---
title: "Update a case template"
method: PUT
path: "/api/cases/templates/{template_id}"
tags: ["cases"]
---

# Update a case template

`PUT /api/cases/templates/{template_id}`

**Spaces method and path for this operation:**

<div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/templates/{template_id}</span></div>

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Fully replaces a case template. Every accepted update creates a new template version; previous versions stay retrievable with the `version` query parameter of the get template API, and cases keep the version they were created with. You must have the "Manage templates" sub-privilege for the Cases feature of the owning solution. Set `dry_run=true` to run the full validation without writing. Requires the Cases feature to be enabled in the space.

## Path parameters

- `template_id` string, required

## Query parameters

- `dry_run` boolean

## Request body

- CasesTemplateWriteRequest — The body for creating or fully replacing a case template. Server-managed attributes (author, usage statistics, field summaries, version flags) are computed and cannot be set. Resource limits (enforced on write; a violation returns `400`): an owner may have at most 200 templates per space, and a definition may declare at most 200 fields. Version history is intentionally uncapped. A single stored extended-field value may not exceed 30000 UTF-8 bytes. The YAML `definition` string itself may not exceed 30000 characters (enforced on create, update, and `dry_run`).
  - `definition` string, required — The template definition as a YAML string: case defaults (name, severity, category, tags, assignees, connector, settings) and a `fields` array of inline field definitions or `$ref` entries pointing into the owner's field library. Stored field values appear on cases under `extended_fields` keys shaped `<field_name>_as_<storage_type>`.
  - `description` string — A description of the template.
  - `isEnabled` boolean — Disabled templates are hidden from the case creation flow.
  - `name` string — The template identity name, unique per owner (case-insensitive). May be omitted when the YAML definition provides a case-default title (`name:`), which is then used as the identity name.
  - `owner` 'cases' | 'observability' | 'securitySolution', required — The application that owns the cases: Stack Management, Observability, or Elastic Security.
  - `tags` string[] — The words and phrases that help categorize templates. It can be an empty array.

## Response `200`

Indicates a successful call. Returns the new template version, or `{"valid": true}` for a dry run.

- union
  - CasesTemplateV2Response — A case template (v2).
    - `author` string — The username of the template author.
    - `definition` unknown, required
    - `definitionString` string, required — The raw YAML definition string.
    - `deletedAt` string, date-time, nullable, required — The date the template was soft-deleted, or null if active.
    - `description` string — A human-readable description of the template.
    - `fieldCount` integer — The number of fields defined in the template.
    - `fieldDefinitions` object[] — Metadata about each field defined in the template.
      - `control` string, required
      - `label` string, required
      - `name` string, required
      - `type` string, required
    - `isDefault` boolean — Whether this is the default template for its owner.
    - `isEnabled` boolean — Whether the template is enabled.
    - `isLatest` boolean, required — Whether this is the latest version of the template.
    - `lastUsedAt` string, date-time — The date the template was last used to create a case.
    - `latestVersion` integer, required — The latest version number of this template.
    - `name` string, required — The display name of the template.
    - `owner` string, required — The owning solution (e.g. cases, observability, securitySolution).
    - `tags` string[] — The words and phrases that help categorize templates. It can be an empty array.
    - `templateId` string, required — The unique identifier of the template, shared across all versions.
    - `templateVersion` integer, required — The version number of this template revision.
    - `usageCount` integer — The number of times this template has been used to create a case.
  - CasesTemplateDryRunResponse — Returned instead of the template when the request was sent with `dry_run=true`.
    - `valid` true, required — Always `true` — validation failures return a 4xx error instead.

## Other responses

- `400` — The request body, YAML definition, or template name is invalid, or a resource limit was exceeded (max 200 fields per template).
- `401` — Authorization information is missing or invalid.
- `403` — The user does not have the manage templates privilege for the owner.
- `404` — The template was not found.
- `409` — A template with the same name already exists for the owner.

---

[API](https://skmtc.net/elastic/apis/kibana-apis.md) · [All operations](https://skmtc.net/elastic/apis/kibana-apis/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/elastic/kibana-apis/versions/531c9e2a7d23/schema)