Type to search.

Create a case template

Base URL
https://{kibana_url}
  • POST /api/cases/templates
  • POST /s/{space_id}/api/cases/templates
Auth The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Preview This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

Creates a case template from a YAML definition. You must have the "Manage templates" sub-privilege for the Cases feature of the owning solution. Set dry_run=true to run the full validation (body, YAML definition, name uniqueness, authorization) without creating anything. Requires the Cases feature to be enabled in the space.

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Query parameters

dry_run boolean · default: false

When true, validates the request without creating the template and returns {"valid": true}.

Request body

definition string · max length: 30000 required

The template definition as a YAML string: case defaults (name, severity, category, tags, assignees, connector, settings) and a fields array of inline field definitions or $ref entries pointing into the owner's field library. Stored field values appear on cases under extended_fields keys shaped <field_name>_as_<storage_type>. Observable extraction (settings.extractObservables) is available only for Security templates. For Stack and Observability templates, setting it to true returns a 400 error. An update that keeps an already stored true for the same owner is accepted.

description string · max length: 1000

A description of the template.

isEnabled boolean · default: true

Disabled templates are hidden from the case creation flow.

name string · min length: 1 · max length: 50

The template identity name, unique per owner (case-insensitive). May be omitted when the YAML definition provides a case-default title (name:), which is then used as the identity name.

owner enum required

The application that owns the cases: Stack Management, Observability, or Elastic Security.

Values: cases observability securitySolution
tags string[] · max items: 200

The words and phrases that help categorize templates. It can be an empty array.

Responses

Indicates a successful call. Returns the created template, or {"valid": true} for a dry run.

application/json
One of:

A case template (v2).

author string · max length: 1000

The username of the template author.

definition object required

The parsed template definition.

definitionString string · max length: 30000 required

The raw YAML definition string.

deletedAt string · format: date-time required nullable

The date the template was soft-deleted, or null if active.

description string · max length: 30000

A human-readable description of the template.

fieldCount integer

The number of fields defined in the template.

isDefault boolean

Whether this is the default template for its owner.

isEnabled boolean

Whether the template is enabled.

isLatest boolean required

Whether this is the latest version of the template.

lastUsedAt string · format: date-time

The date the template was last used to create a case.

latestVersion integer required

The latest version number of this template.

name string · max length: 100 required

The display name of the template.

owner string · max length: 50 required

The owning solution (e.g. cases, observability, securitySolution).

tags string[] · max items: 200

The words and phrases that help categorize templates. It can be an empty array.

templateId string · max length: 36 required

The unique identifier of the template, shared across all versions.

templateVersion integer required

The version number of this template revision.

usageCount integer

The number of times this template has been used to create a case.