Type to search.

Get all case templates

Base URL
https://{kibana_url}
  • GET /api/cases/templates
  • GET /s/{space_id}/api/cases/templates
Auth

Returns a paginated list of case templates. Requires the Cases feature to be enabled in the space.

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Query parameters

page integer · default: 1

The page number to return.

perPage integer · max: 100 · default: 20

The number of items to return. Limited to 100 items.

sortField enum · default: name

Determines which field is used to sort the results.

Values: templateId name templateVersion owner deletedAt author usageCount fieldCount lastUsedAt isDefault isLatest
sortOrder enum · default: desc

Determines the sort order.

Values: asc desc

An Elasticsearch simple_query_string query that filters the objects in the response.

Example: Case title 1
owner union oneOf

A filter to limit the response to a specific set of applications. If this parameter is omitted, the response contains information about all the cases that the user has access to read.

Values: cases observability securitySolution
tags union string | string[]

Filters the returned templates by tags.

Example: tag-1
author union string | string[]

Filters the returned templates by author username.

Example: elastic
isEnabled boolean

Filters the returned templates by their enabled state.

Responses

Indicates a successful call.

application/json
page integer required

The page number of the returned results.

perPage integer required

The number of results per page.

templates object[] required
author string · max length: 1000

The username of the template author.

definition object required

The parsed template definition.

definitionString string · max length: 30000 required

The raw YAML definition string.

deletedAt string · format: date-time required nullable

The date the template was soft-deleted, or null if active.

description string · max length: 30000

A human-readable description of the template.

fieldCount integer

The number of fields defined in the template.

isDefault boolean

Whether this is the default template for its owner.

isEnabled boolean

Whether the template is enabled.

isLatest boolean required

Whether this is the latest version of the template.

lastUsedAt string · format: date-time

The date the template was last used to create a case.

latestVersion integer required

The latest version number of this template.

name string · max length: 100 required

The display name of the template.

owner string · max length: 50 required

The owning solution (e.g. cases, observability, securitySolution).

tags string[] · max items: 200

The words and phrases that help categorize templates. It can be an empty array.

templateId string · max length: 36 required

The unique identifier of the template, shared across all versions.

templateVersion integer required

The version number of this template revision.

usageCount integer

The number of times this template has been used to create a case.

fieldSearchMatches boolean required

Whether the search query matched a field name in this template.

total integer required

The total number of templates matching the query.