---
title: "Get cases for an alert"
method: GET
path: "/api/cases/alerts/{alertId}"
tags: ["cases"]
---

# Get cases for an alert

`GET /api/cases/alerts/{alertId}`

**Spaces method and path for this operation:**

<div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/alerts/{alertId}</span></div>

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you're seeking.

## Path parameters

- `alertId` string, required

## Query parameters

- `owner` union
  - 'cases' | 'observability' | 'securitySolution' — The application that owns the cases: Stack Management, Observability, or Elastic Security.
  - CasesOwner[]

## Response `200`

Indicates a successful call.

- CasesRelatedCase[]
  - `createdAt` string, date-time, required — When the case was created.
  - `description` string, required — The case description.
  - `id` string, required — The case identifier.
  - `status` 'closed' | 'in-progress' | 'open', required — The status of the case.
  - `title` string, required — The case title.
  - `totals` CasesAttachmentTotals, required — Counts of alerts, events, and user comments attached to a case.
    - `alerts` integer, required — Number of alert attachments on the case.
    - `events` integer, required — Number of event attachments on the case.
    - `userComments` integer, required — Number of user comment attachments on the case.

## Other responses

- `401` — Authorization information is missing or invalid.

---

[API](https://skmtc.net/elastic/apis/kibana-apis.md) · [All operations](https://skmtc.net/elastic/apis/kibana-apis/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/elastic/kibana-apis/versions/531c9e2a7d23/schema)