---
title: "Get case settings"
method: GET
path: "/api/cases/configure"
tags: ["cases"]
---

# Get case settings

`GET /api/cases/configure`

**Spaces method and path for this operation:**

<div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/configure</span></div>

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Get setting details such as the closure type, custom fields, templates, and the default connector for cases. You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on where the cases were created.

## Query parameters

- `owner` union
  - 'cases' | 'observability' | 'securitySolution' — The application that owns the cases: Stack Management, Observability, or Elastic Security.
  - CasesOwner[]

## Response `200`

Indicates a successful call.

- object[]
  - `closure_type` 'close-by-pushing' | 'close-by-user' — Indicates whether a case is automatically closed when it is pushed to external systems (`close-by-pushing`) or not automatically closed (`close-by-user`).
  - `connector` object
    - `fields` object, nullable — The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to `null`.
    - `id` string — The identifier for the connector. If you do not want a default connector, use `none`. To retrieve connector IDs, use the find connectors API.
    - `name` string — The name of the connector. If you do not want a default connector, use `none`. To retrieve connector names, use the find connectors API.
    - `type` '.cases-webhook' | '.jira' | '.none' | '.resilient' | '.servicenow' | '.servicenow-sir' | '.swimlane' — The type of connector.
  - `created_at` string, date-time
  - `created_by` object
    - `email` string, nullable, required
    - `full_name` string, nullable, required
    - `profile_uid` string
    - `username` string, nullable, required
  - `customFields` object[] — Custom fields configuration details.
    - `defaultValue` union — A default value for the custom field. If the `type` is `text`, the default value must be a string. If the `type` is `toggle`, the default value must be boolean.
      - string
      - boolean
    - `key` string — A unique key for the custom field. Must be lower case and composed only of a-z, 0-9, '_', and '-' characters. It is used in API calls to refer to a specific custom field.
    - `label` string — The custom field label that is displayed in the case.
    - `type` 'text' | 'toggle' — The type of the custom field.
    - `required` boolean — Indicates whether the field is required. If `false`, the custom field can be set to null or omitted when a case is created or updated.
  - `error` string, nullable
  - `id` string
  - `mappings` object[]
    - `action_type` string
    - `source` string
    - `target` string
  - `observableTypes` object[] — Custom observable type configuration details.
    - `key` string — The observable type key.
    - `label` string — The observable type label.
  - `owner` 'cases' | 'observability' | 'securitySolution' — The application that owns the cases: Stack Management, Observability, or Elastic Security.
  - `templates` object[]
    - `caseFields` object
      - `assignees` object[], nullable — An array containing users that are assigned to the case.
        - `uid` string, required — A unique identifier for the user profile. These identifiers can be found by using the suggest user profile API.
      - `category` string — A word or phrase that categorizes the case.
      - `connector` object
        - `fields` object, nullable — The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to `null`.
        - `id` string — The identifier for the connector. If you do not want a default connector, use `none`. To retrieve connector IDs, use the find connectors API.
        - `name` string — The name of the connector. If you do not want a default connector, use `none`. To retrieve connector names, use the find connectors API.
        - `type` '.cases-webhook' | '.jira' | '.none' | '.resilient' | '.servicenow' | '.servicenow-sir' | '.swimlane' — The type of connector.
      - `customFields` object[] — Custom field values in the template.
        - `key` string — The unique key for the custom field.
        - `type` 'text' | 'toggle' — The type of the custom field.
        - `value` union — The default value for the custom field when a case uses the template. If the `type` is `text`, the default value must be a string. If the `type` is `toggle`, the default value must be boolean.
          - string
          - boolean
      - `description` string — The description for the case.
      - `settings` CasesSettings — An object that contains the case settings.
        - `extractObservables` boolean — When true, observables (e.g. IPs, hashes, URLs) are automatically extracted from case comments. Optional; defaults to false when omitted.
        - `syncAlerts` boolean, required — Turns alert syncing on or off.
      - `severity` 'critical' | 'high' | 'low' | 'medium' — The severity of the case.
      - `tags` string[] — The words and phrases that help categorize cases. It can be an empty array.
      - `title` string — A title for the case.
    - `description` string — A description for the template.
    - `key` string — A unique key for the template. Must be lower case and composed only of a-z, 0-9, '_', and '-' characters. It is used in API calls to refer to a specific template.
    - `name` string — The name of the template.
    - `tags` string[] — The words and phrases that help categorize templates. It can be an empty array.
  - `updated_at` string, date-time, nullable
  - `updated_by` object, nullable
    - `email` string, nullable, required
    - `full_name` string, nullable, required
    - `profile_uid` string
    - `username` string, nullable, required
  - `version` string

## Other responses

- `401` — Authorization information is missing or invalid.

---

[API](https://skmtc.net/elastic/apis/kibana-apis.md) · [All operations](https://skmtc.net/elastic/apis/kibana-apis/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/elastic/kibana-apis/versions/531c9e2a7d23/schema)