Sign in

v53

latestOpenAPI 3.0.3raw.githubusercontent.com2026-08-076771,7565.2 MB
cases

Create a case template

Spaces method and path for this operation:

<div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/templates</span></div>

Refer to Spaces for more information.

Creates a case template from a YAML definition. You must have the "Manage templates" sub-privilege for the Cases feature of the owning solution. Set dry_run=true to run the full validation (body, YAML definition, name uniqueness, authorization) without creating anything. Requires the Cases feature to be enabled in the space.

post/api/cases/templates

Query parameters

dry_runboolean

When true, validates the request without creating the template and returns {"valid": true}.

Request body

definitionstring required

The template definition as a YAML string: case defaults (name, severity, category, tags, assignees, connector, settings) and a fields array of inline field definitions or $ref entries pointing into the owner's field library. Stored field values appear on cases under extended_fields keys shaped <field_name>_as_<storage_type>.

descriptionstring

A description of the template.

isEnabledboolean

Disabled templates are hidden from the case creation flow.

namestring

The template identity name, unique per owner (case-insensitive). May be omitted when the YAML definition provides a case-default title (name:), which is then used as the identity name.

owner'cases' | 'observability' | 'securitySolution' required

The application that owns the cases: Stack Management, Observability, or Elastic Security.

tagsstring[]

The words and phrases that help categorize templates. It can be an empty array.

Example request

{
  "definition": "name: Security incident\nseverity: high\ntags: [security]\nfields:\n  - name: priority\n    label: Priority\n    type: keyword\n    control: SELECT_BASIC\n    metadata:\n      options: [low, medium, high]\n      default: medium\n  - $ref: risk_score\n",
  "owner": "cases"
}

Response

Indicates a successful call. Returns the created template, or {"valid": true} for a dry run.

OR