Sign in

v53

latestOpenAPI 3.0.3raw.githubusercontent.com2026-08-076771,7565.2 MB
cases

Update case settings

Spaces method and path for this operation:

<div><span class="operation-verb patch">patch</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/configure/{configurationId}</span></div>

Refer to Spaces for more information.

Updates setting details such as the closure type, custom fields, templates, and the default connector for cases. Connectors are used to interface with external systems. You must create a connector before you can use it in your cases. You must have all privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on where the case was created.

patch/api/cases/configure/{configurationId}

Path parameters

configurationIdstring required
Example:3297a0f0-b5ec-11ec-b141-0fdb20a7f9a9

An identifier for the configuration.

Headers

kbn-xsrfstring required

Cross-site request forgery protection

Request body

closure_type'close-by-pushing' | 'close-by-user'

Indicates whether a case is automatically closed when it is pushed to external systems (close-by-pushing) or not automatically closed (close-by-user).

versionstring required

The version of the connector. To retrieve the version value, use the get configuration API.

Example request

{
  "closure_type": "close-by-user",
  "connector": {
    "id": "none",
    "name": "none",
    "type": ".none"
  },
  "templates": [
    {
      "caseFields": {
        "assignees": [
          {
            "uid": "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
          }
        ],
        "connector": {
          "id": "none",
          "name": "none",
          "type": ".none"
        },
        "settings": {
          "syncAlerts": true
        }
      }
    }
  ],
  "version": "WzIwMiwxXQ=="
}

Response

Indicates a successful call.

closure_type'close-by-pushing' | 'close-by-user'

Indicates whether a case is automatically closed when it is pushed to external systems (close-by-pushing) or not automatically closed (close-by-user).

created_atstring date-time
errorstring nullable
idstring
owner'cases' | 'observability' | 'securitySolution'

The application that owns the cases: Stack Management, Observability, or Elastic Security.

updated_atstring date-time nullable
versionstring

Example response

{
  "closure_type": "close-by-user",
  "connector": {
    "id": "none",
    "name": "none",
    "type": ".none"
  },
  "created_at": "2022-06-01T17:07:17.767Z",
  "created_by": {
    "profile_uid": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
    "username": "elastic"
  },
  "id": "4a97a440-e1cd-11ec-be9b-9b1838238ee6",
  "mappings": [
    {
      "action_type": "overwrite",
      "source": "title",
      "target": "summary"
    }
  ],
  "observableTypes": [
    {
      "key": "d312efda-ec2b-42ec-9e2c-84981795c581",
      "label": "My observable type"
    }
  ],
  "owner": "cases",
  "templates": [
    {
      "caseFields": {
        "assignees": [
          {
            "uid": "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
          }
        ],
        "connector": {
          "id": "none",
          "name": "none",
          "type": ".none"
        },
        "settings": {
          "syncAlerts": true
        }
      }
    }
  ],
  "updated_at": "2022-06-01T19:58:48.169Z",
  "updated_by": {
    "profile_uid": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
    "username": "elastic"
  },
  "version": "WzIwNzMsMV0="
}