Sign in

v53

latestOpenAPI 3.0.3raw.githubusercontent.com2026-08-076771,7565.2 MB
cases

Get cases for an alert

Spaces method and path for this operation:

<div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/alerts/{alertId}</span></div>

Refer to Spaces for more information.

You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases you're seeking.

get/api/cases/alerts/{alertId}

Path parameters

alertIdstring required
Example:09f0c261e39e36351d75995b78bb83673774d1bc2cca9df2d15f0e5c0a99a540

An identifier for the alert.

Query parameters

'cases' | 'observability' | 'securitySolution'

The application that owns the cases: Stack Management, Observability, or Elastic Security.

OR
CasesOwner[]
Example:cases

A filter to limit the response to a specific set of applications. If this parameter is omitted, the response contains information about all the cases that the user has access to read.

Response

Indicates a successful call.

createdAtstring date-time required

When the case was created.

descriptionstring required

The case description.

idstring required

The case identifier.

status'closed' | 'in-progress' | 'open' required

The status of the case.

titlestring required

The case title.