Get case settings
- Base URL
-
https://{kibana_url}
- GET /api/cases/configure
- GET /s/{space_id}/api/cases/configure
Get setting details such as the closure type, custom fields, templates, and the default connector for cases. You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on where the cases were created.
Path parameters
-
space_idstringoptional -
An identifier for the space. If
space_idis not provided in the URL, the default space is used. Refer to Spaces for more information.
Responses
Indicates a successful call.
<array>object[]-
closure_typeenum -
Indicates whether a case is automatically closed when it is pushed to external systems (
close-by-pushing) or not automatically closed (close-by-user). -
Values:
close-by-pushingclose-by-user -
connectorobject -
fieldsobjectnullable -
The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to
null. -
idstring -
The identifier for the connector. If you do not want a default connector, use
none. To retrieve connector IDs, use the find connectors API. -
customFieldsobject[]deprecated -
Custom fields configuration details. Deprecated. Use the field library (
/api/cases/field_definitions) to manage field definitions andextended_fieldson case create/update to set field values. -
extractObservablesboolean -
Indicates whether observables (for example, IPs, hashes, and URLs) are automatically extracted from case comments and events.
-
ownerenum -
The application that owns the cases: Stack Management, Observability, or Elastic Security.
-
Values:
casesobservabilitysecuritySolution -
templatesobject[]deprecated The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Preview This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. -
Configuration-embedded templates. Deprecated: use the templates API (
GET /api/cases/templates) and caseextended_fieldsinstead. -
caseFieldsobject -
assigneesobject[] · max items: 10nullable -
An array containing users that are assigned to the case.
-
connectorobject -
fieldsobjectnullable -
The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to
null. -
idstring -
The identifier for the connector. If you do not want a default connector, use
none. To retrieve connector IDs, use the find connectors API. -
customFieldsobject[]The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Preview This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. -
Custom field values in the template.
-
settingsobject -
An object that contains the case settings.
-
extractObservablesboolean -
When true, observables (for example, IPs, hashes, and URLs) are automatically extracted from case comments. When omitted on create, the space configuration default is used. Falls back to the owner's default when no space configuration exists:
truefor Security,falsefor Stack and Observability. Precedence: explicit value > template setting > space config > owner default. Observable extraction is available only for Security cases. For Stack and Observability cases, a value that is not sent resolves tofalse, even if the template or space configuration saystrue. Sendingtruereturns a 400 error unless the case already storestrue.