---
title: "Add case settings"
method: POST
path: "/api/cases/configure"
tags: ["cases"]
---

# Add case settings

`POST /api/cases/configure`

**Spaces method and path for this operation:**

<div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/configure</span></div>

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Case settings include external connection details, custom fields, and templates. Connectors are used to interface with external systems. You must create a connector before you can use it in your cases. If you set a default connector, it is automatically selected when you create cases in Kibana. If you use the create case API, however, you must still specify all of the connector details. You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on where you are creating cases.

## Headers

- `kbn-xsrf` string, required

## Request body

- CasesSetCaseConfigurationRequest — External connection details, such as the closure type and default connector for cases.
  - `closure_type` 'close-by-pushing' | 'close-by-user', required — Indicates whether a case is automatically closed when it is pushed to external systems (`close-by-pushing`) or not automatically closed (`close-by-user`).
  - `connector` object, required — An object that contains the connector configuration.
    - `fields` object, nullable, required — The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to `null`.
    - `id` string, required — The identifier for the connector. If you do not want a default connector, use `none`. To retrieve connector IDs, use the find connectors API.
    - `name` string, required — The name of the connector. If you do not want a default connector, use `none`. To retrieve connector names, use the find connectors API.
    - `type` '.cases-webhook' | '.jira' | '.none' | '.resilient' | '.servicenow' | '.servicenow-sir' | '.swimlane', required — The type of connector.
  - `customFields` object[] — Custom fields case configuration.
    - `defaultValue` union — A default value for the custom field. If the `type` is `text`, the default value must be a string. If the `type` is `toggle`, the default value must be boolean.
      - string
      - boolean
    - `key` string, required — A unique key for the custom field. Must be lower case and composed only of a-z, 0-9, '_', and '-' characters. It is used in API calls to refer to a specific custom field.
    - `label` string, required — The custom field label that is displayed in the case.
    - `type` 'text' | 'toggle', required — The type of the custom field.
    - `required` boolean, required — Indicates whether the field is required. If `false`, the custom field can be set to null or omitted when a case is created or updated.
  - `owner` 'cases' | 'observability' | 'securitySolution', required — The application that owns the cases: Stack Management, Observability, or Elastic Security.
  - `templates` object[]
    - `caseFields` object
      - `assignees` object[], nullable — An array containing users that are assigned to the case.
        - `uid` string, required — A unique identifier for the user profile. These identifiers can be found by using the suggest user profile API.
      - `category` string — A word or phrase that categorizes the case.
      - `connector` object
        - `fields` object, nullable — The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to `null`.
        - `id` string — The identifier for the connector. If you do not want a default connector, use `none`. To retrieve connector IDs, use the find connectors API.
        - `name` string — The name of the connector. If you do not want a default connector, use `none`. To retrieve connector names, use the find connectors API.
        - `type` '.cases-webhook' | '.jira' | '.none' | '.resilient' | '.servicenow' | '.servicenow-sir' | '.swimlane' — The type of connector.
      - `customFields` object[] — Custom field values in the template.
        - `key` string — The unique key for the custom field.
        - `type` 'text' | 'toggle' — The type of the custom field.
        - `value` union — The default value for the custom field when a case uses the template. If the `type` is `text`, the default value must be a string. If the `type` is `toggle`, the default value must be boolean.
          - string
          - boolean
      - `description` string — The description for the case.
      - `settings` CasesSettings — An object that contains the case settings.
        - `extractObservables` boolean — When true, observables (e.g. IPs, hashes, URLs) are automatically extracted from case comments. Optional; defaults to false when omitted.
        - `syncAlerts` boolean, required — Turns alert syncing on or off.
      - `severity` 'critical' | 'high' | 'low' | 'medium' — The severity of the case.
      - `tags` string[] — The words and phrases that help categorize cases. It can be an empty array.
      - `title` string — A title for the case.
    - `description` string — A description for the template.
    - `key` string — A unique key for the template. Must be lower case and composed only of a-z, 0-9, '_', and '-' characters. It is used in API calls to refer to a specific template.
    - `name` string — The name of the template.
    - `tags` string[] — The words and phrases that help categorize templates. It can be an empty array.

## Response `200`

Indicates a successful call.

- object
  - `closure_type` 'close-by-pushing' | 'close-by-user' — Indicates whether a case is automatically closed when it is pushed to external systems (`close-by-pushing`) or not automatically closed (`close-by-user`).
  - `connector` object
    - `fields` object, nullable — The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to `null`.
    - `id` string — The identifier for the connector. If you do not want a default connector, use `none`. To retrieve connector IDs, use the find connectors API.
    - `name` string — The name of the connector. If you do not want a default connector, use `none`. To retrieve connector names, use the find connectors API.
    - `type` '.cases-webhook' | '.jira' | '.none' | '.resilient' | '.servicenow' | '.servicenow-sir' | '.swimlane' — The type of connector.
  - `created_at` string, date-time
  - `created_by` object
    - `email` string, nullable, required
    - `full_name` string, nullable, required
    - `profile_uid` string
    - `username` string, nullable, required
  - `customFields` object[] — Custom fields configuration details.
    - `defaultValue` union — A default value for the custom field. If the `type` is `text`, the default value must be a string. If the `type` is `toggle`, the default value must be boolean.
      - string
      - boolean
    - `key` string — A unique key for the custom field. Must be lower case and composed only of a-z, 0-9, '_', and '-' characters. It is used in API calls to refer to a specific custom field.
    - `label` string — The custom field label that is displayed in the case.
    - `type` 'text' | 'toggle' — The type of the custom field.
    - `required` boolean — Indicates whether the field is required. If `false`, the custom field can be set to null or omitted when a case is created or updated.
  - `error` string, nullable
  - `id` string
  - `mappings` object[]
    - `action_type` string
    - `source` string
    - `target` string
  - `observableTypes` object[] — Custom observable type configuration details.
    - `key` string — The observable type key.
    - `label` string — The observable type label.
  - `owner` 'cases' | 'observability' | 'securitySolution' — The application that owns the cases: Stack Management, Observability, or Elastic Security.
  - `templates` object[]
    - `caseFields` object
      - `assignees` object[], nullable — An array containing users that are assigned to the case.
        - `uid` string, required — A unique identifier for the user profile. These identifiers can be found by using the suggest user profile API.
      - `category` string — A word or phrase that categorizes the case.
      - `connector` object
        - `fields` object, nullable — The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to `null`.
        - `id` string — The identifier for the connector. If you do not want a default connector, use `none`. To retrieve connector IDs, use the find connectors API.
        - `name` string — The name of the connector. If you do not want a default connector, use `none`. To retrieve connector names, use the find connectors API.
        - `type` '.cases-webhook' | '.jira' | '.none' | '.resilient' | '.servicenow' | '.servicenow-sir' | '.swimlane' — The type of connector.
      - `customFields` object[] — Custom field values in the template.
        - `key` string — The unique key for the custom field.
        - `type` 'text' | 'toggle' — The type of the custom field.
        - `value` union — The default value for the custom field when a case uses the template. If the `type` is `text`, the default value must be a string. If the `type` is `toggle`, the default value must be boolean.
          - string
          - boolean
      - `description` string — The description for the case.
      - `settings` CasesSettings — An object that contains the case settings.
        - `extractObservables` boolean — When true, observables (e.g. IPs, hashes, URLs) are automatically extracted from case comments. Optional; defaults to false when omitted.
        - `syncAlerts` boolean, required — Turns alert syncing on or off.
      - `severity` 'critical' | 'high' | 'low' | 'medium' — The severity of the case.
      - `tags` string[] — The words and phrases that help categorize cases. It can be an empty array.
      - `title` string — A title for the case.
    - `description` string — A description for the template.
    - `key` string — A unique key for the template. Must be lower case and composed only of a-z, 0-9, '_', and '-' characters. It is used in API calls to refer to a specific template.
    - `name` string — The name of the template.
    - `tags` string[] — The words and phrases that help categorize templates. It can be an empty array.
  - `updated_at` string, date-time, nullable
  - `updated_by` object, nullable
    - `email` string, nullable, required
    - `full_name` string, nullable, required
    - `profile_uid` string
    - `username` string, nullable, required
  - `version` string

## Other responses

- `401` — Authorization information is missing or invalid.

---

[API](https://skmtc.net/elastic/apis/kibana-apis.md) · [All operations](https://skmtc.net/elastic/apis/kibana-apis/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/elastic/kibana-apis/versions/531c9e2a7d23/schema)