Update case settings

Base URL: https://{kibana_url}

PATCH /api/cases/configure/{configurationId}
PATCH /s/{space_id}/api/cases/configure/{configurationId}

Auth

Updates setting details such as the closure type, custom fields, templates, and the default connector for cases. Connectors are used to interface with external systems. You must create a connector before you can use it in your cases. You must have all privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on where the case was created.

Path parameters

space_id string optional: An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.
configurationId string required: An identifier for the configuration.; Example: 3297a0f0-b5ec-11ec-b141-0fdb20a7f9a9

Header parameters

kbn-xsrf string required: Cross-site request forgery protection

Request body

closure_type enum: Indicates whether a case is automatically closed when it is pushed to external systems (close-by-pushing) or not automatically closed (close-by-user).; Values: close-by-pushing close-by-user
connector object: An object that contains the connector configuration.
customFields object[] deprecated: Custom fields case configuration. Deprecated. Use the field library (/api/cases/field_definitions) to manage field definitions and extended_fields on case create/update to set field values.
extractObservables boolean: Indicates whether observables (for example, IPs, hashes, and URLs) are automatically extracted from case comments and events. Observable extraction is available only for Security cases. For Stack and Observability cases, changing it to true returns a 400 error. A request that keeps an already stored true is accepted.
templates object[] deprecated The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Preview This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.: Configuration-embedded templates. Deprecated: use the templates API (GET /api/cases/templates) and case extended_fields instead.
version string required: The version of the connector. To retrieve the version value, use the get configuration API.
workflowTags string[] · max items: 100: Workflow tags that limit which workflows appear in Cases workflow selectors. An empty array shows all workflows.

Responses

Indicates a successful call.

application/json

closure_type enum: Indicates whether a case is automatically closed when it is pushed to external systems (close-by-pushing) or not automatically closed (close-by-user).; Values: close-by-pushing close-by-user
connector object
created_at string · format: date-time
created_by object
customFields object[] deprecated: Custom fields configuration details. Deprecated. Use the field library (/api/cases/field_definitions) to manage field definitions and extended_fields on case create/update to set field values.
error string nullable
extractObservables boolean: Indicates whether observables (for example, IPs, hashes, and URLs) are automatically extracted from case comments and events.
id string
mappings object[]
observableTypes object[]: Custom observable type configuration details.
owner enum: The application that owns the cases: Stack Management, Observability, or Elastic Security.; Values: cases observability securitySolution
templates object[] deprecated The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Preview This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.: Configuration-embedded templates. Deprecated: use the templates API (GET /api/cases/templates) and case extended_fields instead.; Same fields as templates
updated_at string · format: date-time nullable
updated_by object nullable
version string
workflowTags string[] · max items: 100: Workflow tags that limit which workflows appear in Cases workflow selectors. An empty array shows all workflows.

Authorization information is missing or invalid.