v53

latestOpenAPI 3.0.3raw.githubusercontent.com2026-08-076771,7565.2 MB
cases

Add case settings

Spaces method and path for this operation:

<div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/configure</span></div>

Refer to Spaces for more information.

Case settings include external connection details, custom fields, and templates. Connectors are used to interface with external systems. You must create a connector before you can use it in your cases. If you set a default connector, it is automatically selected when you create cases in Kibana. If you use the create case API, however, you must still specify all of the connector details. You must have all privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on where you are creating cases.

post/api/cases/configure

Headers

kbn-xsrfstring required

Cross-site request forgery protection

Request body

closure_type'close-by-pushing' | 'close-by-user' required

Indicates whether a case is automatically closed when it is pushed to external systems (close-by-pushing) or not automatically closed (close-by-user).

owner'cases' | 'observability' | 'securitySolution' required

The application that owns the cases: Stack Management, Observability, or Elastic Security.

Example request

{
  "closure_type": "close-by-user",
  "connector": {
    "id": "none",
    "name": "none",
    "type": ".none"
  },
  "owner": "cases",
  "templates": [
    {
      "caseFields": {
        "assignees": [
          {
            "uid": "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
          }
        ],
        "connector": {
          "id": "none",
          "name": "none",
          "type": ".none"
        },
        "settings": {
          "syncAlerts": true
        }
      }
    }
  ]
}

Response

Indicates a successful call.

closure_type'close-by-pushing' | 'close-by-user'

Indicates whether a case is automatically closed when it is pushed to external systems (close-by-pushing) or not automatically closed (close-by-user).

created_atstring date-time
errorstring nullable
idstring
owner'cases' | 'observability' | 'securitySolution'

The application that owns the cases: Stack Management, Observability, or Elastic Security.

updated_atstring date-time nullable
versionstring

Example response

{
  "closure_type": "close-by-user",
  "connector": {
    "id": "none",
    "name": "none",
    "type": ".none"
  },
  "created_at": "2022-06-01T17:07:17.767Z",
  "created_by": {
    "profile_uid": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
    "username": "elastic"
  },
  "id": "4a97a440-e1cd-11ec-be9b-9b1838238ee6",
  "mappings": [
    {
      "action_type": "overwrite",
      "source": "title",
      "target": "summary"
    }
  ],
  "observableTypes": [
    {
      "key": "d312efda-ec2b-42ec-9e2c-84981795c581",
      "label": "My observable type"
    }
  ],
  "owner": "cases",
  "templates": [
    {
      "caseFields": {
        "assignees": [
          {
            "uid": "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
          }
        ],
        "connector": {
          "id": "none",
          "name": "none",
          "type": ".none"
        },
        "settings": {
          "syncAlerts": true
        }
      }
    }
  ],
  "updated_at": "2022-06-01T19:58:48.169Z",
  "updated_by": {
    "profile_uid": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
    "username": "elastic"
  },
  "version": "WzIwNzMsMV0="
}