Type to search.

Get case information

Base URL
https://{kibana_url}
Auth

Returns case details. The response does not include a comments property; use the find case comments API to retrieve comments. The totalComment field reflects the actual number of user comments on the case. You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're seeking.

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

caseId string required

The identifier for the case. To retrieve case IDs, use the search cases (_find) API. All non-ASCII characters must be URL encoded.

Example: 9c235210-6834-11ea-a78c-6ffb38a34414

Responses

Indicates a successful call.

application/json
category string nullable

The case category.

closed_at string · format: date-time required nullable
closed_by object required nullable
email string required nullable
full_name string required nullable
profile_uid string
username string required nullable
connector union oneOf required
One of: (determined by type)
type: .none

Defines properties for connectors when type is .none.

type enum required

The type of connector. To create a case without a connector, use .none. To update a case to remove the connector, specify .none.

Values: .none
fields string required nullable

An object containing the connector fields. To create a case without a connector, specify null. To update a case to remove the connector, specify null.

id string required

The identifier for the connector. To create a case without a connector, use none. To update a case to remove the connector, specify none.

name string required

The name of the connector. To create a case without a connector, use none. To update a case to remove the connector, specify none.

created_at string · format: date-time required
created_by object required
email string required nullable
full_name string required nullable
profile_uid string
username string required nullable
description string required
duration integer required nullable

The elapsed time from the creation of the case to its closure (in seconds). If the case has not been closed, the duration is set to null. If the case was closed after less than half a second, the duration is rounded down to zero.

extended_fields map string to string The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Preview since 9.5 This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

The case's stored field values, keyed by storage key (for example priority_as_keyword).

extended_fields_labels map string to string

A read-only, response-only map from active field definition storage keys to their human-readable labels. Entries reflect currently applicable global and template field definitions — not every stored extended_fields key is guaranteed a label, because values retained after switching templates may have no matching current definition. Only populated by the get case and search cases endpoints; absent on create, update, push, and comment responses. Including this field in a write request returns a 400 error.

external_service object required nullable
connector_id string
connector_name string
external_id string
external_title string
external_url string
pushed_at string · format: date-time
id string required
incremental_id integer nullable

A monotonically increasing number assigned to each case, unique per space. This value is generated asynchronously after the case is created and may not be present immediately in the response.

observables object[] required

Observables attached to the case.

createdAt string · format: date-time required

When the observable was created.

description string required nullable

An optional description for the observable.

id string required

The observable identifier.

typeKey string required

The observable type key.

updatedAt string · format: date-time required nullable

When the observable was last updated.

value string required

The observable value.

owner enum required

The application that owns the cases: Stack Management, Observability, or Elastic Security.

Values: cases observability securitySolution
settings object required

An object that contains the case settings.

extractObservables boolean

When true, observables (for example, IPs, hashes, and URLs) are automatically extracted from case comments. When omitted on create, the space configuration default is used. Falls back to the owner's default when no space configuration exists: true for Security, false for Stack and Observability. Precedence: explicit value > template setting > space config > owner default. Observable extraction is available only for Security cases. For Stack and Observability cases, a value that is not sent resolves to false, even if the template or space configuration says true. Sending true returns a 400 error unless the case already stores true.

syncAlerts boolean required

Turns alert syncing on or off.

severity enum required

The severity of the case.

Values: critical high low medium
status enum required

The status of the case.

Values: closed in-progress open
tags string[] required
title string required
total_observables integer required nullable

The number of observables attached to the case.

totalAlerts integer required
totalComment integer required

The number of user comments on the case. Use the find case comments API to retrieve comment content.

totalEvents integer

The number of events attached to the case.

updated_at string · format: date-time required nullable
updated_by object required nullable
email string required nullable
full_name string required nullable
profile_uid string
username string required nullable
version string required