Type to search.

Get the fields applicable to a case

Base URL
https://{kibana_url}
  • GET /api/cases/fields
  • GET /s/{space_id}/api/cases/fields
Auth

Returns the fields you can write to a case's extended_fields when creating a case for the given owner. Includes the owner's global (library-wide) fields and, when templateId is supplied, that template's fields. Migrated legacy custom fields appear as global fields. Requires the Cases feature to be enabled in the space.

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Query parameters

owner string · max length: 30 required

The application that owns the cases (for example cases, observability, or securitySolution).

Example: cases
templateId string · max length: 36

The identifier of a template to include the template's fields in the response.

Responses

Indicates a successful call.

application/json
fields object[] required
control string required

The UI control for the field, such as INPUT_TEXT, INPUT_NUMBER, SELECT_BASIC, TOGGLE, or MARKDOWN.

defaultValue string

The default value, as a string, when the field definition declares one.

displayOnly boolean required

When true the field is display-only (for example a MARKDOWN block): it is returned so the full form shape is visible, but it holds no value and its key cannot be written to extended_fields.

isGlobal boolean required

Whether the field is a global (library-wide) definition.

key string required

The storage key to write in the case extended_fields map. Follows the <field_name>_as_<storage_type> convention (for example priority_as_keyword).

label string required

The human-readable label. Falls back to name when no label is authored.

name string required

The field name as authored in the field definition.

options string[]

The allowed values for SELECT_BASIC, RADIO_GROUP, and CHECKBOX_GROUP fields.

type string required

The storage type: keyword, integer, long, boolean, or date.

required boolean required

Whether a value must be supplied at write time.

requiredOnClose boolean required

Whether the field must be filled before the case can be closed.

source enum required

Where the field comes from: global for a library-wide (isGlobal) definition writable on any case, or template for a field contributed by the applied template.

Values: global template