}
Get cases for an alert
GET
/api/cases/configure
Get case settings
POST
/api/cases/configure
Add case settings
PATCH
/api/cases/configure/{configurationId}
Update case settings
GET
/api/cases/configure/connectors/_find
Get case connectors
GET
/api/cases/reporters
Get case creators
GET
/api/cases/tags
Get case tags
Schemas 72
The contract defines 72 schemas that model the data the API accepts and returns. The most detailed are Cases_case_response_properties (28 properties), Cases_case_response_get_case (27 properties), Cases_alert_comment_response_properties (13 properties), Cases_event_comment_response_properties (12 properties). Each schema is shown below with its type and property counts.
Cases_assignees
array
An array containing users that are assigned to the case.
Cases_alert_response_properties
object
3 properties
Cases_connector_properties_servicenow
object
Defines properties for connectors when type is .servicenow.
4 properties
4 required
Cases_case_response_properties
object
28 properties
23 required
Cases_owner
string
The application that owns the cases: Stack Management, Observability, or Elastic Security.
Cases_searchFieldsType
string
The fields to perform the simplequerystring parsed query against.
Cases_update_case_comment_request
The update case comment API request body varies depending on whether you are updating an alert or a comment.
Cases_connector_properties_resilient
object
Defines properties for connectors when type is .resilient.
4 properties
4 required
Cases_connector_properties_none
object
Defines properties for connectors when type is .none.
4 properties
4 required
Cases_case_tags
array
The words and phrases that help categorize cases. It can be an empty array.
Cases_alert_indices
The alert indices. It is required only when type is alert. If you are adding multiple alerts to a case, use an array of strings; the position of each index nam…
Cases_response_4xx
object
3 properties
Cases_user_comment_response_properties
object
11 properties
1 required
Cases_case_response_created_by_properties
object
4 properties
3 required
Cases_payload_connector
object
1 property
Cases_payload_description
object
1 property
Cases_payload_title
object
1 property
Cases_case_severity
string
The severity of the case.
Cases_payload_user_comment
object
1 property
Cases_payload_pushed
object
1 property
Cases_case_category
string
A word or phrase that categorizes the case.
Cases_case_response_closed_by_properties
object
4 properties
3 required
Cases_attachment_totals
object
Counts of alerts, events, and user comments attached to a case.
3 properties
3 required
Cases_settings
object
An object that contains the case settings.
2 properties
1 required
Cases_find_comments_response
object
4 properties
4 required
Cases_payload_settings
object
1 property
Cases_template_tags
array
The words and phrases that help categorize templates. It can be an empty array.
Cases_set_case_configuration_request
object
External connection details, such as the closure type and default connector for cases.
5 properties
3 required
Cases_create_case_request
object
The create case API request body varies depending on the type of connector.
10 properties
6 required
Cases_update_case_request
object
The update case API request body varies depending on the type of connector.
1 property
1 required
Cases_update_alert_comment_request_properties
object
Defines properties for case comment requests when type is alert.
7 properties
7 required
Cases_connector_properties_cases_webhook
object
Defines properties for connectors when type is .cases-webhook.
4 properties
4 required
Cases_alert_comment_response_properties
object
13 properties
1 required
Cases_user_actions_find_response_properties
object
9 properties
9 required
Cases_case_observable
object
A single observable attached to a case.
6 properties
6 required
Cases_case_status
string
The status of the case.
Cases_string_array
array
Cases_add_alert_comment_request_properties
object
Defines properties for case comment requests when type is alert.
5 properties
5 required
Cases_payload_severity
object
1 property
Cases_searchFieldsTypeArray
array
Cases_case_title
string
A title for the case.
Cases_case_categories
array
Cases_string
string
Cases_connector_properties_swimlane
object
Defines properties for connectors when type is .swimlane.
4 properties
4 required
Cases_add_user_comment_request_properties
object
Defines properties for case comment requests when type is user.
3 properties
3 required
Cases_related_case
object
Summary of a case returned when listing cases that contain a given alert. This is a subset of the full case response.
6 properties
6 required
Cases_payload_status
object
1 property
Cases_payload_delete
object
If the action is delete and the type is deletecase, the payload is nullable.
Cases_payload_create_case
object
9 properties
Cases_owners
array
Cases_event_comment_response_properties
object
12 properties
1 required
Cases_alert_identifiers
The alert identifiers. It is required only when type is alert. You can use an array of strings to add multiple alerts to a case, provided that they all relate…
Cases_case_response_updated_by_properties
object
4 properties
3 required
Cases_external_service
object
7 properties
Cases_add_case_comment_request
The add comment to case API request body varies depending on whether you are adding an alert or a comment.
Cases_connector_properties_servicenow_sir
object
Defines properties for connectors when type is .servicenow-sir.
4 properties
4 required
Cases_connector_types
string
The type of connector.
Cases_case_response_get_case
object
Case details returned by the get case API. The comments property is not included in the response. Use the find case comments API to retrieve comments. totalCom…
27 properties
22 required
Cases_update_case_configuration_request
object
You can update settings such as the closure type, custom fields, templates, and the default connector for cases.
5 properties
1 required
Cases_case_description
string
The description for the case.
Cases_connector_properties_jira
object
Defines properties for connectors when type is .jira.
4 properties
4 required
Cases_payload_assignees
object
1 property
Cases_rule
object
The rule that is associated with the alerts. It is required only when type is alert. This functionality is in technical preview and may be changed or removed i…
2 properties
Cases_payload_alert_comment
object
1 property
Cases_templates
array
Cases_add_case_file_request
object
Defines the file that will be attached to the case. Optional parameters will be generated automatically from the file metadata if not defined.
2 properties
1 required
Cases_case_response_pushed_by_properties
object
4 properties
3 required
Cases_payload_tags
object
1 property
Cases_update_user_comment_request_properties
object
Defines properties for case comment requests when type is user.
5 properties
5 required
Cases_actions
string
Cases_case_close_sync_reason
The close reason to sync to attached alerts when closing the case. Can be one of following predefined reasons: [falsepositive, duplicate, truepositive, benignp…
Cases_closure_types
string
Indicates whether a case is automatically closed when it is pushed to external systems (close-by-pushing) or not automatically closed (close-by-user).
Specification
The full machine-readable OpenAPI contract behind this narrative.
Source
More from Kibana 12
Other APIs Kibana publishes across the network.
Kibana Actions API
Kibana agent builder API
Kibana alerting API
Kibana APM agent configuration API
Kibana APM agent keys API
Kibana APM annotations API
Kibana APM server schema API
Kibana APM sourcemaps API
Kibana connectors API
Kibana Data streams API
Kibana data views API
Kibana Elastic Agent actions API
#cases