Type to search.

Create a field definition

Base URL
https://{kibana_url}
  • POST /api/cases/field_definitions
  • POST /s/{space_id}/api/cases/field_definitions
Auth The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Preview This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

Creates a field definition in the field library. You must have the "Manage templates" sub-privilege for the Cases feature of the owning solution. Requires the Cases feature to be enabled in the space. Use dry_run=true to validate the request without writing anything.

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Query parameters

dry_run boolean · default: false

When true, runs authorization, body, and name-uniqueness validation without creating the field definition. Returns { "valid": true } on success.

Request body

definition string · max length: 30000 required

The field definition as a YAML string describing a single field (type, label, control, metadata).

description string · max length: 1000

Optional human-readable description of the field's purpose.

isGlobal boolean

When true, this field is rendered in every case for this owner, regardless of the template used. Global fields cannot be demoted (set to false) while they are linked to an active custom field in the Cases configuration.

name string · min length: 1 · max length: 50

The field name, unique per owner (case-insensitive). Must match the name key inside the YAML definition. When omitted, the name is extracted from the definition YAML automatically. Immutable after creation.

owner string · min length: 1 · max length: 30 required

The application that owns this field definition.

Responses

Indicates a successful call. Returns the created field definition, or { "valid": true } when dry_run=true.

application/json
One of:

A field definition from the field library. The legacyKey attribute, which is a server-managed link to a migrated custom field, is not included in the public API response.

definition string required

The field definition as a YAML string. New definitions are limited to 30 000 characters, but existing definitions created via internal tooling may be longer.

description string

Optional human-readable description of the field's purpose.

displayOrder integer · min: 0

Position of a global field in the case details view. Assigned by the server and changed via the Field Library reorder controls.

fieldDefinitionId string · max length: 36 required

Unique server-assigned identifier for the field definition (UUID). May be UUIDv4 for definitions created through the public API, or UUIDv5 for definitions created by internal migration processes.

isGlobal boolean

When true, this field is rendered in every case regardless of which template the case uses.

name string required

The field name. Must match the name property in the YAML definition and is unique per owner (case-insensitive). Immutable after creation.

owner string · max length: 50 required

The application that owns this field definition.