--- title: "Create a case" method: POST path: "/api/cases" tags: ["cases"] --- # Create a case `POST /api/cases` **Spaces method and path for this operation:**
post /s/{space_id}/api/cases
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information. You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you're creating. ## Headers - `kbn-xsrf` string, required ## Request body - CasesCreateCaseRequest — The create case API request body varies depending on the type of connector. - `assignees` object[], nullable — An array containing users that are assigned to the case. - `uid` string, required — A unique identifier for the user profile. These identifiers can be found by using the suggest user profile API. - `category` string — A word or phrase that categorizes the case. - `connector` union, required - CasesConnectorPropertiesNone — Defines properties for connectors when type is `.none`. - `fields` string, nullable, required — An object containing the connector fields. To create a case without a connector, specify null. To update a case to remove the connector, specify null. - `id` string, required — The identifier for the connector. To create a case without a connector, use `none`. To update a case to remove the connector, specify `none`. - `name` string, required — The name of the connector. To create a case without a connector, use `none`. To update a case to remove the connector, specify `none`. - `type` '.none', required — The type of connector. To create a case without a connector, use `.none`. To update a case to remove the connector, specify `.none`. - CasesConnectorPropertiesCasesWebhook — Defines properties for connectors when type is `.cases-webhook`. - `fields` string, nullable, required - `id` string, required — The identifier for the connector. To retrieve connector IDs, use the find connectors API. - `name` string, required — The name of the connector. - `type` '.cases-webhook', required — The type of connector. - CasesConnectorPropertiesJira — Defines properties for connectors when type is `.jira`. - `fields` object, required — An object containing the connector fields. If you want to omit any individual field, specify null as its value. - `issueType` string, nullable, required — The type of issue. - `parent` string, nullable, required — The key of the parent issue, when the issue type is sub-task. - `priority` string, nullable, required — The priority of the issue. - `id` string, required — The identifier for the connector. To retrieve connector IDs, use the find connectors API. - `name` string, required — The name of the connector. - `type` '.jira', required — The type of connector. - CasesConnectorPropertiesResilient — Defines properties for connectors when type is `.resilient`. - `fields` object, nullable, required — An object containing the connector fields. If you want to omit any individual field, specify null as its value. - `issueTypes` string[], required — The type of incident. - `severityCode` string, required — The severity code of the incident. - `id` string, required — The identifier for the connector. - `name` string, required — The name of the connector. - `type` '.resilient', required — The type of connector. - CasesConnectorPropertiesServicenow — Defines properties for connectors when type is `.servicenow`. - `fields` object, required — An object containing the connector fields. If you want to omit any individual field, specify null as its value. - `category` string, nullable, required — The category of the incident. - `impact` string, nullable, required — The effect an incident had on business. - `severity` string, nullable, required — The severity of the incident. - `subcategory` string, nullable, required — The subcategory of the incident. - `urgency` string, nullable, required — The extent to which the incident resolution can be delayed. - `id` string, required — The identifier for the connector. To retrieve connector IDs, use the find connectors API. - `name` string, required — The name of the connector. - `type` '.servicenow', required — The type of connector. - CasesConnectorPropertiesServicenowSir — Defines properties for connectors when type is `.servicenow-sir`. - `fields` object, required — An object containing the connector fields. If you want to omit any individual field, specify null as its value. - `category` string, nullable, required — The category of the incident. - `destIp` boolean, nullable, required — Indicates whether cases will send a comma-separated list of destination IPs. - `malwareHash` boolean, nullable, required — Indicates whether cases will send a comma-separated list of malware hashes. - `malwareUrl` boolean, nullable, required — Indicates whether cases will send a comma-separated list of malware URLs. - `priority` string, nullable, required — The priority of the issue. - `sourceIp` boolean, nullable, required — Indicates whether cases will send a comma-separated list of source IPs. - `subcategory` string, nullable, required — The subcategory of the incident. - `id` string, required — The identifier for the connector. To retrieve connector IDs, use the find connectors API. - `name` string, required — The name of the connector. - `type` '.servicenow-sir', required — The type of connector. - CasesConnectorPropertiesSwimlane — Defines properties for connectors when type is `.swimlane`. - `fields` object, required — An object containing the connector fields. If you want to omit any individual field, specify null as its value. - `caseId` string, nullable, required — The case identifier for Swimlane connectors. - `id` string, required — The identifier for the connector. To retrieve connector IDs, use the find connectors API. - `name` string, required — The name of the connector. - `type` '.swimlane', required — The type of connector. - `customFields` object[] — Custom field values for a case. Any optional custom fields that are not specified in the request are set to null. - `key` string, required — The unique identifier for the custom field. The key value must exist in the case configuration settings. - `type` 'text' | 'toggle', required — The custom field type. It must match the type specified in the case configuration settings. - `value` union, required — The custom field value. If the custom field is required, it cannot be explicitly set to null. However, for cases that existed when the required custom field was added, the default value stored in Elasticsearch is `undefined`. The value returned in the API and user interface in this case is `null`. - string, nullable - boolean - `description` string, required — The description for the case. - `owner` 'cases' | 'observability' | 'securitySolution', required — The application that owns the cases: Stack Management, Observability, or Elastic Security. - `settings` CasesSettings, required — An object that contains the case settings. - `extractObservables` boolean — When true, observables (e.g. IPs, hashes, URLs) are automatically extracted from case comments. Optional; defaults to false when omitted. - `syncAlerts` boolean, required — Turns alert syncing on or off. - `severity` 'critical' | 'high' | 'low' | 'medium' — The severity of the case. - `tags` string[], required — The words and phrases that help categorize cases. It can be an empty array. - `template` object, nullable — A case template to create the case from. Requires the `xpack.cases.templates.enabled` setting. The server applies the template's case defaults (severity, category, tags, assignees, settings, connector) and its field defaults into `extended_fields`; any value explicitly provided in the request wins over the template default. When `version` is omitted, the latest version of the template is resolved and pinned on the case. To discover a template's fields before creating a case, use the get case fields API (`GET /api/cases/fields`). - `id` string, required — The template identifier. Retrieve template ids with `GET /api/cases/templates`. - `version` integer — The template version to apply. Omit to use (and pin) the latest version. - `title` string, required — A title for the case. ## Response `200` Indicates a successful call. - CasesCaseResponseProperties - `assignees` object[], nullable — An array containing users that are assigned to the case. - `uid` string, required — A unique identifier for the user profile. These identifiers can be found by using the suggest user profile API. - `category` string, nullable — The case category. - `closed_at` string, date-time, nullable, required - `closed_by` CasesCaseResponseClosedByProperties, nullable, required - `email` string, nullable, required - `full_name` string, nullable, required - `profile_uid` string - `username` string, nullable, required - `comments` union[], required — An array of comment objects for the case. - union - CasesAlertCommentResponseProperties - `alertId` string[] - `created_at` string, date-time - `created_by` object - `email` string, nullable, required - `full_name` string, nullable, required - `profile_uid` string - `username` string, nullable, required - `id` string - `index` string[] - `owner` 'cases' | 'observability' | 'securitySolution' — The application that owns the cases: Stack Management, Observability, or Elastic Security. - `pushed_at` string, date-time, nullable - `pushed_by` object, nullable - `email` string, nullable, required - `full_name` string, nullable, required - `profile_uid` string - `username` string, nullable, required - `rule` object - `id` string, nullable — The rule identifier. - `name` string, nullable — The rule name. - `type` 'alert', required - `updated_at` string, date-time, nullable - `updated_by` object, nullable - `email` string, nullable, required - `full_name` string, nullable, required - `profile_uid` string - `username` string, nullable, required - `version` string - CasesEventCommentResponseProperties - `created_at` string, date-time - `created_by` CasesCaseResponseCreatedByProperties - `email` string, nullable, required - `full_name` string, nullable, required - `profile_uid` string - `username` string, nullable, required - `eventId` string[] - `id` string - `index` string[] - `owner` 'cases' | 'observability' | 'securitySolution' — The application that owns the cases: Stack Management, Observability, or Elastic Security. - `pushed_at` string, date-time, nullable - `pushed_by` CasesCaseResponsePushedByProperties, nullable - `email` string, nullable, required - `full_name` string, nullable, required - `profile_uid` string - `username` string, nullable, required - `type` 'event', required - `updated_at` string, date-time, nullable - `updated_by` CasesCaseResponseUpdatedByProperties, nullable - `email` string, nullable, required - `full_name` string, nullable, required - `profile_uid` string - `username` string, nullable, required - `version` string - CasesUserCommentResponseProperties - `comment` string - `created_at` string, date-time - `created_by` CasesCaseResponseCreatedByProperties - `email` string, nullable, required - `full_name` string, nullable, required - `profile_uid` string - `username` string, nullable, required - `id` string - `owner` 'cases' | 'observability' | 'securitySolution' — The application that owns the cases: Stack Management, Observability, or Elastic Security. - `pushed_at` string, date-time, nullable - `pushed_by` CasesCaseResponsePushedByProperties, nullable - `email` string, nullable, required - `full_name` string, nullable, required - `profile_uid` string - `username` string, nullable, required - `type` 'user', required - `updated_at` string, date-time, nullable - `updated_by` CasesCaseResponseUpdatedByProperties, nullable - `email` string, nullable, required - `full_name` string, nullable, required - `profile_uid` string - `username` string, nullable, required - `version` string - `connector` union, required - CasesConnectorPropertiesNone — Defines properties for connectors when type is `.none`. - `fields` string, nullable, required — An object containing the connector fields. To create a case without a connector, specify null. To update a case to remove the connector, specify null. - `id` string, required — The identifier for the connector. To create a case without a connector, use `none`. To update a case to remove the connector, specify `none`. - `name` string, required — The name of the connector. To create a case without a connector, use `none`. To update a case to remove the connector, specify `none`. - `type` '.none', required — The type of connector. To create a case without a connector, use `.none`. To update a case to remove the connector, specify `.none`. - CasesConnectorPropertiesCasesWebhook — Defines properties for connectors when type is `.cases-webhook`. - `fields` string, nullable, required - `id` string, required — The identifier for the connector. To retrieve connector IDs, use the find connectors API. - `name` string, required — The name of the connector. - `type` '.cases-webhook', required — The type of connector. - CasesConnectorPropertiesJira — Defines properties for connectors when type is `.jira`. - `fields` object, required — An object containing the connector fields. If you want to omit any individual field, specify null as its value. - `issueType` string, nullable, required — The type of issue. - `parent` string, nullable, required — The key of the parent issue, when the issue type is sub-task. - `priority` string, nullable, required — The priority of the issue. - `id` string, required — The identifier for the connector. To retrieve connector IDs, use the find connectors API. - `name` string, required — The name of the connector. - `type` '.jira', required — The type of connector. - CasesConnectorPropertiesResilient — Defines properties for connectors when type is `.resilient`. - `fields` object, nullable, required — An object containing the connector fields. If you want to omit any individual field, specify null as its value. - `issueTypes` string[], required — The type of incident. - `severityCode` string, required — The severity code of the incident. - `id` string, required — The identifier for the connector. - `name` string, required — The name of the connector. - `type` '.resilient', required — The type of connector. - CasesConnectorPropertiesServicenow — Defines properties for connectors when type is `.servicenow`. - `fields` object, required — An object containing the connector fields. If you want to omit any individual field, specify null as its value. - `category` string, nullable, required — The category of the incident. - `impact` string, nullable, required — The effect an incident had on business. - `severity` string, nullable, required — The severity of the incident. - `subcategory` string, nullable, required — The subcategory of the incident. - `urgency` string, nullable, required — The extent to which the incident resolution can be delayed. - `id` string, required — The identifier for the connector. To retrieve connector IDs, use the find connectors API. - `name` string, required — The name of the connector. - `type` '.servicenow', required — The type of connector. - CasesConnectorPropertiesServicenowSir — Defines properties for connectors when type is `.servicenow-sir`. - `fields` object, required — An object containing the connector fields. If you want to omit any individual field, specify null as its value. - `category` string, nullable, required — The category of the incident. - `destIp` boolean, nullable, required — Indicates whether cases will send a comma-separated list of destination IPs. - `malwareHash` boolean, nullable, required — Indicates whether cases will send a comma-separated list of malware hashes. - `malwareUrl` boolean, nullable, required — Indicates whether cases will send a comma-separated list of malware URLs. - `priority` string, nullable, required — The priority of the issue. - `sourceIp` boolean, nullable, required — Indicates whether cases will send a comma-separated list of source IPs. - `subcategory` string, nullable, required — The subcategory of the incident. - `id` string, required — The identifier for the connector. To retrieve connector IDs, use the find connectors API. - `name` string, required — The name of the connector. - `type` '.servicenow-sir', required — The type of connector. - CasesConnectorPropertiesSwimlane — Defines properties for connectors when type is `.swimlane`. - `fields` object, required — An object containing the connector fields. If you want to omit any individual field, specify null as its value. - `caseId` string, nullable, required — The case identifier for Swimlane connectors. - `id` string, required — The identifier for the connector. To retrieve connector IDs, use the find connectors API. - `name` string, required — The name of the connector. - `type` '.swimlane', required — The type of connector. - `created_at` string, date-time, required - `created_by` CasesCaseResponseCreatedByProperties, required - `email` string, nullable, required - `full_name` string, nullable, required - `profile_uid` string - `username` string, nullable, required - `customFields` object[] — Custom field values for the case. - `key` string — The unique identifier for the custom field. The key value must exist in the case configuration settings. - `type` 'text' | 'toggle' — The custom field type. It must match the type specified in the case configuration settings. - `value` union — The custom field value. If the custom field is required, it cannot be explicitly set to null. However, for cases that existed when the required custom field was added, the default value stored in Elasticsearch is `undefined`. The value returned in the API and user interface in this case is `null`. - string, nullable - boolean - `description` string, required - `duration` integer, nullable, required — The elapsed time from the creation of the case to its closure (in seconds). If the case has not been closed, the duration is set to null. If the case was closed after less than half a second, the duration is rounded down to zero. - `external_service` CasesExternalService, nullable, required - `connector_id` string - `connector_name` string - `external_id` string - `external_title` string - `external_url` string - `pushed_at` string, date-time - `pushed_by` object, nullable - `email` string, nullable - `full_name` string, nullable - `profile_uid` string - `username` string, nullable - `id` string, required - `incremental_id` integer, nullable — A monotonically increasing number assigned to each case, unique per space. This value is generated asynchronously after the case is created and may not be present immediately in the response. - `observables` CasesCaseObservable[], required — Observables attached to the case. - `createdAt` string, date-time, required — When the observable was created. - `description` string, nullable, required — An optional description for the observable. - `id` string, required — The observable identifier. - `typeKey` string, required — The observable type key. - `updatedAt` string, date-time, nullable, required — When the observable was last updated. - `value` string, required — The observable value. - `owner` 'cases' | 'observability' | 'securitySolution', required — The application that owns the cases: Stack Management, Observability, or Elastic Security. - `settings` CasesSettings, required — An object that contains the case settings. - `extractObservables` boolean — When true, observables (e.g. IPs, hashes, URLs) are automatically extracted from case comments. Optional; defaults to false when omitted. - `syncAlerts` boolean, required — Turns alert syncing on or off. - `severity` 'critical' | 'high' | 'low' | 'medium', required — The severity of the case. - `status` 'closed' | 'in-progress' | 'open', required — The status of the case. - `tags` string[], required - `title` string, required - `total_observables` integer, nullable, required — The number of observables attached to the case. - `totalAlerts` integer, required - `totalComment` integer, required - `totalEvents` integer — The number of events attached to the case. - `updated_at` string, date-time, nullable, required - `updated_by` CasesCaseResponseUpdatedByProperties, nullable, required - `email` string, nullable, required - `full_name` string, nullable, required - `profile_uid` string - `username` string, nullable, required - `version` string, required ## Other responses - `401` — Authorization information is missing or invalid. --- [API](https://skmtc.net/elastic/apis/kibana-apis.md) · [All operations](https://skmtc.net/elastic/apis/kibana-apis/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/elastic/kibana-apis/versions/531c9e2a7d23/schema)