Sign in

v53

latestOpenAPI 3.0.3raw.githubusercontent.com2026-08-076771,7565.2 MB
cases

Search cases

Spaces method and path for this operation:

<div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/_find</span></div>

Refer to Spaces for more information.

You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases you're seeking.

get/api/cases/_find

Query parameters

string
OR
CasesString[]

Filters the returned cases by assignees. Valid values are none or unique identifiers for the user profiles. These identifiers can be found by using the suggest user profile API.

string

A word or phrase that categorizes the case.

OR
CasesCaseCategory[]

Filters the returned cases by category.

defaultSearchOperatorstring

he default operator to use for the simple_query_string.

fromstring
Example:now-1d

Returns only cases that were created after a specific date. The date must be specified as a KQL data range or date match expression.

'cases' | 'observability' | 'securitySolution'

The application that owns the cases: Stack Management, Observability, or Elastic Security.

OR
CasesOwner[]
Example:cases

A filter to limit the response to a specific set of applications. If this parameter is omitted, the response contains information about all the cases that the user has access to read.

pageinteger

The page number to return.

perPageinteger

The number of items to return. Limited to 100 items.

string
OR
CasesString[]

Filters the returned cases by the user name of the reporter.

searchstring

An Elasticsearch simple_query_string query that filters the objects in the response.

'description' | 'title'

The fields to perform the simple_query_string parsed query against.

OR
CasesSearchFieldsType[]

The fields to perform the simple_query_string parsed query against.

severity'critical' | 'high' | 'low' | 'medium'

The severity of the case.

sortField'createdAt' | 'updatedAt' | 'closedAt' | 'title' | 'category' | 'status' | 'severity'

Determines which field is used to sort the results.

sortOrder'asc' | 'desc'

Determines the sort order.

status'closed' | 'in-progress' | 'open'

Filters the returned cases by state.

string
OR
CasesString[]

Filters the returned cases by tags.

tostring

Returns only cases that were created before a specific date. The date must be specified as a KQL data range or date match expression.

Response

Indicates a successful call.

count_closed_casesinteger
count_in_progress_casesinteger
count_open_casesinteger
pageinteger
per_pageinteger
totalinteger

Example response

{
  "cases": [
    {
      "assignees": [
        {
          "uid": "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
        }
      ],
      "closed_by": {
        "profile_uid": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
        "username": "elastic"
      },
      "comments": [
        {
          "alertId": [
            "a6e12ac4-7bce-457b-84f6-d7ce8deb8446"
          ],
          "created_at": "2023-11-06T19:29:38.424Z",
          "created_by": {
            "profile_uid": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
            "username": "elastic"
          },
          "id": "73362370-ab1a-11ec-985f-97e55adae8b9",
          "index": [
            ".internal.alerts-security.alerts-default-000001"
          ],
          "owner": "cases",
          "pushed_by": {
            "profile_uid": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
            "username": "elastic"
          },
          "rule": {
            "id": "94d80550-aaf4-11ec-985f-97e55adae8b9",
            "name": "security_rule"
          },
          "type": "alert",
          "updated_by": {
            "profile_uid": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
            "username": "elastic"
          },
          "version": "WzMwNDgsMV0="
        }
      ],
      "connector": {
        "id": "none",
        "name": "none",
        "type": ".none"
      },
      "created_at": "2022-05-13T09:16:17.416Z",
      "created_by": {
        "profile_uid": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
        "username": "elastic"
      },
      "description": "A case description.",
      "duration": 120,
      "external_service": {
        "pushed_by": {
          "profile_uid": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
          "username": "elastic"
        }
      },
      "id": "66b9aa00-94fa-11ea-9f74-e7e108796192",
      "incremental_id": 1,
      "observables": [
        {
          "createdAt": "2024-11-14T10:00:00.000Z",
          "description": "Source IP",
          "id": "df927ab8-54ed-47d6-be07-9948c255c097",
          "typeKey": "observable-type-ipv4",
          "updatedAt": "2024-11-14T10:00:00.000Z",
          "value": "10.0.0.8"
        }
      ],
      "owner": "cases",
      "settings": {
        "syncAlerts": true
      },
      "tags": [
        "tag-1"
      ],
      "title": "Case title 1",
      "updated_by": {
        "profile_uid": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
        "username": "elastic"
      },
      "version": "WzUzMiwxXQ=="
    }
  ]
}