openapi: 3.2.0
info:
  contact:
    name: Kibana Team
  description: 'The Kibana REST APIs enable you to manage resources such as connectors, data views, and saved objects.

    The API calls are stateless.

    Each request that you make happens in isolation from other calls and must include all of the necessary information for Kibana to fulfill the

    request.

    API requests return JSON output, which is a format that is machine-readable and works well for automation.


    To interact with Kibana APIs, use the following operations:


    - GET: Fetches the information.

    - PATCH: Applies partial modifications to the existing information.

    - POST: Adds new information.

    - PUT: Updates the existing information.

    - DELETE: Removes the information.


    You can prepend any Kibana API endpoint with `kbn:` and run the request in **Dev Tools → Console**.

    For example:


    ```

    GET kbn:/api/data_views

    ```


    For more information about the console, refer to [Run API requests](https://www.elastic.co/docs/explore-analyze/query-filter/tools/console).


    NOTE: Access to internal Kibana API endpoints will be restricted in Kibana version 9.0. Please move any integrations to publicly documented APIs.


    ## Documentation source and versions


    This documentation is derived from the `main` branch of the [kibana](https://github.com/elastic/kibana) repository.

    It is provided under license [Attribution-NonCommercial-NoDerivatives 4.0 International](https://creativecommons.org/licenses/by-nc-nd/4.0/).


    This documentation contains work-in-progress information for future Elastic Stack releases.

    '
  title: Kibana Cases API
  version: ''
  x-doc-license:
    name: Attribution-NonCommercial-NoDerivatives 4.0 International
    url: https://creativecommons.org/licenses/by-nc-nd/4.0/
  x-feedbackLink:
    label: Feedback
    url: https://github.com/elastic/docs-content/issues/new?assignees=&labels=feedback%2Ccommunity&projects=&template=api-feedback.yaml&title=%5BFeedback%5D%3A+
servers:
- url: https://{kibana_url}
  variables:
    kibana_url:
      default: localhost:5601
security:
- apiKeyAuth: []
- basicAuth: []
tags:
- description: 'Cases are used to open and track issues. You can add assignees and tags to your cases, set their severity and status, and add alerts, comments, and visualizations. You can also send cases to external incident management systems by configuring connectors.

    '
  name: cases
  externalDocs:
    description: Cases documentation
    url: https://www.elastic.co/docs/explore-analyze/alerts-cases/cases
  x-displayName: Cases
paths:
  /api/cases:
    delete:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        You must have `read` or `all` privileges and the `delete` sub-feature privilege for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you''re deleting.

        '
      operationId: deleteCaseDefaultSpace
      parameters:
      - $ref: '#/components/parameters/Cases_kbn_xsrf'
      - $ref: '#/components/parameters/Cases_ids'
      responses:
        '204':
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Delete cases
      tags:
      - cases
      x-codeSamples:
      - label: curl
        lang: curl
        source: "curl \\\n  --request DELETE 'https://localhost:5601/api/cases?ids=%5B%22030e6e34-6470-4001-864f-b229511ad188%22%2C%22e662ff34-0493-4538-b9d1-6706ced02ff2%22%5D' \\\n  --header \"Authorization: $API_KEY\" \\\n  --header \"Content-Type: application/json\" \\\n  --header \"kbn-xsrf: true\"\n"
      - label: Console
        lang: console
        source: 'DELETE kbn:/api/cases?ids=["030e6e34-6470-4001-864f-b229511ad188","e662ff34-0493-4538-b9d1-6706ced02ff2"]

          '
      x-metaTags:
      - content: Kibana
        name: product_name
    patch:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb patch">patch</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        You must have `all` privileges for the **Cases** feature in the  **Management**, **Observability**, or **Security** section of the Kibana  feature privileges, depending on the owner of the case you''re updating.

        '
      operationId: updateCaseDefaultSpace
      parameters:
      - $ref: '#/components/parameters/Cases_kbn_xsrf'
      requestBody:
        content:
          application/json:
            examples:
              updateCaseRequest:
                $ref: '#/components/examples/Cases_update_case_request'
            schema:
              $ref: '#/components/schemas/Cases_update_case_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                updateCaseResponse:
                  $ref: '#/components/examples/Cases_update_case_response'
              schema:
                items:
                  $ref: '#/components/schemas/Cases_case_response_properties'
                type: array
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Update cases
      tags:
      - cases
      x-metaTags:
      - content: Kibana
        name: product_name
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana  feature privileges, depending on the owner of the case you''re creating.

        '
      operationId: createCaseDefaultSpace
      parameters:
      - $ref: '#/components/parameters/Cases_kbn_xsrf'
      requestBody:
        content:
          application/json:
            examples:
              createCaseRequest:
                $ref: '#/components/examples/Cases_create_case_request'
            schema:
              $ref: '#/components/schemas/Cases_create_case_request'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                createCaseResponse:
                  $ref: '#/components/examples/Cases_create_case_response'
              schema:
                $ref: '#/components/schemas/Cases_case_response_properties'
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Create a case
      tags:
      - cases
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/cases/_find:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/_find</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you''re seeking.

        '
      operationId: findCasesDefaultSpace
      parameters:
      - $ref: '#/components/parameters/Cases_assignees_filter'
      - $ref: '#/components/parameters/Cases_category'
      - $ref: '#/components/parameters/Cases_defaultSearchOperator'
      - $ref: '#/components/parameters/Cases_from'
      - $ref: '#/components/parameters/Cases_owner_filter'
      - $ref: '#/components/parameters/Cases_page_index'
      - $ref: '#/components/parameters/Cases_page_size'
      - $ref: '#/components/parameters/Cases_reporters'
      - $ref: '#/components/parameters/Cases_search'
      - $ref: '#/components/parameters/Cases_searchFields'
      - $ref: '#/components/parameters/Cases_severity'
      - $ref: '#/components/parameters/Cases_sortField'
      - $ref: '#/components/parameters/Cases_sort_order'
      - $ref: '#/components/parameters/Cases_status'
      - $ref: '#/components/parameters/Cases_tags'
      - $ref: '#/components/parameters/Cases_to'
      responses:
        '200':
          content:
            application/json:
              examples:
                findCaseResponse:
                  $ref: '#/components/examples/Cases_find_case_response'
              schema:
                type: object
                properties:
                  cases:
                    items:
                      $ref: '#/components/schemas/Cases_case_response_properties'
                    maxItems: 10000
                    type: array
                  count_closed_cases:
                    type: integer
                  count_in_progress_cases:
                    type: integer
                  count_open_cases:
                    type: integer
                  page:
                    type: integer
                  per_page:
                    type: integer
                  total:
                    type: integer
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Search cases
      tags:
      - cases
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/cases/{caseId}:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/{caseId}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Returns case details. The response does not include a comments property;  use the find case comments API to retrieve comments. The totalComment field  reflects the actual number of user comments on the case. You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you''re seeking.

        '
      operationId: getCaseDefaultSpace
      parameters:
      - $ref: '#/components/parameters/Cases_case_id'
      responses:
        '200':
          content:
            application/json:
              examples:
                getDefaultCaseResponse:
                  $ref: '#/components/examples/Cases_get_case_response'
                getDefaultObservabilityCaseResponse:
                  $ref: '#/components/examples/Cases_get_case_observability_response'
              schema:
                $ref: '#/components/schemas/Cases_case_response_get_case'
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Get case information
      tags:
      - cases
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/cases/{caseId}/alerts:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/{caseId}/alerts</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you''re seeking.

        '
      operationId: getCaseAlertsDefaultSpace
      parameters:
      - $ref: '#/components/parameters/Cases_case_id'
      responses:
        '200':
          content:
            application/json:
              examples:
                getCaseAlertsResponse:
                  $ref: '#/components/examples/Cases_get_case_alerts_response'
              schema:
                items:
                  $ref: '#/components/schemas/Cases_alert_response_properties'
                type: array
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Get all alerts for a case
      tags:
      - cases
      x-state: Technical preview
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/cases/{caseId}/comments:
    delete:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/{caseId}/comments</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Deletes all comments and alerts from a case. You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you''re deleting.

        '
      operationId: deleteCaseCommentsDefaultSpace
      parameters:
      - $ref: '#/components/parameters/Cases_kbn_xsrf'
      - $ref: '#/components/parameters/Cases_case_id'
      responses:
        '204':
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Delete all case comments and alerts
      tags:
      - cases
      x-codeSamples:
      - label: curl
        lang: curl
        source: "curl \\\n  --request DELETE 'https://localhost:5601/api/cases/9c235210-6834-11ea-a78c-6ffb38a34414/comments' \\\n  --header \"Authorization: $API_KEY\" \\\n  --header \"kbn-xsrf: true\"\n"
      - label: Console
        lang: console
        source: 'DELETE kbn:/api/cases/9c235210-6834-11ea-a78c-6ffb38a34414/comments

          '
      x-metaTags:
      - content: Kibana
        name: product_name
    patch:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb patch">patch</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/{caseId}/comments</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you''re updating. NOTE: You cannot change the comment type or the owner of a comment.

        '
      operationId: updateCaseCommentDefaultSpace
      parameters:
      - $ref: '#/components/parameters/Cases_kbn_xsrf'
      - $ref: '#/components/parameters/Cases_case_id'
      requestBody:
        content:
          application/json:
            examples:
              updateCaseCommentRequest:
                $ref: '#/components/examples/Cases_update_comment_request'
            schema:
              $ref: '#/components/schemas/Cases_update_case_comment_request'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                updateCaseCommentResponse:
                  $ref: '#/components/examples/Cases_update_comment_response'
              schema:
                $ref: '#/components/schemas/Cases_case_response_properties'
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Update a case comment or alert
      tags:
      - cases
      x-metaTags:
      - content: Kibana
        name: product_name
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/{caseId}/comments</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you''re creating. NOTE: Each case can have a maximum of 1,000 alerts.

        '
      operationId: addCaseCommentDefaultSpace
      parameters:
      - $ref: '#/components/parameters/Cases_kbn_xsrf'
      - $ref: '#/components/parameters/Cases_case_id'
      requestBody:
        content:
          application/json:
            examples:
              createCaseCommentRequest:
                $ref: '#/components/examples/Cases_add_comment_request'
            schema:
              $ref: '#/components/schemas/Cases_add_case_comment_request'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                createCaseCommentResponse:
                  $ref: '#/components/examples/Cases_add_comment_response'
              schema:
                $ref: '#/components/schemas/Cases_case_response_properties'
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Add a case comment or alert
      tags:
      - cases
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/cases/{caseId}/comments/_find:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/{caseId}/comments/_find</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Retrieves a paginated list of comments for a case. You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases with the comments you''re seeking.

        '
      operationId: findCaseCommentsDefaultSpace
      parameters:
      - $ref: '#/components/parameters/Cases_case_id'
      - $ref: '#/components/parameters/Cases_page_index'
      - $ref: '#/components/parameters/Cases_page_size'
      - $ref: '#/components/parameters/Cases_sort_order'
      responses:
        '200':
          content:
            application/json:
              examples:
                findCaseCommentsResponse:
                  $ref: '#/components/examples/Cases_find_case_comments_response'
              schema:
                $ref: '#/components/schemas/Cases_find_comments_response'
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Find case comments
      tags:
      - cases
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/cases/{caseId}/comments/{commentId}:
    delete:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/{caseId}/comments/{commentId}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you''re deleting.

        '
      operationId: deleteCaseCommentDefaultSpace
      parameters:
      - $ref: '#/components/parameters/Cases_kbn_xsrf'
      - $ref: '#/components/parameters/Cases_case_id'
      - $ref: '#/components/parameters/Cases_comment_id'
      responses:
        '204':
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Delete a case comment or alert
      tags:
      - cases
      x-codeSamples:
      - label: curl
        lang: curl
        source: "curl \\\n  --request DELETE 'https://localhost:5601/api/cases/9c235210-6834-11ea-a78c-6ffb38a34414/comments/71ec1870-725b-11ea-a0b2-c51ea50a58e2' \\\n  --header \"Authorization: $API_KEY\" \\\n  --header \"kbn-xsrf: true\"\n"
      - label: Console
        lang: console
        source: 'DELETE kbn:/api/cases/9c235210-6834-11ea-a78c-6ffb38a34414/comments/71ec1870-725b-11ea-a0b2-c51ea50a58e2

          '
      x-metaTags:
      - content: Kibana
        name: product_name
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/{caseId}/comments/{commentId}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases with the comments you''re seeking.

        '
      operationId: getCaseCommentDefaultSpace
      parameters:
      - $ref: '#/components/parameters/Cases_case_id'
      - $ref: '#/components/parameters/Cases_comment_id'
      responses:
        '200':
          content:
            application/json:
              examples:
                getCaseCommentResponse:
                  $ref: '#/components/examples/Cases_get_comment_response'
              schema:
                oneOf:
                - $ref: '#/components/schemas/Cases_alert_comment_response_properties'
                - $ref: '#/components/schemas/Cases_user_comment_response_properties'
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Get a case comment or alert
      tags:
      - cases
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/cases/{caseId}/connector/{connectorId}/_push:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/{caseId}/connector/{connectorId}/_push</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        You must have `all` privileges for the **Actions and Connectors** feature in the **Management** section of the Kibana feature privileges. You must also have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you''re pushing.

        '
      operationId: pushCaseDefaultSpace
      parameters:
      - $ref: '#/components/parameters/Cases_case_id'
      - $ref: '#/components/parameters/Cases_connector_id'
      - $ref: '#/components/parameters/Cases_kbn_xsrf'
      requestBody:
        content:
          application/json:
            examples:
              pushCaseRequest:
                summary: Push a case to an external service. No request body is required.
                value: null
            schema:
              type:
              - object
              - 'null'
      responses:
        '200':
          content:
            application/json:
              examples:
                pushCaseResponse:
                  $ref: '#/components/examples/Cases_push_case_response'
              schema:
                $ref: '#/components/schemas/Cases_case_response_properties'
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Push a case to an external service
      tags:
      - cases
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/cases/{caseId}/fields:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/{caseId}/fields</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Returns the fields you can write to the case''s `extended_fields`. The case determines the owner and any applied template. The response includes the owner''s global fields (library-wide) and, if the case has a template, that template''s fields. Requires the Cases feature to be enabled in the space.

        '
      operationId: getCaseApplicableFieldsDefaultSpace
      parameters:
      - $ref: '#/components/parameters/Cases_case_id'
      responses:
        '200':
          content:
            application/json:
              examples:
                getCaseApplicableFieldsResponse:
                  $ref: '#/components/examples/Cases_get_case_applicable_fields_response'
              schema:
                $ref: '#/components/schemas/Cases_applicable_fields_response'
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
        '403':
          content:
            application/json:
              examples:
                response403:
                  $ref: '#/components/examples/Cases_response_403'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: The user does not have access to the case.
        '404':
          content:
            application/json:
              examples:
                response404:
                  $ref: '#/components/examples/Cases_response_404'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: The case was not found.
      summary: Get the fields applicable to an existing case
      tags:
      - cases
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/cases/{caseId}/files:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/{caseId}/files</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Attach a file to a case. You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you''re updating. The request must include:

        - The `Content-Type: multipart/form-data` HTTP header.

        - The location of the file that is being uploaded.

        '
      operationId: addCaseFileDefaultSpace
      parameters:
      - $ref: '#/components/parameters/Cases_kbn_xsrf'
      - $ref: '#/components/parameters/Cases_case_id'
      requestBody:
        content:
          multipart/form-data:
            examples:
              addCaseFileRequest:
                summary: Attach a plain text file named "my_attachment".
                value:
                  filename: my_attachment
            schema:
              $ref: '#/components/schemas/Cases_add_case_file_request'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                addCaseFileResponse:
                  $ref: '#/components/examples/Cases_add_comment_response'
              schema:
                $ref: '#/components/schemas/Cases_case_response_properties'
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Attach a file to a case
      tags:
      - cases
      x-codeSamples:
      - label: curl
        lang: curl
        source: "curl \\\n  --request POST 'https://localhost:5601/api/cases/9c235210-6834-11ea-a78c-6ffb38a34414/files' \\\n  --header \"Authorization: $API_KEY\" \\\n  --header \"kbn-xsrf: true\" \\\n  --form \"file=@/path/to/my_attachment.txt\" \\\n  --form \"filename=my_attachment\"\n"
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/cases/{caseId}/user_actions/_find:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/{caseId}/user_actions/_find</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Retrieves a paginated list of user activity for a case. You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you''re seeking.

        '
      operationId: findCaseActivityDefaultSpace
      parameters:
      - $ref: '#/components/parameters/Cases_case_id'
      - $ref: '#/components/parameters/Cases_page_index'
      - $ref: '#/components/parameters/Cases_page_size'
      - $ref: '#/components/parameters/Cases_sort_order'
      - $ref: '#/components/parameters/Cases_user_action_types'
      responses:
        '200':
          content:
            application/json:
              examples:
                findCaseActivityResponse:
                  $ref: '#/components/examples/Cases_find_case_activity_response'
              schema:
                type: object
                properties:
                  page:
                    type: integer
                  perPage:
                    type: integer
                  total:
                    type: integer
                  userActions:
                    items:
                      $ref: '#/components/schemas/Cases_user_actions_find_response_properties'
                    maxItems: 10000
                    type: array
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Find case activity
      tags:
      - cases
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/cases/alerts/{alertId}:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/alerts/{alertId}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you''re seeking.

        '
      operationId: getCasesByAlertDefaultSpace
      parameters:
      - $ref: '#/components/parameters/Cases_alert_id'
      - $ref: '#/components/parameters/Cases_owner_filter'
      responses:
        '200':
          content:
            application/json:
              examples:
                getCasesByAlertResponse:
                  summary: Cases associated with a given alert.
                  value:
                  - createdAt: '2020-02-19T23:06:33.798Z'
                    description: Investigating suspicious activity
                    id: 06116b80-e1c3-11ec-be9b-9b1838238ee6
                    status: open
                    title: security_case
                    totals:
                      alerts: 1
                      events: 0
                      userComments: 0
              schema:
                items:
                  $ref: '#/components/schemas/Cases_related_case'
                maxItems: 10000
                type: array
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Get cases for an alert
      tags:
      - cases
      x-state: Technical preview
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/cases/configure:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/configure</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get setting details such as the closure type, custom fields, templates, and the default connector for cases. You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on where the cases were created.

        '
      operationId: getCaseConfigurationDefaultSpace
      parameters:
      - $ref: '#/components/parameters/Cases_owner_filter'
      responses:
        '200':
          content:
            application/json:
              examples:
                getConfigurationResponse:
                  $ref: '#/components/examples/Cases_get_case_configuration_response'
              schema:
                items:
                  type: object
                  properties:
                    closure_type:
                      $ref: '#/components/schemas/Cases_closure_types'
                    connector:
                      type: object
                      properties:
                        fields:
                          description: The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to `null`.
                          type:
                          - object
                          - 'null'
                        id:
                          description: The identifier for the connector. If you do not want a default connector, use `none`. To retrieve connector IDs, use the find connectors API.
                          example: none
                          type: string
                        name:
                          description: The name of the connector. If you do not want a default connector, use `none`. To retrieve connector names, use the find connectors API.
                          example: none
                          type: string
                        type:
                          $ref: '#/components/schemas/Cases_connector_types'
                    created_at:
                      example: '2022-06-01T17:07:17.767Z'
                      format: date-time
                      type: string
                    created_by:
                      type: object
                      properties:
                        email:
                          example: null
                          type:
                          - string
                          - 'null'
                        full_name:
                          example: null
                          type:
                          - string
                          - 'null'
                        profile_uid:
                          example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
                          type: string
                        username:
                          example: elastic
                          type:
                          - string
                          - 'null'
                      required:
                      - email
                      - full_name
                      - username
                    customFields:
                      description: Custom fields configuration details.
                      items:
                        type: object
                        properties:
                          defaultValue:
                            description: 'A default value for the custom field. If the `type` is `text`, the default value must be a string. If the `type` is `toggle`, the default value must be boolean.

                              '
                            oneOf:
                            - type: string
                            - type: boolean
                          key:
                            description: 'A unique key for the custom field. Must be lower case and composed only of a-z, 0-9, ''_'', and ''-'' characters. It is used in API calls to refer to a specific custom field.

                              '
                            maxLength: 36
                            minLength: 1
                            type: string
                          label:
                            description: The custom field label that is displayed in the case.
                            maxLength: 50
                            minLength: 1
                            type: string
                          type:
                            description: The type of the custom field.
                            enum:
                            - text
                            - toggle
                            type: string
                          required:
                            description: 'Indicates whether the field is required. If `false`, the custom field can be set to null or omitted when a case is created or updated.

                              '
                            type: boolean
                      type: array
                    error:
                      example: null
                      type:
                      - string
                      - 'null'
                    id:
                      example: 4a97a440-e1cd-11ec-be9b-9b1838238ee6
                      type: string
                    mappings:
                      items:
                        type: object
                        properties:
                          action_type:
                            example: overwrite
                            type: string
                          source:
                            example: title
                            type: string
                          target:
                            example: summary
                            type: string
                      type: array
                    observableTypes:
                      description: Custom observable type configuration details.
                      items:
                        type: object
                        properties:
                          key:
                            description: The observable type key.
                            example: d312efda-ec2b-42ec-9e2c-84981795c581
                            type: string
                          label:
                            description: The observable type label.
                            example: My observable type
                            type: string
                      type: array
                    owner:
                      $ref: '#/components/schemas/Cases_owner'
                    templates:
                      $ref: '#/components/schemas/Cases_templates'
                    updated_at:
                      example: '2022-06-01T19:58:48.169Z'
                      format: date-time
                      type:
                      - string
                      - 'null'
                    updated_by:
                      type:
                      - object
                      - 'null'
                      properties:
                        email:
                          example: null
                          type:
                          - string
                          - 'null'
                        full_name:
                          example: null
                          type:
                          - string
                          - 'null'
                        profile_uid:
                          example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
                          type: string
                        username:
                          example: elastic
                          type:
                          - string
                          - 'null'
                      required:
                      - email
                      - full_name
                      - username
                    version:
                      example: WzIwNzMsMV0=
                      type: string
                type: array
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Get case settings
      tags:
      - cases
      x-metaTags:
      - content: Kibana
        name: product_name
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/configure</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Case settings include external connection details, custom fields, and templates. Connectors are used to interface with external systems. You must create a connector before you can use it in your cases. If you set a default connector, it is automatically selected when you create cases in Kibana. If you use the create case API, however, you must still specify all of the connector details. You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on where you are creating cases.

        '
      operationId: setCaseConfigurationDefaultSpace
      parameters:
      - $ref: '#/components/parameters/Cases_kbn_xsrf'
      requestBody:
        content:
          application/json:
            examples:
              setCaseConfigRequest:
                $ref: '#/components/examples/Cases_set_case_configuration_request'
            schema:
              $ref: '#/components/schemas/Cases_set_case_configuration_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                setCaseConfigResponse:
                  $ref: '#/components/examples/Cases_set_case_configuration_response'
              schema:
                type: object
                properties:
                  closure_type:
                    $ref: '#/components/schemas/Cases_closure_types'
                  connector:
                    type: object
                    properties:
                      fields:
                        description: The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to `null`.
                        type:
                        - object
                        - 'null'
                      id:
                        description: The identifier for the connector. If you do not want a default connector, use `none`. To retrieve connector IDs, use the find connectors API.
                        example: none
                        type: string
                      name:
                        description: The name of the connector. If you do not want a default connector, use `none`. To retrieve connector names, use the find connectors API.
                        example: none
                        type: string
                      type:
                        $ref: '#/components/schemas/Cases_connector_types'
                  created_at:
                    example: '2022-06-01T17:07:17.767Z'
                    format: date-time
                    type: string
                  created_by:
                    type: object
                    properties:
                      email:
                        example: null
                        type:
                        - string
                        - 'null'
                      full_name:
                        example: null
                        type:
                        - string
                        - 'null'
                      profile_uid:
                        example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
                        type: string
                      username:
                        example: elastic
                        type:
                        - string
                        - 'null'
                    required:
                    - email
                    - full_name
                    - username
                  customFields:
                    description: Custom fields configuration details.
                    items:
                      type: object
                      properties:
                        defaultValue:
                          description: 'A default value for the custom field. If the `type` is `text`, the default value must be a string. If the `type` is `toggle`, the default value must be boolean.

                            '
                          oneOf:
                          - type: string
                          - type: boolean
                        key:
                          description: 'A unique key for the custom field. Must be lower case and composed only of a-z, 0-9, ''_'', and ''-'' characters. It is used in API calls to refer to a specific custom field.

                            '
                          maxLength: 36
                          minLength: 1
                          type: string
                        label:
                          description: The custom field label that is displayed in the case.
                          maxLength: 50
                          minLength: 1
                          type: string
                        type:
                          description: The type of the custom field.
                          enum:
                          - text
                          - toggle
                          type: string
                        required:
                          description: 'Indicates whether the field is required. If `false`, the custom field can be set to null or omitted when a case is created or updated.

                            '
                          type: boolean
                    type: array
                  error:
                    example: null
                    type:
                    - string
                    - 'null'
                  id:
                    example: 4a97a440-e1cd-11ec-be9b-9b1838238ee6
                    type: string
                  mappings:
                    items:
                      type: object
                      properties:
                        action_type:
                          example: overwrite
                          type: string
                        source:
                          example: title
                          type: string
                        target:
                          example: summary
                          type: string
                    type: array
                  observableTypes:
                    description: Custom observable type configuration details.
                    items:
                      type: object
                      properties:
                        key:
                          description: The observable type key.
                          example: d312efda-ec2b-42ec-9e2c-84981795c581
                          type: string
                        label:
                          description: The observable type label.
                          example: My observable type
                          type: string
                    type: array
                  owner:
                    $ref: '#/components/schemas/Cases_owner'
                  templates:
                    $ref: '#/components/schemas/Cases_templates'
                  updated_at:
                    example: '2022-06-01T19:58:48.169Z'
                    format: date-time
                    type:
                    - string
                    - 'null'
                  updated_by:
                    type:
                    - object
                    - 'null'
                    properties:
                      email:
                        example: null
                        type:
                        - string
                        - 'null'
                      full_name:
                        example: null
                        type:
                        - string
                        - 'null'
                      profile_uid:
                        example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
                        type: string
                      username:
                        example: elastic
                        type:
                        - string
                        - 'null'
                    required:
                    - email
                    - full_name
                    - username
                  version:
                    example: WzIwNzMsMV0=
                    type: string
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Add case settings
      tags:
      - cases
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/cases/configure/{configurationId}:
    patch:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb patch">patch</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/configure/{configurationId}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Updates setting details such as the closure type, custom fields, templates, and the default connector for cases. Connectors are used to interface with external systems. You must create a connector before you can use it in your cases. You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on where the case was created.

        '
      operationId: updateCaseConfigurationDefaultSpace
      parameters:
      - $ref: '#/components/parameters/Cases_kbn_xsrf'
      - $ref: '#/components/parameters/Cases_configuration_id'
      requestBody:
        content:
          application/json:
            examples:
              updateCaseConfigurationRequest:
                $ref: '#/components/examples/Cases_update_case_configuration_request'
            schema:
              $ref: '#/components/schemas/Cases_update_case_configuration_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                updateCaseConfigurationResponse:
                  $ref: '#/components/examples/Cases_update_case_configuration_response'
              schema:
                type: object
                properties:
                  closure_type:
                    $ref: '#/components/schemas/Cases_closure_types'
                  connector:
                    type: object
                    properties:
                      fields:
                        description: The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to `null`.
                        type:
                        - object
                        - 'null'
                      id:
                        description: The identifier for the connector. If you do not want a default connector, use `none`. To retrieve connector IDs, use the find connectors API.
                        example: none
                        type: string
                      name:
                        description: The name of the connector. If you do not want a default connector, use `none`. To retrieve connector names, use the find connectors API.
                        example: none
                        type: string
                      type:
                        $ref: '#/components/schemas/Cases_connector_types'
                  created_at:
                    example: '2022-06-01T17:07:17.767Z'
                    format: date-time
                    type: string
                  created_by:
                    type: object
                    properties:
                      email:
                        example: null
                        type:
                        - string
                        - 'null'
                      full_name:
                        example: null
                        type:
                        - string
                        - 'null'
                      profile_uid:
                        example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
                        type: string
                      username:
                        example: elastic
                        type:
                        - string
                        - 'null'
                    required:
                    - email
                    - full_name
                    - username
                  customFields:
                    description: Custom fields configuration details.
                    items:
                      type: object
                      properties:
                        defaultValue:
                          description: 'A default value for the custom field. If the `type` is `text`, the default value must be a string. If the `type` is `toggle`, the default value must be boolean.

                            '
                          oneOf:
                          - type: string
                          - type: boolean
                        key:
                          description: 'A unique key for the custom field. Must be lower case and composed only of a-z, 0-9, ''_'', and ''-'' characters. It is used in API calls to refer to a specific custom field.

                            '
                          maxLength: 36
                          minLength: 1
                          type: string
                        label:
                          description: The custom field label that is displayed in the case.
                          maxLength: 50
                          minLength: 1
                          type: string
                        type:
                          description: The type of the custom field.
                          enum:
                          - text
                          - toggle
                          type: string
                        required:
                          description: 'Indicates whether the field is required. If `false`, the custom field can be set to null or omitted when a case is created or updated.

                            '
                          type: boolean
                    type: array
                  error:
                    example: null
                    type:
                    - string
                    - 'null'
                  id:
                    example: 4a97a440-e1cd-11ec-be9b-9b1838238ee6
                    type: string
                  mappings:
                    items:
                      type: object
                      properties:
                        action_type:
                          example: overwrite
                          type: string
                        source:
                          example: title
                          type: string
                        target:
                          example: summary
                          type: string
                    type: array
                  observableTypes:
                    description: Custom observable type configuration details.
                    items:
                      type: object
                      properties:
                        key:
                          description: The observable type key.
                          example: d312efda-ec2b-42ec-9e2c-84981795c581
                          type: string
                        label:
                          description: The observable type label.
                          example: My observable type
                          type: string
                    type: array
                  owner:
                    $ref: '#/components/schemas/Cases_owner'
                  templates:
                    $ref: '#/components/schemas/Cases_templates'
                  updated_at:
                    example: '2022-06-01T19:58:48.169Z'
                    format: date-time
                    type:
                    - string
                    - 'null'
                  updated_by:
                    type:
                    - object
                    - 'null'
                    properties:
                      email:
                        example: null
                        type:
                        - string
                        - 'null'
                      full_name:
                        example: null
                        type:
                        - string
                        - 'null'
                      profile_uid:
                        example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
                        type: string
                      username:
                        example: elastic
                        type:
                        - string
                        - 'null'
                    required:
                    - email
                    - full_name
                    - username
                  version:
                    example: WzIwNzMsMV0=
                    type: string
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Update case settings
      tags:
      - cases
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/cases/configure/connectors/_find:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/configure/connectors/_find</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get information about connectors that are supported for use in cases. You must have `read` privileges for the **Actions and Connectors** feature in the **Management** section of the Kibana feature privileges.

        '
      operationId: findCaseConnectorsDefaultSpace
      responses:
        '200':
          content:
            application/json:
              examples:
                findConnectorResponse:
                  $ref: '#/components/examples/Cases_find_connector_response'
              schema:
                items:
                  type: object
                  properties:
                    actionTypeId:
                      $ref: '#/components/schemas/Cases_connector_types'
                    config:
                      additionalProperties: true
                      type: object
                      properties:
                        apiUrl:
                          type: string
                        projectKey:
                          type: string
                    id:
                      type: string
                    isDeprecated:
                      type: boolean
                    isMissingSecrets:
                      type: boolean
                    isPreconfigured:
                      type: boolean
                    name:
                      type: string
                    referencedByCount:
                      type: integer
                maxItems: 1000
                type: array
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Get case connectors
      tags:
      - cases
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/cases/fields:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/fields</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Returns the fields you can write to a case''s `extended_fields` when creating a case for the given owner. Includes the owner''s global (library-wide) fields and, when `templateId` is supplied, that template''s fields. Migrated legacy custom fields appear as `global` fields. Requires the Cases feature to be enabled in the space.

        '
      operationId: getApplicableFieldsDefaultSpace
      parameters:
      - description: The application that owns the cases (for example `cases`, `observability`, or `securitySolution`).
        example: cases
        in: query
        name: owner
        required: true
        schema:
          maxLength: 30
          type: string
      - description: The identifier of a template to include the template's fields in the response.
        in: query
        name: templateId
        required: false
        schema:
          maxLength: 36
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getCaseApplicableFieldsResponse:
                  $ref: '#/components/examples/Cases_get_case_applicable_fields_response'
              schema:
                $ref: '#/components/schemas/Cases_applicable_fields_response'
          description: Indicates a successful call.
        '400':
          content:
            application/json:
              examples:
                response400:
                  $ref: '#/components/examples/Cases_response_400_invalid_template'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: The request is invalid, for example when the `templateId` does not exist for the owner or its definition is invalid.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
        '403':
          content:
            application/json:
              examples:
                response403:
                  $ref: '#/components/examples/Cases_response_403'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: The user does not have access to the requested owner.
      summary: Get the fields applicable to a case
      tags:
      - cases
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/cases/reporters:
    get:
      description: 'Returns information about the users who opened cases. You must have read privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases. The API returns information about the users as they existed at the time of the case creation, including their name, full name, and email address. If any of those details change thereafter or if a user is deleted, the information returned by this API is unchanged.

        '
      operationId: getCaseReportersDefaultSpace
      parameters:
      - $ref: '#/components/parameters/Cases_owner_filter'
      responses:
        '200':
          content:
            application/json:
              examples:
                getReportersResponse:
                  $ref: '#/components/examples/Cases_get_reporters_response'
              schema:
                items:
                  type: object
                  properties:
                    email:
                      example: null
                      type:
                      - string
                      - 'null'
                    full_name:
                      example: null
                      type:
                      - string
                      - 'null'
                    profile_uid:
                      example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
                      type: string
                    username:
                      example: elastic
                      type:
                      - string
                      - 'null'
                  required:
                  - email
                  - full_name
                  - username
                maxItems: 10000
                type: array
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Get case creators
      tags:
      - cases
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/cases/tags:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/tags</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Aggregates and returns a list of case tags. You must have read privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you''re seeking.

        '
      operationId: getCaseTagsDefaultSpace
      parameters:
      - $ref: '#/components/parameters/Cases_owner_filter'
      responses:
        '200':
          content:
            application/json:
              examples:
                getTagsResponse:
                  $ref: '#/components/examples/Cases_get_tags_response'
              schema:
                items:
                  type: string
                maxItems: 10000
                type: array
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Get case tags
      tags:
      - cases
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/cases/templates:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/templates</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Returns a paginated list of case templates. Requires the Cases feature to be enabled in the space.

        '
      operationId: getCaseTemplatesDefaultSpace
      parameters:
      - $ref: '#/components/parameters/Cases_page_index'
      - $ref: '#/components/parameters/Cases_page_size'
      - $ref: '#/components/parameters/Cases_template_sort_field'
      - $ref: '#/components/parameters/Cases_sort_order'
      - $ref: '#/components/parameters/Cases_search'
      - $ref: '#/components/parameters/Cases_owner_filter'
      - $ref: '#/components/parameters/Cases_template_tags'
      - $ref: '#/components/parameters/Cases_template_author'
      - $ref: '#/components/parameters/Cases_template_is_enabled'
      responses:
        '200':
          content:
            application/json:
              examples:
                getCaseTemplatesResponse:
                  $ref: '#/components/examples/Cases_get_case_templates_response'
              schema:
                $ref: '#/components/schemas/Cases_get_case_templates_response'
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Get all case templates
      tags:
      - cases
      x-metaTags:
      - content: Kibana
        name: product_name
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/templates</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Creates a case template from a YAML definition. You must have the "Manage templates" sub-privilege for the Cases feature of the owning solution. Set `dry_run=true` to run the full validation (body, YAML definition, name uniqueness, authorization) without creating anything. Requires the Cases feature to be enabled in the space.

        '
      operationId: createCaseTemplateDefaultSpace
      parameters:
      - description: 'When true, validates the request without creating the template and returns `{"valid": true}`.'
        in: query
        name: dry_run
        required: false
        schema:
          default: false
          type: boolean
      requestBody:
        content:
          application/json:
            examples:
              createCaseTemplateRequest:
                $ref: '#/components/examples/Cases_template_write_request'
            schema:
              $ref: '#/components/schemas/Cases_template_write_request'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                createCaseTemplateResponse:
                  $ref: '#/components/examples/Cases_get_case_template_response'
                dryRunResponse:
                  $ref: '#/components/examples/Cases_template_dry_run_response'
              schema:
                oneOf:
                - $ref: '#/components/schemas/Cases_template_v2_response'
                - $ref: '#/components/schemas/Cases_template_dry_run_response'
          description: 'Indicates a successful call. Returns the created template, or `{"valid": true}` for a dry run.'
        '400':
          content:
            application/json:
              examples:
                response400:
                  $ref: '#/components/examples/Cases_response_400_template_limit'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: 'The request body, YAML definition, or template name is invalid, or a resource limit was exceeded (max 200 templates per owner, max 200 fields per template).

            '
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
        '403':
          content:
            application/json:
              examples:
                response403:
                  $ref: '#/components/examples/Cases_response_403'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: The user does not have the manage templates privilege for the owner.
        '409':
          content:
            application/json:
              examples:
                response409:
                  $ref: '#/components/examples/Cases_response_409'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: A template with the same name already exists for the owner.
      summary: Create a case template
      tags:
      - cases
      x-state: Technical preview
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/cases/templates/{template_id}:
    delete:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/templates/{template_id}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Soft-deletes a case template (all versions). Existing cases keep their pinned template reference; the template stops appearing in the case creation flow and in find responses. You must have the "Manage templates" sub-privilege for the Cases feature of the owning solution. Requires the Cases feature to be enabled in the space.

        '
      operationId: deleteCaseTemplateDefaultSpace
      parameters:
      - $ref: '#/components/parameters/Cases_template_id'
      responses:
        '204':
          description: The template was deleted.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
        '403':
          content:
            application/json:
              examples:
                response403:
                  $ref: '#/components/examples/Cases_response_403'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: The user does not have the manage templates privilege for the owner.
        '404':
          content:
            application/json:
              examples:
                response404:
                  $ref: '#/components/examples/Cases_response_404'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: The template was not found.
      summary: Delete a case template
      tags:
      - cases
      x-state: Technical preview
      x-metaTags:
      - content: Kibana
        name: product_name
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/templates/{template_id}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Returns the details of a case template. Requires the Cases feature to be enabled in the space.

        '
      operationId: getCaseTemplateDefaultSpace
      parameters:
      - $ref: '#/components/parameters/Cases_template_id'
      - $ref: '#/components/parameters/Cases_template_version'
      responses:
        '200':
          content:
            application/json:
              examples:
                getCaseTemplateResponse:
                  $ref: '#/components/examples/Cases_get_case_template_response'
              schema:
                $ref: '#/components/schemas/Cases_template_v2_response'
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
        '404':
          content:
            application/json:
              examples:
                response404:
                  $ref: '#/components/examples/Cases_response_404'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: The template was not found.
      summary: Get a case template by ID
      tags:
      - cases
      x-metaTags:
      - content: Kibana
        name: product_name
    put:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/templates/{template_id}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Fully replaces a case template. Every accepted update creates a new template version; previous versions stay retrievable with the `version` query parameter of the get template API, and cases keep the version they were created with. You must have the "Manage templates" sub-privilege for the Cases feature of the owning solution. Set `dry_run=true` to run the full validation without writing. Requires the Cases feature to be enabled in the space.

        '
      operationId: updateCaseTemplateDefaultSpace
      parameters:
      - $ref: '#/components/parameters/Cases_template_id'
      - description: 'When true, validates the request without updating the template and returns `{"valid": true}`.'
        in: query
        name: dry_run
        required: false
        schema:
          default: false
          type: boolean
      requestBody:
        content:
          application/json:
            examples:
              updateCaseTemplateRequest:
                $ref: '#/components/examples/Cases_template_write_request'
            schema:
              $ref: '#/components/schemas/Cases_template_write_request'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                dryRunResponse:
                  $ref: '#/components/examples/Cases_template_dry_run_response'
                updateCaseTemplateResponse:
                  $ref: '#/components/examples/Cases_get_case_template_response'
              schema:
                oneOf:
                - $ref: '#/components/schemas/Cases_template_v2_response'
                - $ref: '#/components/schemas/Cases_template_dry_run_response'
          description: 'Indicates a successful call. Returns the new template version, or `{"valid": true}` for a dry run.'
        '400':
          content:
            application/json:
              examples:
                response400:
                  $ref: '#/components/examples/Cases_response_400_template_limit'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: 'The request body, YAML definition, or template name is invalid, or a resource limit was exceeded (max 200 fields per template).

            '
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
        '403':
          content:
            application/json:
              examples:
                response403:
                  $ref: '#/components/examples/Cases_response_403'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: The user does not have the manage templates privilege for the owner.
        '404':
          content:
            application/json:
              examples:
                response404:
                  $ref: '#/components/examples/Cases_response_404'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: The template was not found.
        '409':
          content:
            application/json:
              examples:
                response409:
                  $ref: '#/components/examples/Cases_response_409'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: A template with the same name already exists for the owner.
      summary: Update a case template
      tags:
      - cases
      x-state: Technical preview
      x-metaTags:
      - content: Kibana
        name: product_name
components:
  examples:
    Cases_get_case_template_response:
      summary: A case template.
      value:
        definition: {}
        definitionString: 'fields: []'
        deletedAt: null
        isLatest: true
        latestVersion: 1
        name: My Template
        owner: cases
        templateId: 9da1ea2a-09f8-4d0e-bf9d-09bf8c9d0f42
        templateVersion: 1
    Cases_response_401:
      summary: Authorization information is missing or invalid.
      value:
        error: Unauthorized
        message: Unable to authenticate with the provided credentials.
        statusCode: 401
    Cases_find_case_comments_response:
      summary: Paginated list of user comments for a case
      value:
        comments:
        - comment: A new comment
          created_at: '2023-10-07T19:32:13.104Z'
          created_by:
            email: null
            full_name: null
            profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
            username: elastic
          id: 8048b460-fe2b-11ec-b15d-779a7c8bbcc3
          owner: cases
          pushed_at: null
          pushed_by: null
          type: user
          updated_at: null
          updated_by: null
          version: WzIzLDFd
        page: 1
        per_page: 20
        total: 1
    Cases_update_case_configuration_request:
      summary: Update the case settings.
      value:
        closure_type: close-by-user
        connector:
          fields: null
          id: 5e656730-e1ca-11ec-be9b-9b1838238ee6
          name: my-jira-connector
          type: .jira
        customFields:
        - defaultValue: A new default value.
          key: d312efda-ec2b-42ec-9e2c-84981795c581
          label: my-text-field
          type: text
          required: true
        - key: fcc6840d-eb14-42df-8aaf-232201a705ec
          label: my-toggle
          type: toggle
          required: false
        version: WzExOSw0XQ==
    Cases_get_case_configuration_response:
      summary: Get the case configuration.
      value:
      - closure_type: close-by-user
        connector:
          fields: null
          id: none
          name: none
          type: .none
        created_at: '2024-07-01T17:07:17.767Z'
        created_by:
          email: null
          full_name: null
          username: elastic
        customFields:
        - defaultValue: Custom text field value.
          key: d312efda-ec2b-42ec-9e2c-84981795c581
          label: my-text-field
          type: text
          required: false
        error: null
        id: 856ee650-6c82-11ee-a20a-6164169afa58
        mappings: []
        observableTypes: []
        owner: cases
        templates:
        - caseFields:
            assignees:
            - uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
            category: Default-category
            connector:
              fields: null
              id: none
              name: none
              type: .none
            customFields:
            - key: d312efda-ec2b-42ec-9e2c-84981795c581
              type: text
              value: Default text field value.
            description: A default description for cases.
            settings:
              syncAlerts: false
            tags:
            - Default case tag
            title: Default case title
          description: A description of the template.
          key: 505932fe-ee3a-4960-a661-c781b5acdb05
          name: template-1
          tags:
          - Template tag 1
        updated_at: null
        updated_by: null
        version: WzEyLDNd
    Cases_create_case_request:
      summary: Create a security case that uses a Jira connector.
      value:
        connector:
          fields:
            issueType: '10006'
            parent: null
            priority: High
          id: 131d4448-abe0-4789-939d-8ef60680b498
          name: My connector
          type: .jira
        customFields:
        - key: d312efda-ec2b-42ec-9e2c-84981795c581
          type: text
          value: My field value
        description: A case description.
        owner: cases
        settings:
          extractObservables: false
          syncAlerts: true
        tags:
        - tag-1
        title: Case title 1
    Cases_response_400_invalid_template:
      summary: The request is invalid.
      value:
        error: Bad Request
        message: Template [invalid-template-id] not found for owner [cases]
        statusCode: 400
    Cases_get_reporters_response:
      summary: A list of two users that opened cases
      value:
      - email: null
        full_name: null
        profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
        username: elastic
      - email: jdoe@example.com
        full_name: Jane Doe
        profile_uid: u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0
        username: jdoe
    Cases_find_case_activity_response:
      summary: Retrieves all activity for a case
      value:
        page: 1
        perPage: 20
        total: 3
        userActions:
        - action: create
          comment_id: null
          created_at: '2023-10-20T01:17:22.150Z'
          created_by:
            email: null
            full_name: null
            profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
            username: elastic
          id: b4cd0770-07c9-11ed-a5fd-47154cb8767e
          owner: cases
          payload:
            assignees: []
            category: null
            connector:
              fields: null
              id: none
              name: none
              type: .none
            customFields:
            - key: d312efda-ec2b-42ec-9e2c-84981795c581
              type: text
              value: My field value
            - key: fcc6840d-eb14-42df-8aaf-232201a705ec
              type: toggle
              value: null
            description: A case description.
            owner: cases
            settings:
              syncAlerts: false
            severity: low
            status: open
            tags:
            - tag 1
            title: Case title 1
          type: create_case
          version: WzM1ODg4LDFd
        - action: create
          comment_id: 578608d0-03b1-11ed-920c-974bfa104448
          created_at: '2023-10-14T20:12:53.354Z'
          created_by:
            email: null
            full_name: null
            profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
            username: elastic
          id: 57af14a0-03b1-11ed-920c-974bfa104448
          owner: cases
          payload:
            comment:
              comment: A new comment
              owner: cases
              type: user
          type: comment
          version: WzM1ODg4LDFa
        - action: add
          comment_id: null
          created_at: '2023-10-20T01:10:28.238Z'
          created_by:
            email: null
            full_name: null
            profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
            username: elastic
          id: 573c6980-6123-11ed-aa41-81a0a61fe447
          owner: cases
          payload:
            assignees:
            - uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
          type: assignees
          version: WzM1ODg4LDFb
    Cases_response_404:
      summary: The requested resource was not found.
      value:
        error: Not Found
        message: Saved object [cases-template/9da1ea2a-09f8-4d0e-bf9d-09bf8c9d0f42] not found
        statusCode: 404
    Cases_get_comment_response:
      summary: A single user comment retrieved from a case
      value:
        comment: A new comment
        created_at: '2023-10-07T19:32:13.104Z'
        created_by:
          email: null
          full_name: null
          profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
          username: elastic
        id: 8048b460-fe2b-11ec-b15d-779a7c8bbcc3
        owner: cases
        pushed_at: null
        pushed_by: null
        type: user
        updated_at: null
        updated_by: null
        version: WzIzLDFd
    Cases_response_403:
      summary: The user does not have access to the requested resource.
      value:
        error: Forbidden
        message: Unauthorized to access cases
        statusCode: 403
    Cases_find_connector_response:
      summary: Retrieve information about the connectors and their settings.
      value:
      - actionTypeId: .jira
        config:
          apiUrl: https://elastic.atlassian.net/
          projectKey: ES
        id: 61787f53-4eee-4741-8df6-8fe84fa616f7
        isDeprecated: false
        isMissingSecrets: false
        isPreconfigured: false
        name: my-Jira
        referencedByCount: 0
    Cases_set_case_configuration_response:
      summary: This is an example response for case settings.
      value:
        closure_type: close-by-user
        connector:
          fields: null
          id: 5e656730-e1ca-11ec-be9b-9b1838238ee6
          name: my-jira-connector
          type: .jira
        created_at: '2024-07-01T17:07:17.767Z'
        created_by:
          email: null,
          full_name: null
          profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
          username: elastic
        customFields:
        - defaultValue: My custom field default value.
          key: d312efda-ec2b-42ec-9e2c-84981795c581
          label: my-text-field
          type: text
          required: false
        error: null
        id: 4a97a440-e1cd-11ec-be9b-9b1838238ee6
        mappings:
        - action_type: overwrite
          source: title
          target: summary
        - action_type: overwrite
          source: description
          target: description
        - action_type: append
          source: comments
          target: comments
        - action_type: overwrite
          source: tags
          target: labels
        owner: cases
        templates:
        - caseFields:
            assignees:
            - uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
            category: Default-category
            customFields:
            - key: d312efda-ec2b-42ec-9e2c-84981795c581
              type: text
              value: A text field value for the template.
            description: A default description for cases.
            tags:
            - Default case tag
            title: Default case title
          description: A description of the template.
          key: 505932fe-ee3a-4960-a661-c781b5acdb05
          name: template-1
          tags:
          - Template tag 1
        updated_at: null
        updated_by: null
        version: WzIwNzMsMV0=
    Cases_response_400_template_limit:
      summary: A template resource limit was exceeded.
      value:
        error: Bad Request
        message: A template cannot define more than 200 fields.
        statusCode: 400
    Cases_template_write_request:
      summary: Create or fully replace a case template.
      value:
        definition: "name: Security incident\nseverity: high\ntags: [security]\nfields:\n  - name: priority\n    label: Priority\n    type: keyword\n    control: SELECT_BASIC\n    metadata:\n      options: [low, medium, high]\n      default: medium\n"
        description: Default template for security incidents.
        isEnabled: true
        name: Security incident
        owner: cases
        tags:
        - security
    Cases_push_case_response:
      summary: The push case API returns a JSON object with details about the case and the external service.
      value:
        assignees: []
        category: null
        closed_at: null
        closed_by: null
        comments: []
        connector:
          fields:
            issueType: '10006'
            parent: null
            priority: Low
          id: 09f8c0b0-0eda-11ed-bd18-65557fe66949
          name: My connector
          type: .jira
        created_at: '2022-07-29T00:59:39.444Z'
        created_by:
          email: null
          full_name: null
          profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
          username: elastic
        customFields: []
        description: A case description.
        duration: null
        external_service:
          connector_id: 09f8c0b0-0eda-11ed-bd18-65557fe66949
          connector_name: My connector
          external_id: '71926'
          external_title: ES-554
          external_url: https://cases.jira.com
          pushed_at: '2022-07-29T01:20:58.436Z'
          pushed_by:
            email: null
            full_name: null
            username: elastic
        id: b917f300-0ed9-11ed-bd18-65557fe66949
        observables: []
        owner: cases
        settings:
          extractObservables: false
          syncAlerts: true
        severity: low
        status: open
        tags:
        - tag 1
        title: Case title 1
        total_observables: 0
        totalAlerts: 0
        totalComment: 0
        totalEvents: 0
        updated_at: '2022-07-29T01:20:58.436Z'
        updated_by:
          email: null
          full_name: null
          profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
          username: elastic
        version: WzE3NjgsM10=
    Cases_get_case_observability_response:
      summary: Get case response (Observability). Comments are not included; use the find case comments API. totalComment reflects the actual count.
      value:
        assignees:
        - uid: u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0
        category: null
        closed_at: null
        closed_by: null
        connector:
          fields: null
          id: none
          name: none
          type: .none
        created_at: '2023-11-06T19:29:04.086Z'
        created_by:
          email: null
          full_name: null
          username: elastic
        customFields: []
        description: An Observability case description.
        duration: null
        external_service: null
        id: c3ff7550-def1-4e90-b6bc-c9969a4a09b1
        observables: []
        owner: observability
        settings:
          extractObservables: false
          syncAlerts: false
        severity: low
        status: in-progress
        tags:
        - observability
        - tag 1
        title: Observability case title 1
        total_observables: 0
        totalAlerts: 1
        totalComment: 1
        totalEvents: 0
        updated_at: '2023-11-06T19:47:55.662Z'
        updated_by:
          email: null
          full_name: null
          profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
          username: elastic
        version: WzI0NywyXQ==
    Cases_get_case_response:
      summary: Get case response. Comments are not included; use the find case comments API. totalComment reflects the actual count.
      value:
        assignees:
        - uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
        category: null
        closed_at: null
        closed_by: null
        connector:
          fields: null
          id: none
          name: none
          type: .none
        created_at: '2023-10-13T15:33:50.604Z'
        created_by:
          email: null
          full_name: null
          profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
          username: elastic
        customFields:
        - key: d312efda-ec2b-42ec-9e2c-84981795c581
          type: text
          value: My field value
        - key: fcc6840d-eb14-42df-8aaf-232201a705ec
          type: toggle
          value: null
        description: A case description
        duration: null
        external_service: null
        id: 31cdada0-02c1-11ed-85f2-4f7c222ca2fa
        incremental_id: 1
        observables: []
        owner: cases
        settings:
          extractObservables: false
          syncAlerts: true
        severity: low
        status: open
        tags:
        - tag 1
        title: Case title 1
        total_observables: 0
        totalAlerts: 1
        totalComment: 1
        totalEvents: 0
        updated_at: '2023-10-13T15:40:32.335Z'
        updated_by:
          email: null
          full_name: null
          profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
          username: elastic
        version: WzM2LDFd
    Cases_update_case_configuration_response:
      summary: This is an example response when the case configuration was updated.
      value:
        closure_type: close-by-user
        connector:
          fields: null
          id: 5e656730-e1ca-11ec-be9b-9b1838238ee6
          name: my-jira-connector
          type: .jira
        created_at: '2024-07-01T17:07:17.767Z'
        created_by:
          email: null
          full_name: null
          profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
          username: elastic
        customFields:
        - defaultValue: A new default value.
          key: d312efda-ec2b-42ec-9e2c-84981795c581
          label: my-text-field
          type: text
          required: true
        - key: fcc6840d-eb14-42df-8aaf-232201a705ec
          label: my-toggle
          type: toggle
          required: false
        error: null
        id: 4a97a440-e1cd-11ec-be9b-9b1838238ee6
        mappings:
        - action_type: overwrite
          source: title
          target: summary
        - action_type: overwrite
          source: description
          target: description
        - action_type: overwrite
          source: tags
          target: labels
        - action_type: append
          source: comments
          target: comments
        owner: cases
        templates: []
        updated_at: '2024-07-19T00:52:42.401Z'
        updated_by:
          email: null
          full_name: null
          profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
          username: elastic
        version: WzI2LDNd
    Cases_get_case_alerts_response:
      summary: Retrieves all alerts attached to a case
      value:
      - attached_at: '2022-07-25T20:09:40.963Z'
        id: f6a7d0c3-d52d-432c-b2e6-447cd7fce04d
        index: .alerts-observability.logs.alerts-default
    Cases_get_case_applicable_fields_response:
      summary: Fields applicable to a case
      value:
        fields:
        - control: SELECT_BASIC
          defaultValue: medium
          displayOnly: false
          isGlobal: true
          key: priority_as_keyword
          label: Priority
          name: priority
          options:
          - low
          - medium
          - high
          type: keyword
          required: true
          requiredOnClose: false
          source: global
        - control: TEXTAREA
          displayOnly: false
          isGlobal: false
          key: rollout_notes_as_keyword
          label: Rollout notes
          name: rollout_notes
          type: keyword
          required: false
          requiredOnClose: true
          source: template
        - control: MARKDOWN
          displayOnly: true
          isGlobal: false
          key: instructions_as_keyword
          label: Instructions
          name: instructions
          type: keyword
          required: false
          requiredOnClose: false
          source: template
    Cases_get_tags_response:
      summary: A list of tags that are used in cases
      value:
      - observability
      - security
      - tag 1
      - tag 2
    Cases_find_case_response:
      summary: Retrieve the first five cases with the `tag-1` tag, in ascending order by last update time.
      value:
        cases:
        - assignees: []
          category: null
          closed_at: null
          closed_by: null
          comments: []
          connector:
            fields: null
            id: none
            name: none
            type: .none
          created_at: '2023-10-12T00:16:36.371Z'
          created_by:
            email: null
            full_name: null
            profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
            username: elastic
          customFields:
          - key: d312efda-ec2b-42ec-9e2c-84981795c581
            type: text
            value: My field value
          - key: fcc6840d-eb14-42df-8aaf-232201a705ec
            type: toggle
            value: null
          description: Case description
          duration: null
          external_service: null
          id: abed3a70-71bd-11ea-a0b2-c51ea50a58e2
          incremental_id: 1
          observables: []
          owner: cases
          settings:
            extractObservables: false
            syncAlerts: true
          severity: low
          status: open
          tags:
          - tag-1
          title: Case title
          total_observables: 0
          totalAlerts: 0
          totalComment: 1
          totalEvents: 0
          updated_at: '2023-10-12T00:27:58.162Z'
          updated_by:
            email: null
            full_name: null
            profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
            username: elastic
          version: WzExMCwxXQ==
        count_closed_cases: 0
        count_in_progress_cases: 0
        count_open_cases: 1
        page: 1
        per_page: 5
        total: 1
    Cases_update_comment_response:
      summary: The add comment to case API returns a JSON object that contains details about the case and its comments.
      value:
        assignees: []
        category: null
        closed_at: null
        closed_by: null
        comments:
        - comment: An updated comment.
          created_at: '2023-10-24T00:37:10.832Z'
          created_by:
            email: null
            full_name: null
            profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
            username: elastic
          id: 8af6ac20-74f6-11ea-b83a-553aecdb28b6
          owner: cases
          pushed_at: null
          pushed_by: null
          type: user
          updated_at: '2023-10-24T01:27:06.210Z'
          updated_by:
            email: null
            full_name: null
            profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
            username: elastic
          version: WzIwNjM3LDFd
        connector:
          fields: null
          id: none
          name: none
          type: .none
        created_at: '2023-10-24T00:37:03.906Z'
        created_by:
          email: null
          full_name: null
          profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
          username: elastic
        customFields:
        - key: d312efda-ec2b-42ec-9e2c-84981795c581
          type: text
          value: My new field value
        - key: fcc6840d-eb14-42df-8aaf-232201a705ec
          type: toggle
          value: false
        description: A case description.
        duration: null
        external_service: null
        id: 293f1bc0-74f6-11ea-b83a-553aecdb28b6
        owner: cases
        settings:
          syncAlerts: false
        severity: low
        status: open
        tags:
        - tag 1
        title: Case title 1
        totalAlerts: 0
        totalComment: 1
        totalEvents: 0
        updated_at: '2023-10-24T01:27:06.210Z'
        updated_by:
          email: null
          full_name: null
          profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
          username: elastic
        version: WzIwNjM2LDFd
    Cases_response_409:
      summary: A resource conflict occurred.
      value:
        error: Conflict
        message: Template name "Security incident" already exists for owner "cases"
        statusCode: 409
    Cases_create_case_response:
      summary: The create case API returns a JSON object that contains details about the case.
      value:
        assignees: []
        closed_at: null
        closed_by: null
        comments: []
        connector:
          fields:
            issueType: '10006'
            parent: null
            priority: High
          id: 131d4448-abe0-4789-939d-8ef60680b498
          name: My connector
          type: .jira
        created_at: '2022-10-13T15:33:50.604Z'
        created_by:
          email: null
          full_name: null
          profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
          username: elastic
        customFields:
        - key: d312efda-ec2b-42ec-9e2c-84981795c581
          type: text
          value: My field value
        - key: fcc6840d-eb14-42df-8aaf-232201a705ec
          type: toggle
          value: null
        description: A case description.
        duration: null
        external_service: null
        id: 66b9aa00-94fa-11ea-9f74-e7e108796192
        observables: []
        owner: cases
        settings:
          extractObservables: false
          syncAlerts: true
        severity: low
        status: open
        tags:
        - tag 1
        title: Case title 1
        total_observables: 0
        totalAlerts: 0
        totalComment: 0
        totalEvents: 0
        updated_at: null
        updated_by: null
        version: WzUzMiwxXQ==
    Cases_template_dry_run_response:
      summary: Dry-run validation succeeded without writing.
      value:
        valid: true
    Cases_set_case_configuration_request:
      summary: Set the closure type, custom fields, and default connector for Stack Management cases.
      value:
        closure_type: close-by-user
        connector:
          fields: null
          id: 5e656730-e1ca-11ec-be9b-9b1838238ee6
          name: my-jira-connector
          type: .jira
        customFields:
        - defaultValue: My custom field default value.
          key: d312efda-ec2b-42ec-9e2c-84981795c581
          label: my-text-field
          type: text
          required: false
        owner: cases
        templates:
        - caseFields:
            assignees:
            - uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
            category: Default-category
            customFields:
            - key: d312efda-ec2b-42ec-9e2c-84981795c581
              type: text
              value: A text field value for the template.
            description: A default description for cases.
            tags:
            - Default case tag
            title: Default case title
          description: A description of the template.
          key: 505932fe-ee3a-4960-a661-c781b5acdb05
          name: template-1
          tags:
          - Template tag 1
    Cases_get_case_templates_response:
      summary: A paginated list of case templates.
      value:
        page: 1
        perPage: 20
        templates:
        - definition: {}
          definitionString: 'fields: []'
          deletedAt: null
          fieldSearchMatches: false
          isLatest: true
          latestVersion: 1
          name: My Template
          owner: cases
          templateId: 9da1ea2a-09f8-4d0e-bf9d-09bf8c9d0f42
          templateVersion: 1
        total: 1
    Cases_add_comment_request:
      summary: Adds a comment to a case.
      value:
        comment: A new comment.
        owner: cases
        type: user
    Cases_update_case_response:
      summary: This is an example response when the case description, tags, and connector were updated.
      value:
      - assignees: []
        category: null
        closed_at: null
        closed_by: null
        comments: []
        connector:
          fields:
            issueType: '10006'
            parent: null
            priority: null
          id: 131d4448-abe0-4789-939d-8ef60680b498
          name: My connector
          type: .jira
        created_at: '2023-10-13T09:16:17.416Z'
        created_by:
          email: null
          full_name: null
          profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
          username: elastic
        customFields:
        - key: d312efda-ec2b-42ec-9e2c-84981795c581
          type: text
          value: My new field value
        - key: fcc6840d-eb14-42df-8aaf-232201a705ec
          type: toggle
          value: false
        description: A case description.
        duration: null
        external_service:
          connector_id: 05da469f-1fde-4058-99a3-91e4807e2de8
          connector_name: Jira
          external_id: '10003'
          external_title: IS-4
          external_url: https://hms.atlassian.net/browse/IS-4
          pushed_at: '2023-10-13T09:20:40.672Z'
          pushed_by:
            email: null
            full_name: null
            username: elastic
        id: 66b9aa00-94fa-11ea-9f74-e7e108796192
        observables: []
        owner: cases
        settings:
          extractObservables: false
          syncAlerts: true
        severity: low
        status: open
        tags:
        - tag-1
        title: Case title 1
        total_observables: 0
        totalAlerts: 0
        totalComment: 0
        totalEvents: 0
        updated_at: '2023-10-13T09:48:33.043Z'
        updated_by:
          email: null
          full_name: null
          profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
          username: elastic
        version: WzU0OCwxXQ==
    Cases_update_case_request:
      summary: Update the case description, tags, and connector.
      value:
        cases:
        - connector:
            fields:
              issueType: '10006'
              parent: null
              priority: null
            id: 131d4448-abe0-4789-939d-8ef60680b498
            name: My connector
            type: .jira
          customFields:
          - key: fcc6840d-eb14-42df-8aaf-232201a705ec
            type: toggle
            value: false
          - key: d312efda-ec2b-42ec-9e2c-84981795c581
            type: text
            value: My new field value
          description: A case description.
          id: a18b38a0-71b0-11ea-a0b2-c51ea50a58e2
          settings:
            extractObservables: false
            syncAlerts: true
          tags:
          - tag-1
          version: WzIzLDFd
    Cases_add_comment_response:
      summary: The add comment to case API returns a JSON object that contains details about the case and its comments.
      value:
        assignees: []
        category: null
        closed_at: null
        closed_by: null
        comments:
        - comment: A new comment.
          created_at: '2022-10-02T00:49:47.716Z'
          created_by:
            email: null
            full_name: null
            profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
            username: elastic
          id: 8af6ac20-74f6-11ea-b83a-553aecdb28b6
          owner: cases
          pushed_at: null
          pushed_by: null
          type: user
          updated_at: null
          updated_by: null
          version: WzIwNDMxLDFd
        connector:
          fields: null
          id: none
          name: none
          type: .none
        created_at: '2022-03-24T00:37:03.906Z'
        created_by:
          email: null
          full_name: null
          profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
          username: elastic
        customFields:
        - key: d312efda-ec2b-42ec-9e2c-84981795c581
          type: text
          value: Field value
        - key: fcc6840d-eb14-42df-8aaf-232201a705ec
          type: toggle
          value: true
        description: A case description.
        duration: null
        external_service: null
        id: 293f1bc0-74f6-11ea-b83a-553aecdb28b6
        observables: []
        owner: cases
        settings:
          syncAlerts: false
        severity: low
        status: open
        tags:
        - tag 1
        title: Case title 1
        total_observables: 0
        totalAlerts: 0
        totalComment: 1
        totalEvents: 0
        updated_at: '2022-06-03T00:49:47.716Z'
        updated_by:
          email: null
          full_name: null
          profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
          username: elastic
        version: WzIzMzgsMV0=
    Cases_update_comment_request:
      summary: Updates a comment of a case.
      value:
        comment: An updated comment.
        id: 8af6ac20-74f6-11ea-b83a-553aecdb28b6
        owner: cases
        type: user
        version: Wzk1LDFd
  schemas:
    Cases_add_case_comment_request:
      description: The add comment to case API request body varies depending on whether you are adding an alert or a comment.
      discriminator:
        mapping:
          alert: '#/components/schemas/Cases_add_alert_comment_request_properties'
          user: '#/components/schemas/Cases_add_user_comment_request_properties'
        propertyName: type
      oneOf:
      - $ref: '#/components/schemas/Cases_add_alert_comment_request_properties'
      - $ref: '#/components/schemas/Cases_add_user_comment_request_properties'
      title: Add case comment request
    Cases_case_severity:
      description: The severity of the case.
      enum:
      - critical
      - high
      - low
      - medium
      type: string
    Cases_alert_response_properties:
      type: object
      properties:
        attached_at:
          format: date-time
          type: string
        id:
          description: The alert identifier.
          type: string
        index:
          description: The alert index.
          type: string
    Cases_applicable_fields_response:
      description: 'The fields a caller may apply to a case''s `extended_fields`. When no template is in scope, this is the owner''s global (library-wide) fields; when a template is applied, it also includes that template''s fields. Migrated legacy custom fields appear here as `global` fields, so existing automations can look up the exact key to write.

        '
      type: object
      properties:
        fields:
          items:
            type: object
            properties:
              control:
                description: 'The UI control for the field, such as `INPUT_TEXT`, `INPUT_NUMBER`, `SELECT_BASIC`, `TOGGLE`, or `MARKDOWN`.

                  '
                example: SELECT_BASIC
                type: string
              defaultValue:
                description: The default value, as a string, when the field definition declares one.
                type: string
              displayOnly:
                description: 'When `true` the field is display-only (for example a `MARKDOWN` block): it is returned so the full form shape is visible, but it holds no value and its `key` cannot be written to `extended_fields`.

                  '
                type: boolean
              isGlobal:
                description: Whether the field is a global (library-wide) definition.
                type: boolean
              key:
                description: 'The storage key to write in the case `extended_fields` map. Follows the `<field_name>_as_<storage_type>` convention (for example `priority_as_keyword`).

                  '
                example: priority_as_keyword
                type: string
              label:
                description: The human-readable label. Falls back to `name` when no label is authored.
                example: Priority
                type: string
              name:
                description: The field name as authored in the field definition.
                example: priority
                type: string
              options:
                description: The allowed values for `SELECT_BASIC`, `RADIO_GROUP`, and `CHECKBOX_GROUP` fields.
                items:
                  type: string
                type: array
              type:
                description: 'The storage type: `keyword`, `integer`, `long`, `boolean`, or `date`.'
                example: keyword
                type: string
              required:
                description: Whether a value must be supplied at write time.
                type: boolean
              requiredOnClose:
                description: Whether the field must be filled before the case can be closed.
                type: boolean
              source:
                description: 'Where the field comes from: `global` for a library-wide (`isGlobal`) definition writable on any case, or `template` for a field contributed by the applied template.

                  '
                enum:
                - global
                - template
                type: string
            required:
            - key
            - name
            - label
            - type
            - control
            - required
            - requiredOnClose
            - displayOnly
            - source
            - isGlobal
          type: array
      required:
      - fields
    Cases_alert_identifiers:
      description: 'The alert identifiers. It is required only when `type` is `alert`. You can use an array of strings to add multiple alerts to a case, provided that they all relate to the same rule; `index` must also be an array with the same length or number of elements. Adding multiple alerts in this manner is recommended rather than calling the API multiple times. This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.

        '
      example: 6b24c4dc44bc720cfc92797f3d61fff952f2b2627db1fb4f8cc49f4530c4ff42
      oneOf:
      - type: string
      - items:
          type: string
        maxItems: 1000
        type: array
      title: Alert identifiers
      x-state: Technical preview
    Cases_actions:
      enum:
      - add
      - create
      - delete
      - push_to_service
      - update
      example: create
      type: string
    Cases_case_status:
      description: The status of the case.
      enum:
      - closed
      - in-progress
      - open
      type: string
    Cases_user_comment_response_properties:
      title: Case response properties for user comments
      type: object
      properties:
        comment:
          example: A new comment.
          type: string
        created_at:
          example: '2022-05-13T09:16:17.416Z'
          format: date-time
          type: string
        created_by:
          $ref: '#/components/schemas/Cases_case_response_created_by_properties'
        id:
          example: 8af6ac20-74f6-11ea-b83a-553aecdb28b6
          type: string
        owner:
          $ref: '#/components/schemas/Cases_owner'
        pushed_at:
          example: null
          format: date-time
          type:
          - string
          - 'null'
        pushed_by:
          $ref: '#/components/schemas/Cases_case_response_pushed_by_properties'
        type:
          enum:
          - user
          example: user
          type: string
        updated_at:
          example: null
          format: date-time
          type:
          - string
          - 'null'
        updated_by:
          $ref: '#/components/schemas/Cases_case_response_updated_by_properties'
        version:
          example: WzIwNDMxLDFd
          type: string
      required:
      - type
    Cases_update_case_comment_request:
      description: The update case comment API request body varies depending on whether you are updating an alert or a comment.
      discriminator:
        mapping:
          alert: '#/components/schemas/Cases_update_alert_comment_request_properties'
          user: '#/components/schemas/Cases_update_user_comment_request_properties'
        propertyName: type
      oneOf:
      - $ref: '#/components/schemas/Cases_update_alert_comment_request_properties'
      - $ref: '#/components/schemas/Cases_update_user_comment_request_properties'
      title: Update case comment request
    Cases_connector_properties_jira:
      description: Defines properties for connectors when type is `.jira`.
      type: object
      properties:
        fields:
          description: An object containing the connector fields. If you want to omit any individual field, specify null as its value.
          type: object
          properties:
            issueType:
              description: The type of issue.
              type:
              - string
              - 'null'
            parent:
              description: The key of the parent issue, when the issue type is sub-task.
              type:
              - string
              - 'null'
            priority:
              description: The priority of the issue.
              type:
              - string
              - 'null'
          required:
          - issueType
          - parent
          - priority
        id:
          description: The identifier for the connector. To retrieve connector IDs, use the find connectors API.
          type: string
        name:
          description: The name of the connector.
          type: string
        type:
          description: The type of connector.
          enum:
          - .jira
          example: .jira
          type: string
      required:
      - fields
      - id
      - name
      - type
      title: Create or update case request properties for a Jira connector
    Cases_payload_tags:
      type: object
      properties:
        tags:
          example:
          - tag-1
          items:
            type: string
          type: array
    Cases_connector_properties_servicenow_sir:
      description: Defines properties for connectors when type is `.servicenow-sir`.
      type: object
      properties:
        fields:
          description: An object containing the connector fields. If you want to omit any individual field, specify null as its value.
          type: object
          properties:
            category:
              description: The category of the incident.
              type:
              - string
              - 'null'
            destIp:
              description: Indicates whether cases will send a comma-separated list of destination IPs.
              type:
              - boolean
              - 'null'
            malwareHash:
              description: Indicates whether cases will send a comma-separated list of malware hashes.
              type:
              - boolean
              - 'null'
            malwareUrl:
              description: Indicates whether cases will send a comma-separated list of malware URLs.
              type:
              - boolean
              - 'null'
            priority:
              description: The priority of the issue.
              type:
              - string
              - 'null'
            sourceIp:
              description: Indicates whether cases will send a comma-separated list of source IPs.
              type:
              - boolean
              - 'null'
            subcategory:
              description: The subcategory of the incident.
              type:
              - string
              - 'null'
          required:
          - category
          - destIp
          - malwareHash
          - malwareUrl
          - priority
          - sourceIp
          - subcategory
        id:
          description: The identifier for the connector. To retrieve connector IDs, use the find connectors API.
          type: string
        name:
          description: The name of the connector.
          type: string
        type:
          description: The type of connector.
          enum:
          - .servicenow-sir
          example: .servicenow-sir
          type: string
      required:
      - fields
      - id
      - name
      - type
      title: Create case request properties for a ServiceNow SecOps connector
    Cases_connector_properties_servicenow:
      description: Defines properties for connectors when type is `.servicenow`.
      type: object
      properties:
        fields:
          description: An object containing the connector fields. If you want to omit any individual field, specify null as its value.
          type: object
          properties:
            category:
              description: The category of the incident.
              type:
              - string
              - 'null'
            impact:
              description: The effect an incident had on business.
              type:
              - string
              - 'null'
            severity:
              description: The severity of the incident.
              type:
              - string
              - 'null'
            subcategory:
              description: The subcategory of the incident.
              type:
              - string
              - 'null'
            urgency:
              description: The extent to which the incident resolution can be delayed.
              type:
              - string
              - 'null'
          required:
          - category
          - impact
          - severity
          - subcategory
          - urgency
        id:
          description: The identifier for the connector. To retrieve connector IDs, use the find connectors API.
          type: string
        name:
          description: The name of the connector.
          type: string
        type:
          description: The type of connector.
          enum:
          - .servicenow
          example: .servicenow
          type: string
      required:
      - fields
      - id
      - name
      - type
      title: Create case request properties for a ServiceNow ITSM connector
    Cases_update_alert_comment_request_properties:
      description: Defines properties for case comment requests when type is alert.
      type: object
      properties:
        alertId:
          $ref: '#/components/schemas/Cases_alert_identifiers'
        id:
          description: 'The identifier for the comment. To retrieve comment IDs, use the get comments API.

            '
          example: 8af6ac20-74f6-11ea-b83a-553aecdb28b6
          type: string
        index:
          $ref: '#/components/schemas/Cases_alert_indices'
        owner:
          $ref: '#/components/schemas/Cases_owner'
        rule:
          $ref: '#/components/schemas/Cases_rule'
        type:
          description: The type of comment.
          enum:
          - alert
          example: alert
          type: string
        version:
          description: 'The current comment version. To retrieve version values, use the get comments API.

            '
          example: Wzk1LDFd
          type: string
      required:
      - alertId
      - id
      - index
      - owner
      - rule
      - type
      - version
      title: Update case comment request properties for alerts
    Cases_related_case:
      description: 'Summary of a case returned when listing cases that contain a given alert. This is a subset of the full case response.

        '
      properties:
        createdAt:
          description: When the case was created.
          format: date-time
          type: string
        description:
          description: The case description.
          type: string
        id:
          description: The case identifier.
          type: string
        status:
          $ref: '#/components/schemas/Cases_case_status'
        title:
          description: The case title.
          type: string
        totals:
          $ref: '#/components/schemas/Cases_attachment_totals'
      required:
      - id
      - title
      - description
      - status
      - createdAt
      - totals
      title: Related case
      type: object
    Cases_owner:
      description: 'The application that owns the cases: Stack Management, Observability, or Elastic Security.

        '
      enum:
      - cases
      - observability
      - securitySolution
      example: cases
      type: string
    Cases_searchFieldsType:
      description: The fields to perform the `simple_query_string` parsed query against.
      enum:
      - description
      - title
      type: string
    Cases_update_case_configuration_request:
      description: 'You can update settings such as the closure type, custom fields, templates, and the default connector for cases.

        '
      properties:
        closure_type:
          $ref: '#/components/schemas/Cases_closure_types'
        connector:
          description: An object that contains the connector configuration.
          type: object
          properties:
            fields:
              description: The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to `null`.
              type:
              - object
              - 'null'
            id:
              description: The identifier for the connector. If you do not want a default connector, use `none`. To retrieve connector IDs, use the find connectors API.
              example: none
              type: string
            name:
              description: The name of the connector. If you do not want a default connector, use `none`. To retrieve connector names, use the find connectors API.
              example: none
              type: string
            type:
              $ref: '#/components/schemas/Cases_connector_types'
          required:
          - fields
          - id
          - name
          - type
        customFields:
          description: Custom fields case configuration.
          items:
            type: object
            properties:
              defaultValue:
                description: 'A default value for the custom field. If the `type` is `text`, the default value must be a string. If the `type` is `toggle`, the default value must be boolean.

                  '
                oneOf:
                - type: string
                - type: boolean
              key:
                description: 'A unique key for the custom field. Must be lower case and composed only of a-z, 0-9, ''_'', and ''-'' characters. It is used in API calls to refer to a specific custom field.

                  '
                maxLength: 36
                minLength: 1
                type: string
              label:
                description: The custom field label that is displayed in the case.
                maxLength: 50
                minLength: 1
                type: string
              type:
                description: The type of the custom field.
                enum:
                - text
                - toggle
                type: string
              required:
                description: 'Indicates whether the field is required. If `false`, the custom field can be set to null or omitted when a case is created or updated.

                  '
                type: boolean
            required:
            - key
            - label
            - required
            - type
          type: array
        templates:
          $ref: '#/components/schemas/Cases_templates'
        version:
          description: 'The version of the connector. To retrieve the version value, use the get configuration API.

            '
          example: WzIwMiwxXQ==
          type: string
      required:
      - version
      title: Update case configuration request
      type: object
    Cases_add_user_comment_request_properties:
      description: Defines properties for case comment requests when type is user.
      properties:
        comment:
          description: The new comment. It is required only when `type` is `user`.
          example: A new comment.
          maxLength: 30000
          type: string
        owner:
          $ref: '#/components/schemas/Cases_owner'
        type:
          description: The type of comment.
          enum:
          - user
          example: user
          type: string
      required:
      - comment
      - owner
      - type
      title: Add case comment request properties for user comments
      type: object
    Cases_payload_user_comment:
      type: object
      properties:
        comment:
          type: object
          properties:
            comment:
              type: string
            owner:
              $ref: '#/components/schemas/Cases_owner'
            type:
              enum:
              - user
              type: string
    Cases_owners:
      items:
        $ref: '#/components/schemas/Cases_owner'
      type: array
    Cases_case_observable:
      description: A single observable attached to a case.
      properties:
        createdAt:
          description: When the observable was created.
          example: '2024-11-14T10:00:00.000Z'
          format: date-time
          type: string
        description:
          description: An optional description for the observable.
          example: Source IP
          type:
          - string
          - 'null'
        id:
          description: The observable identifier.
          example: df927ab8-54ed-47d6-be07-9948c255c097
          type: string
        typeKey:
          description: The observable type key.
          example: observable-type-ipv4
          type: string
        updatedAt:
          description: When the observable was last updated.
          example: '2024-11-14T10:00:00.000Z'
          format: date-time
          type:
          - string
          - 'null'
        value:
          description: The observable value.
          example: 10.0.0.8
          type: string
      required:
      - id
      - typeKey
      - value
      - description
      - createdAt
      - updatedAt
      title: Case observable
      type: object
    Cases_update_case_request:
      description: The update case API request body varies depending on the type of connector.
      properties:
        cases:
          description: An array containing one or more case objects.
          items:
            type: object
            properties:
              assignees:
                $ref: '#/components/schemas/Cases_assignees'
              category:
                $ref: '#/components/schemas/Cases_case_category'
              closeReason:
                $ref: '#/components/schemas/Cases_case_close_sync_reason'
              connector:
                oneOf:
                - $ref: '#/components/schemas/Cases_connector_properties_none'
                - $ref: '#/components/schemas/Cases_connector_properties_cases_webhook'
                - $ref: '#/components/schemas/Cases_connector_properties_jira'
                - $ref: '#/components/schemas/Cases_connector_properties_resilient'
                - $ref: '#/components/schemas/Cases_connector_properties_servicenow'
                - $ref: '#/components/schemas/Cases_connector_properties_servicenow_sir'
                - $ref: '#/components/schemas/Cases_connector_properties_swimlane'
              customFields:
                description: 'Custom field values for a case. Any optional custom fields that are not specified in the request are set to null.

                  '
                items:
                  type: object
                  properties:
                    key:
                      description: 'The unique identifier for the custom field. The key value must exist in the case configuration settings.

                        '
                      type: string
                    type:
                      description: 'The custom field type. It must match the type specified in the case configuration settings.

                        '
                      enum:
                      - text
                      - toggle
                      type: string
                    value:
                      description: 'The custom field value. If the custom field is required, it cannot be explicitly set to null. However, for cases that existed when the required custom field was added, the default value stored in Elasticsearch is `undefined`. The value returned in the API and user interface in this case is `null`.

                        '
                      oneOf:
                      - maxLength: 160
                        minLength: 1
                        type:
                        - string
                        - 'null'
                      - type: boolean
                  required:
                  - key
                  - type
                  - value
                maxItems: 10
                minItems: 0
                type: array
              description:
                $ref: '#/components/schemas/Cases_case_description'
              id:
                description: The identifier for the case.
                maxLength: 30000
                type: string
              settings:
                $ref: '#/components/schemas/Cases_settings'
              severity:
                $ref: '#/components/schemas/Cases_case_severity'
              status:
                $ref: '#/components/schemas/Cases_case_status'
              tags:
                $ref: '#/components/schemas/Cases_case_tags'
              title:
                $ref: '#/components/schemas/Cases_case_title'
              version:
                description: 'The current version of the case. To determine this value, use the get case or search cases (`_find`) APIs.

                  '
                type: string
            required:
            - id
            - version
          maxItems: 100
          minItems: 1
          type: array
      required:
      - cases
      title: Update case request
      type: object
    Cases_rule:
      description: 'The rule that is associated with the alerts. It is required only when `type` is `alert`. This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.

        '
      title: Alerting rule
      type: object
      properties:
        id:
          description: The rule identifier.
          example: 94d80550-aaf4-11ec-985f-97e55adae8b9
          type: string
        name:
          description: The rule name.
          example: security_rule
          type: string
      x-state: Technical preview
    Cases_payload_connector:
      type: object
      properties:
        connector:
          type: object
          properties:
            fields:
              description: An object containing the connector fields. To create a case without a connector, specify null. If you want to omit any individual field, specify null as its value.
              example: null
              type:
              - object
              - 'null'
              properties:
                caseId:
                  description: The case identifier for Swimlane connectors.
                  type: string
                category:
                  description: The category of the incident for ServiceNow ITSM and ServiceNow SecOps connectors.
                  type: string
                destIp:
                  description: Indicates whether cases will send a comma-separated list of destination IPs for ServiceNow SecOps connectors.
                  type:
                  - boolean
                  - 'null'
                impact:
                  description: The effect an incident had on business for ServiceNow ITSM connectors.
                  type: string
                issueType:
                  description: The type of issue for Jira connectors.
                  type: string
                issueTypes:
                  description: The type of incident for IBM Resilient connectors.
                  items:
                    type: string
                  type: array
                malwareHash:
                  description: Indicates whether cases will send a comma-separated list of malware hashes for ServiceNow SecOps connectors.
                  type:
                  - boolean
                  - 'null'
                malwareUrl:
                  description: Indicates whether cases will send a comma-separated list of malware URLs for ServiceNow SecOps connectors.
                  type:
                  - boolean
                  - 'null'
                parent:
                  description: The key of the parent issue, when the issue type is sub-task for Jira connectors.
                  type: string
                priority:
                  description: The priority of the issue for Jira and ServiceNow SecOps connectors.
                  type: string
                severity:
                  description: The severity of the incident for ServiceNow ITSM connectors.
                  type: string
                severityCode:
                  description: The severity code of the incident for IBM Resilient connectors.
                  type: string
                sourceIp:
                  description: Indicates whether cases will send a comma-separated list of source IPs for ServiceNow SecOps connectors.
                  type:
                  - boolean
                  - 'null'
                subcategory:
                  description: The subcategory of the incident for ServiceNow ITSM connectors.
                  type: string
                urgency:
                  description: The extent to which the incident resolution can be delayed for ServiceNow ITSM connectors.
                  type: string
            id:
              description: The identifier for the connector. To create a case without a connector, use `none`.
              example: none
              type: string
            name:
              description: The name of the connector. To create a case without a connector, use `none`.
              example: none
              type: string
            type:
              $ref: '#/components/schemas/Cases_connector_types'
    Cases_template_tags:
      description: 'The words and phrases that help categorize templates. It can be an empty array.

        '
      items:
        maxLength: 256
        type: string
      maxItems: 200
      type: array
    Cases_alert_indices:
      description: 'The alert indices. It is required only when `type` is `alert`. If you are adding multiple alerts to a case, use an array of strings; the position of each index name in the array must match the position of the corresponding alert identifier in the `alertId` array.  This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.

        '
      oneOf:
      - type: string
      - items:
          type: string
        maxItems: 1000
        type: array
      title: Alert indices
      x-state: Technical preview
    Cases_payload_title:
      type: object
      properties:
        title:
          type: string
    Cases_case_tags:
      description: 'The words and phrases that help categorize cases. It can be an empty array.

        '
      items:
        maxLength: 256
        type: string
      maxItems: 200
      type: array
    Cases_closure_types:
      description: Indicates whether a case is automatically closed when it is pushed to external systems (`close-by-pushing`) or not automatically closed (`close-by-user`).
      enum:
      - close-by-pushing
      - close-by-user
      example: close-by-user
      type: string
    Cases_create_case_request:
      description: The create case API request body varies depending on the type of connector.
      properties:
        assignees:
          $ref: '#/components/schemas/Cases_assignees'
        category:
          $ref: '#/components/schemas/Cases_case_category'
        connector:
          oneOf:
          - $ref: '#/components/schemas/Cases_connector_properties_none'
          - $ref: '#/components/schemas/Cases_connector_properties_cases_webhook'
          - $ref: '#/components/schemas/Cases_connector_properties_jira'
          - $ref: '#/components/schemas/Cases_connector_properties_resilient'
          - $ref: '#/components/schemas/Cases_connector_properties_servicenow'
          - $ref: '#/components/schemas/Cases_connector_properties_servicenow_sir'
          - $ref: '#/components/schemas/Cases_connector_properties_swimlane'
        customFields:
          description: 'Custom field values for a case. Any optional custom fields that are not specified in the request are set to null.

            '
          items:
            type: object
            properties:
              key:
                description: 'The unique identifier for the custom field. The key value must exist in the case configuration settings.

                  '
                type: string
              type:
                description: 'The custom field type. It must match the type specified in the case configuration settings.

                  '
                enum:
                - text
                - toggle
                type: string
              value:
                description: 'The custom field value. If the custom field is required, it cannot be explicitly set to null. However, for cases that existed when the required custom field was added, the default value stored in Elasticsearch is `undefined`. The value returned in the API and user interface in this case is `null`.

                  '
                oneOf:
                - maxLength: 160
                  minLength: 1
                  type:
                  - string
                  - 'null'
                - type: boolean
            required:
            - key
            - type
            - value
          maxItems: 10
          minItems: 0
          type: array
        description:
          $ref: '#/components/schemas/Cases_case_description'
        owner:
          $ref: '#/components/schemas/Cases_owner'
        settings:
          $ref: '#/components/schemas/Cases_settings'
        severity:
          $ref: '#/components/schemas/Cases_case_severity'
        tags:
          $ref: '#/components/schemas/Cases_case_tags'
        template:
          description: 'A case template to create the case from. Requires the `xpack.cases.templates.enabled` setting. The server applies the template''s case defaults (severity, category, tags, assignees, settings, connector) and its field defaults into `extended_fields`; any value explicitly provided in the request wins over the template default. When `version` is omitted, the latest version of the template is resolved and pinned on the case. To discover a template''s fields before creating a case, use the get case fields API (`GET /api/cases/fields`).

            '
          type:
          - object
          - 'null'
          properties:
            id:
              description: The template identifier. Retrieve template ids with `GET /api/cases/templates`.
              type: string
            version:
              description: 'The template version to apply. Omit to use (and pin) the latest version.

                '
              minimum: 1
              type: integer
          required:
          - id
          x-state: Technical preview
        title:
          $ref: '#/components/schemas/Cases_case_title'
      required:
      - connector
      - description
      - owner
      - settings
      - tags
      - title
      title: Create case request
      type: object
    Cases_case_categories:
      items:
        $ref: '#/components/schemas/Cases_case_category'
      maxItems: 100
      type: array
    Cases_case_response_closed_by_properties:
      properties:
        email:
          example: null
          type:
          - string
          - 'null'
        full_name:
          example: null
          type:
          - string
          - 'null'
        profile_uid:
          example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
          type: string
        username:
          example: elastic
          type:
          - string
          - 'null'
      required:
      - email
      - full_name
      - username
      title: Case response properties for closed_by
      type:
      - object
      - 'null'
    Cases_payload_create_case:
      type: object
      properties:
        assignees:
          $ref: '#/components/schemas/Cases_assignees'
        connector:
          type: object
          properties:
            fields:
              description: An object containing the connector fields. To create a case without a connector, specify null. If you want to omit any individual field, specify null as its value.
              example: null
              type:
              - object
              - 'null'
              properties:
                caseId:
                  description: The case identifier for Swimlane connectors.
                  type: string
                category:
                  description: The category of the incident for ServiceNow ITSM and ServiceNow SecOps connectors.
                  type: string
                destIp:
                  description: Indicates whether cases will send a comma-separated list of destination IPs for ServiceNow SecOps connectors.
                  type:
                  - boolean
                  - 'null'
                impact:
                  description: The effect an incident had on business for ServiceNow ITSM connectors.
                  type: string
                issueType:
                  description: The type of issue for Jira connectors.
                  type: string
                issueTypes:
                  description: The type of incident for IBM Resilient connectors.
                  items:
                    type: string
                  type: array
                malwareHash:
                  description: Indicates whether cases will send a comma-separated list of malware hashes for ServiceNow SecOps connectors.
                  type:
                  - boolean
                  - 'null'
                malwareUrl:
                  description: Indicates whether cases will send a comma-separated list of malware URLs for ServiceNow SecOps connectors.
                  type:
                  - boolean
                  - 'null'
                parent:
                  description: The key of the parent issue, when the issue type is sub-task for Jira connectors.
                  type: string
                priority:
                  description: The priority of the issue for Jira and ServiceNow SecOps connectors.
                  type: string
                severity:
                  description: The severity of the incident for ServiceNow ITSM connectors.
                  type: string
                severityCode:
                  description: The severity code of the incident for IBM Resilient connectors.
                  type: string
                sourceIp:
                  description: Indicates whether cases will send a comma-separated list of source IPs for ServiceNow SecOps connectors.
                  type:
                  - boolean
                  - 'null'
                subcategory:
                  description: The subcategory of the incident for ServiceNow ITSM connectors.
                  type: string
                urgency:
                  description: The extent to which the incident resolution can be delayed for ServiceNow ITSM connectors.
                  type: string
            id:
              description: The identifier for the connector. To create a case without a connector, use `none`.
              example: none
              type: string
            name:
              description: The name of the connector. To create a case without a connector, use `none`.
              example: none
              type: string
            type:
              $ref: '#/components/schemas/Cases_connector_types'
        description:
          type: string
        owner:
          $ref: '#/components/schemas/Cases_owner'
        settings:
          $ref: '#/components/schemas/Cases_settings'
        severity:
          $ref: '#/components/schemas/Cases_case_severity'
        status:
          $ref: '#/components/schemas/Cases_case_status'
        tags:
          example:
          - tag-1
          items:
            type: string
          type: array
        title:
          type: string
    Cases_add_alert_comment_request_properties:
      description: Defines properties for case comment requests when type is alert.
      type: object
      properties:
        alertId:
          $ref: '#/components/schemas/Cases_alert_identifiers'
        index:
          $ref: '#/components/schemas/Cases_alert_indices'
        owner:
          $ref: '#/components/schemas/Cases_owner'
        rule:
          $ref: '#/components/schemas/Cases_rule'
        type:
          description: The type of comment.
          enum:
          - alert
          example: alert
          type: string
      required:
      - alertId
      - index
      - owner
      - rule
      - type
      title: Add case comment request properties for alerts
    Cases_case_response_properties:
      title: Case response properties
      type: object
      properties:
        assignees:
          $ref: '#/components/schemas/Cases_assignees'
        category:
          description: The case category.
          type:
          - string
          - 'null'
        closed_at:
          format: date-time
          type:
          - string
          - 'null'
        closed_by:
          $ref: '#/components/schemas/Cases_case_response_closed_by_properties'
        comments:
          description: An array of comment objects for the case.
          items:
            discriminator:
              mapping:
                alert: '#/components/schemas/Cases_alert_comment_response_properties'
                event: '#/components/schemas/Cases_event_comment_response_properties'
                user: '#/components/schemas/Cases_user_comment_response_properties'
              propertyName: type
            oneOf:
            - $ref: '#/components/schemas/Cases_alert_comment_response_properties'
            - $ref: '#/components/schemas/Cases_event_comment_response_properties'
            - $ref: '#/components/schemas/Cases_user_comment_response_properties'
          maxItems: 10000
          title: Case response properties for comments
          type: array
        connector:
          discriminator:
            mapping:
              .cases-webhook: '#/components/schemas/Cases_connector_properties_cases_webhook'
              .jira: '#/components/schemas/Cases_connector_properties_jira'
              .none: '#/components/schemas/Cases_connector_properties_none'
              .resilient: '#/components/schemas/Cases_connector_properties_resilient'
              .servicenow: '#/components/schemas/Cases_connector_properties_servicenow'
              .servicenow-sir: '#/components/schemas/Cases_connector_properties_servicenow_sir'
              .swimlane: '#/components/schemas/Cases_connector_properties_swimlane'
            propertyName: type
          oneOf:
          - $ref: '#/components/schemas/Cases_connector_properties_none'
          - $ref: '#/components/schemas/Cases_connector_properties_cases_webhook'
          - $ref: '#/components/schemas/Cases_connector_properties_jira'
          - $ref: '#/components/schemas/Cases_connector_properties_resilient'
          - $ref: '#/components/schemas/Cases_connector_properties_servicenow'
          - $ref: '#/components/schemas/Cases_connector_properties_servicenow_sir'
          - $ref: '#/components/schemas/Cases_connector_properties_swimlane'
          title: Case response properties for connectors
        created_at:
          example: '2022-05-13T09:16:17.416Z'
          format: date-time
          type: string
        created_by:
          $ref: '#/components/schemas/Cases_case_response_created_by_properties'
        customFields:
          description: Custom field values for the case.
          items:
            type: object
            properties:
              key:
                description: 'The unique identifier for the custom field. The key value must exist in the case configuration settings.

                  '
                type: string
              type:
                description: 'The custom field type. It must match the type specified in the case configuration settings.

                  '
                enum:
                - text
                - toggle
                type: string
              value:
                description: 'The custom field value. If the custom field is required, it cannot be explicitly set to null. However, for cases that existed when the required custom field was added, the default value stored in Elasticsearch is `undefined`. The value returned in the API and user interface in this case is `null`.

                  '
                oneOf:
                - maxLength: 160
                  minLength: 1
                  type:
                  - string
                  - 'null'
                - type: boolean
          type: array
        description:
          example: A case description.
          type: string
        duration:
          description: 'The elapsed time from the creation of the case to its closure (in seconds). If the case has not been closed, the duration is set to null. If the case was closed after less than half a second, the duration is rounded down to zero.

            '
          example: 120
          type:
          - integer
          - 'null'
        external_service:
          $ref: '#/components/schemas/Cases_external_service'
        id:
          example: 66b9aa00-94fa-11ea-9f74-e7e108796192
          type: string
        incremental_id:
          description: 'A monotonically increasing number assigned to each case, unique per space. This value is generated asynchronously after the case is created and may not be present immediately in the response.

            '
          example: 1
          type:
          - integer
          - 'null'
        observables:
          description: Observables attached to the case.
          items:
            $ref: '#/components/schemas/Cases_case_observable'
          type: array
        owner:
          $ref: '#/components/schemas/Cases_owner'
        settings:
          $ref: '#/components/schemas/Cases_settings'
        severity:
          $ref: '#/components/schemas/Cases_case_severity'
        status:
          $ref: '#/components/schemas/Cases_case_status'
        tags:
          example:
          - tag-1
          items:
            type: string
          type: array
        title:
          example: Case title 1
          type: string
        total_observables:
          description: The number of observables attached to the case.
          example: 0
          type:
          - integer
          - 'null'
        totalAlerts:
          example: 0
          type: integer
        totalComment:
          example: 0
          type: integer
        totalEvents:
          description: The number of events attached to the case.
          example: 0
          type: integer
        updated_at:
          format: date-time
          type:
          - string
          - 'null'
        updated_by:
          $ref: '#/components/schemas/Cases_case_response_updated_by_properties'
        version:
          example: WzUzMiwxXQ==
          type: string
      required:
      - closed_at
      - closed_by
      - comments
      - connector
      - created_at
      - created_by
      - description
      - duration
      - external_service
      - id
      - observables
      - owner
      - settings
      - severity
      - status
      - tags
      - title
      - totalAlerts
      - totalComment
      - total_observables
      - updated_at
      - updated_by
      - version
    Cases_template_dry_run_response:
      description: Returned instead of the template when the request was sent with `dry_run=true`.
      properties:
        valid:
          description: Always `true` — validation failures return a 4xx error instead.
          enum:
          - true
          type: boolean
      required:
      - valid
      title: Template write dry run response
      type: object
    Cases_alert_comment_response_properties:
      title: Add case comment response properties for alerts
      type: object
      properties:
        alertId:
          items:
            example: a6e12ac4-7bce-457b-84f6-d7ce8deb8446
            type: string
          type: array
        created_at:
          example: '2023-11-06T19:29:38.424Z'
          format: date-time
          type: string
        created_by:
          type: object
          properties:
            email:
              example: null
              type:
              - string
              - 'null'
            full_name:
              example: null
              type:
              - string
              - 'null'
            profile_uid:
              example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
              type: string
            username:
              example: elastic
              type:
              - string
              - 'null'
          required:
          - email
          - full_name
          - username
        id:
          example: 73362370-ab1a-11ec-985f-97e55adae8b9
          type: string
        index:
          items:
            example: .internal.alerts-security.alerts-default-000001
            type: string
          type: array
        owner:
          $ref: '#/components/schemas/Cases_owner'
        pushed_at:
          example: null
          format: date-time
          type:
          - string
          - 'null'
        pushed_by:
          type:
          - object
          - 'null'
          properties:
            email:
              example: null
              type:
              - string
              - 'null'
            full_name:
              example: null
              type:
              - string
              - 'null'
            profile_uid:
              example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
              type: string
            username:
              example: elastic
              type:
              - string
              - 'null'
          required:
          - email
          - full_name
          - username
        rule:
          type: object
          properties:
            id:
              description: The rule identifier.
              example: 94d80550-aaf4-11ec-985f-97e55adae8b9
              type:
              - string
              - 'null'
            name:
              description: The rule name.
              example: security_rule
              type:
              - string
              - 'null'
        type:
          enum:
          - alert
          example: alert
          type: string
        updated_at:
          format: date-time
          type:
          - string
          - 'null'
        updated_by:
          type:
          - object
          - 'null'
          properties:
            email:
              example: null
              type:
              - string
              - 'null'
            full_name:
              example: null
              type:
              - string
              - 'null'
            profile_uid:
              example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
              type: string
            username:
              example: elastic
              type:
              - string
              - 'null'
          required:
          - email
          - full_name
          - username
        version:
          example: WzMwNDgsMV0=
          type: string
      required:
      - type
    Cases_payload_settings:
      type: object
      properties:
        settings:
          $ref: '#/components/schemas/Cases_settings'
    Cases_connector_properties_swimlane:
      description: Defines properties for connectors when type is `.swimlane`.
      type: object
      properties:
        fields:
          description: An object containing the connector fields. If you want to omit any individual field, specify null as its value.
          type: object
          properties:
            caseId:
              description: The case identifier for Swimlane connectors.
              type:
              - string
              - 'null'
          required:
          - caseId
        id:
          description: The identifier for the connector. To retrieve connector IDs, use the find connectors API.
          type: string
        name:
          description: The name of the connector.
          type: string
        type:
          description: The type of connector.
          enum:
          - .swimlane
          example: .swimlane
          type: string
      required:
      - fields
      - id
      - name
      - type
      title: Create case request properties for a Swimlane connector
    Cases_case_response_get_case:
      description: 'Case details returned by the get case API. The comments property is not included in the response. Use the find case comments API to retrieve comments. totalComment reflects the actual number of user comments.

        '
      properties:
        assignees:
          $ref: '#/components/schemas/Cases_assignees'
        category:
          description: The case category.
          type:
          - string
          - 'null'
        closed_at:
          format: date-time
          type:
          - string
          - 'null'
        closed_by:
          $ref: '#/components/schemas/Cases_case_response_closed_by_properties'
        connector:
          discriminator:
            mapping:
              .cases-webhook: '#/components/schemas/Cases_connector_properties_cases_webhook'
              .jira: '#/components/schemas/Cases_connector_properties_jira'
              .none: '#/components/schemas/Cases_connector_properties_none'
              .resilient: '#/components/schemas/Cases_connector_properties_resilient'
              .servicenow: '#/components/schemas/Cases_connector_properties_servicenow'
              .servicenow-sir: '#/components/schemas/Cases_connector_properties_servicenow_sir'
              .swimlane: '#/components/schemas/Cases_connector_properties_swimlane'
            propertyName: type
          oneOf:
          - $ref: '#/components/schemas/Cases_connector_properties_none'
          - $ref: '#/components/schemas/Cases_connector_properties_cases_webhook'
          - $ref: '#/components/schemas/Cases_connector_properties_jira'
          - $ref: '#/components/schemas/Cases_connector_properties_resilient'
          - $ref: '#/components/schemas/Cases_connector_properties_servicenow'
          - $ref: '#/components/schemas/Cases_connector_properties_servicenow_sir'
          - $ref: '#/components/schemas/Cases_connector_properties_swimlane'
          title: Case response properties for connectors
        created_at:
          example: '2022-05-13T09:16:17.416Z'
          format: date-time
          type: string
        created_by:
          $ref: '#/components/schemas/Cases_case_response_created_by_properties'
        customFields:
          description: Custom field values for the case.
          items:
            type: object
            properties:
              key:
                description: 'The unique identifier for the custom field. The key value must exist in the case configuration settings.

                  '
                type: string
              type:
                description: 'The custom field type. It must match the type specified in the case configuration settings.

                  '
                enum:
                - text
                - toggle
                type: string
              value:
                description: 'The custom field value. If the custom field is required, it cannot be explicitly set to null. However, for cases that existed when the required custom field was added, the default value stored in Elasticsearch is `undefined`. The value returned in the API and user interface in this case is `null`.

                  '
                oneOf:
                - maxLength: 160
                  minLength: 1
                  type:
                  - string
                  - 'null'
                - type: boolean
          type: array
        description:
          example: A case description.
          type: string
        duration:
          description: 'The elapsed time from the creation of the case to its closure (in seconds). If the case has not been closed, the duration is set to null. If the case was closed after less than half a second, the duration is rounded down to zero.

            '
          example: 120
          type:
          - integer
          - 'null'
        external_service:
          $ref: '#/components/schemas/Cases_external_service'
        id:
          example: 66b9aa00-94fa-11ea-9f74-e7e108796192
          type: string
        incremental_id:
          description: 'A monotonically increasing number assigned to each case, unique per space. This value is generated asynchronously after the case is created and may not be present immediately in the response.

            '
          example: 1
          type:
          - integer
          - 'null'
        observables:
          description: Observables attached to the case.
          items:
            $ref: '#/components/schemas/Cases_case_observable'
          type: array
        owner:
          $ref: '#/components/schemas/Cases_owner'
        settings:
          $ref: '#/components/schemas/Cases_settings'
        severity:
          $ref: '#/components/schemas/Cases_case_severity'
        status:
          $ref: '#/components/schemas/Cases_case_status'
        tags:
          example:
          - tag-1
          items:
            type: string
          type: array
        title:
          example: Case title 1
          type: string
        total_observables:
          description: The number of observables attached to the case.
          example: 0
          type:
          - integer
          - 'null'
        totalAlerts:
          example: 0
          type: integer
        totalComment:
          description: The number of user comments on the case. Use the find case comments API to retrieve comment content.
          example: 1
          type: integer
        totalEvents:
          description: The number of events attached to the case.
          example: 0
          type: integer
        updated_at:
          format: date-time
          type:
          - string
          - 'null'
        updated_by:
          $ref: '#/components/schemas/Cases_case_response_updated_by_properties'
        version:
          example: WzUzMiwxXQ==
          type: string
      required:
      - closed_at
      - closed_by
      - connector
      - created_at
      - created_by
      - description
      - duration
      - external_service
      - id
      - observables
      - owner
      - settings
      - severity
      - status
      - tags
      - title
      - totalAlerts
      - totalComment
      - total_observables
      - updated_at
      - updated_by
      - version
      title: Get case response
      type: object
    Cases_payload_pushed:
      type: object
      properties:
        externalService:
          $ref: '#/components/schemas/Cases_external_service'
    Cases_event_comment_response_properties:
      title: Case response properties for event comments
      type: object
      properties:
        created_at:
          example: '2022-05-13T09:16:17.416Z'
          format: date-time
          type: string
        created_by:
          $ref: '#/components/schemas/Cases_case_response_created_by_properties'
        eventId:
          items:
            example: 7605e6a6f9f4f990ad9f8f6901e5f082f1f1f1665cbaf2f0f2c6f8f6b0d8a39f
            type: string
          type: array
        id:
          example: 8af6ac20-74f6-11ea-b83a-553aecdb28b6
          type: string
        index:
          items:
            example: .internal.alerts-security.alerts-default-000001
            type: string
          type: array
        owner:
          $ref: '#/components/schemas/Cases_owner'
        pushed_at:
          example: null
          format: date-time
          type:
          - string
          - 'null'
        pushed_by:
          $ref: '#/components/schemas/Cases_case_response_pushed_by_properties'
        type:
          enum:
          - event
          example: event
          type: string
        updated_at:
          example: null
          format: date-time
          type:
          - string
          - 'null'
        updated_by:
          $ref: '#/components/schemas/Cases_case_response_updated_by_properties'
        version:
          example: WzIwNDMxLDFd
          type: string
      required:
      - type
    Cases_payload_severity:
      type: object
      properties:
        severity:
          $ref: '#/components/schemas/Cases_case_severity'
    Cases_string_array:
      items:
        $ref: '#/components/schemas/Cases_string'
      maxItems: 100
      type: array
    Cases_get_case_templates_response:
      description: Response returned by the get all case templates API.
      type: object
      properties:
        page:
          description: The page number of the returned results.
          type: integer
        perPage:
          description: The number of results per page.
          type: integer
        templates:
          items:
            allOf:
            - $ref: '#/components/schemas/Cases_template_v2_response'
            - type: object
              properties:
                fieldSearchMatches:
                  description: Whether the search query matched a field name in this template.
                  type: boolean
              required:
              - fieldSearchMatches
          type: array
        total:
          description: The total number of templates matching the query.
          type: integer
      required:
      - templates
      - page
      - perPage
      - total
    Cases_case_response_pushed_by_properties:
      properties:
        email:
          example: null
          type:
          - string
          - 'null'
        full_name:
          example: null
          type:
          - string
          - 'null'
        profile_uid:
          example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
          type: string
        username:
          example: elastic
          type:
          - string
          - 'null'
      required:
      - email
      - full_name
      - username
      title: Case response properties for pushed_by
      type:
      - object
      - 'null'
    Cases_case_response_updated_by_properties:
      properties:
        email:
          example: null
          type:
          - string
          - 'null'
        full_name:
          example: null
          type:
          - string
          - 'null'
        profile_uid:
          example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
          type: string
        username:
          example: elastic
          type:
          - string
          - 'null'
      required:
      - email
      - full_name
      - username
      title: Case response properties for updated_by
      type:
      - object
      - 'null'
    Cases_attachment_totals:
      description: Counts of alerts, events, and user comments attached to a case.
      properties:
        alerts:
          description: Number of alert attachments on the case.
          type: integer
        events:
          description: Number of event attachments on the case.
          type: integer
        userComments:
          description: Number of user comment attachments on the case.
          type: integer
      required:
      - alerts
      - events
      - userComments
      title: Attachment totals
      type: object
    Cases_connector_properties_none:
      description: Defines properties for connectors when type is `.none`.
      type: object
      properties:
        fields:
          description: An object containing the connector fields. To create a case without a connector, specify null. To update a case to remove the connector, specify null.
          example: null
          type:
          - string
          - 'null'
        id:
          description: The identifier for the connector. To create a case without a connector, use `none`. To update a case to remove the connector, specify `none`.
          example: none
          type: string
        name:
          description: The name of the connector. To create a case without a connector, use `none`. To update a case to remove the connector, specify `none`.
          example: none
          type: string
        type:
          description: The type of connector. To create a case without a connector, use `.none`. To update a case to remove the connector, specify `.none`.
          enum:
          - .none
          example: .none
          type: string
      required:
      - fields
      - id
      - name
      - type
      title: Create or update case request properties for no connector
    Cases_case_response_created_by_properties:
      title: Case response properties for created_by
      type: object
      properties:
        email:
          example: null
          type:
          - string
          - 'null'
        full_name:
          example: null
          type:
          - string
          - 'null'
        profile_uid:
          example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
          type: string
        username:
          example: elastic
          type:
          - string
          - 'null'
      required:
      - email
      - full_name
      - username
    Cases_connector_properties_resilient:
      description: Defines properties for connectors when type is `.resilient`.
      type: object
      properties:
        fields:
          description: An object containing the connector fields. If you want to omit any individual field, specify null as its value.
          type:
          - object
          - 'null'
          properties:
            issueTypes:
              description: The type of incident.
              items:
                type: string
              type: array
            severityCode:
              description: The severity code of the incident.
              type: string
          required:
          - issueTypes
          - severityCode
        id:
          description: The identifier for the connector.
          type: string
        name:
          description: The name of the connector.
          type: string
        type:
          description: The type of connector.
          enum:
          - .resilient
          example: .resilient
          type: string
      required:
      - fields
      - id
      - name
      - type
      title: Create case request properties for a IBM Resilient connector
    Cases_string:
      type: string
    Cases_connector_properties_cases_webhook:
      description: Defines properties for connectors when type is `.cases-webhook`.
      type: object
      properties:
        fields:
          example: null
          type:
          - string
          - 'null'
        id:
          description: The identifier for the connector. To retrieve connector IDs, use the find connectors API.
          type: string
        name:
          description: The name of the connector.
          type: string
        type:
          description: The type of connector.
          enum:
          - .cases-webhook
          example: .cases-webhook
          type: string
      required:
      - fields
      - id
      - name
      - type
      title: Create or upate case request properties for Cases Webhook connector
    Cases_response_4xx:
      properties:
        error:
          example: Unauthorized
          type: string
        message:
          type: string
        statusCode:
          example: 401
          type: integer
      title: Unsuccessful cases API response
      type: object
    Cases_templates:
      items:
        type: object
        properties:
          caseFields:
            type: object
            properties:
              assignees:
                $ref: '#/components/schemas/Cases_assignees'
              category:
                $ref: '#/components/schemas/Cases_case_category'
              connector:
                type: object
                properties:
                  fields:
                    description: The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to `null`.
                    type:
                    - object
                    - 'null'
                  id:
                    description: The identifier for the connector. If you do not want a default connector, use `none`. To retrieve connector IDs, use the find connectors API.
                    example: none
                    type: string
                  name:
                    description: The name of the connector. If you do not want a default connector, use `none`. To retrieve connector names, use the find connectors API.
                    example: none
                    type: string
                  type:
                    $ref: '#/components/schemas/Cases_connector_types'
              customFields:
                description: Custom field values in the template.
                items:
                  type: object
                  properties:
                    key:
                      description: The unique key for the custom field.
                      type: string
                    type:
                      description: The type of the custom field.
                      enum:
                      - text
                      - toggle
                      type: string
                    value:
                      description: 'The default value for the custom field when a case uses the template. If the `type` is `text`, the default value must be a string. If the `type` is `toggle`, the default value must be boolean.

                        '
                      oneOf:
                      - type: string
                      - type: boolean
                type: array
                x-state: Technical preview
              description:
                $ref: '#/components/schemas/Cases_case_description'
              settings:
                $ref: '#/components/schemas/Cases_settings'
              severity:
                $ref: '#/components/schemas/Cases_case_severity'
              tags:
                $ref: '#/components/schemas/Cases_case_tags'
              title:
                $ref: '#/components/schemas/Cases_case_title'
          description:
            description: A description for the template.
            type: string
          key:
            description: 'A unique key for the template. Must be lower case and composed only of a-z, 0-9, ''_'', and ''-'' characters. It is used in API calls to refer to a specific template.

              '
            type: string
          name:
            description: The name of the template.
            type: string
          tags:
            $ref: '#/components/schemas/Cases_template_tags'
      type: array
      x-state: Technical preview
    Cases_connector_types:
      description: The type of connector.
      enum:
      - .cases-webhook
      - .jira
      - .none
      - .resilient
      - .servicenow
      - .servicenow-sir
      - .swimlane
      example: .none
      type: string
    Cases_find_comments_response:
      title: Find case comments response
      type: object
      properties:
        comments:
          description: Paginated list of user comments for the case.
          items:
            $ref: '#/components/schemas/Cases_user_comment_response_properties'
          type: array
        page:
          description: The current page index.
          type: integer
        per_page:
          description: The number of items per page.
          type: integer
        total:
          description: The total number of comments.
          type: integer
      required:
      - comments
      - page
      - per_page
      - total
    Cases_payload_assignees:
      type: object
      properties:
        assignees:
          $ref: '#/components/schemas/Cases_assignees'
    Cases_case_description:
      description: The description for the case.
      maxLength: 30000
      type: string
    Cases_payload_description:
      type: object
      properties:
        description:
          type: string
    Cases_assignees:
      description: An array containing users that are assigned to the case.
      items:
        type: object
        properties:
          uid:
            description: A unique identifier for the user profile. These identifiers can be found by using the suggest user profile API.
            example: u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0
            type: string
        required:
        - uid
      maxItems: 10
      type:
      - array
      - 'null'
    Cases_template_v2_response:
      description: A case template (v2).
      type: object
      properties:
        author:
          description: The username of the template author.
          maxLength: 1000
          type: string
        definition:
          description: The parsed template definition.
        definitionString:
          description: The raw YAML definition string.
          maxLength: 30000
          type: string
        deletedAt:
          description: The date the template was soft-deleted, or null if active.
          format: date-time
          type:
          - string
          - 'null'
        description:
          description: A human-readable description of the template.
          maxLength: 30000
          type: string
        fieldCount:
          description: The number of fields defined in the template.
          type: integer
        fieldDefinitions:
          description: Metadata about each field defined in the template.
          items:
            type: object
            properties:
              control:
                maxLength: 50
                type: string
              label:
                maxLength: 256
                type: string
              name:
                maxLength: 256
                type: string
              type:
                maxLength: 50
                type: string
            required:
            - name
            - label
            - type
            - control
          type: array
        isDefault:
          description: Whether this is the default template for its owner.
          type: boolean
        isEnabled:
          description: Whether the template is enabled.
          type: boolean
        isLatest:
          description: Whether this is the latest version of the template.
          type: boolean
        lastUsedAt:
          description: The date the template was last used to create a case.
          format: date-time
          type: string
        latestVersion:
          description: The latest version number of this template.
          type: integer
        name:
          description: The display name of the template.
          maxLength: 100
          type: string
        owner:
          description: The owning solution (e.g. cases, observability, securitySolution).
          maxLength: 50
          type: string
        tags:
          $ref: '#/components/schemas/Cases_template_tags'
        templateId:
          description: The unique identifier of the template, shared across all versions.
          maxLength: 36
          type: string
        templateVersion:
          description: The version number of this template revision.
          type: integer
        usageCount:
          description: The number of times this template has been used to create a case.
          type: integer
      required:
      - templateId
      - name
      - owner
      - definition
      - definitionString
      - templateVersion
      - deletedAt
      - isLatest
      - latestVersion
    Cases_set_case_configuration_request:
      description: External connection details, such as the closure type and default connector for cases.
      properties:
        closure_type:
          $ref: '#/components/schemas/Cases_closure_types'
        connector:
          description: An object that contains the connector configuration.
          type: object
          properties:
            fields:
              description: The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to `null`.
              type:
              - object
              - 'null'
            id:
              description: The identifier for the connector. If you do not want a default connector, use `none`. To retrieve connector IDs, use the find connectors API.
              example: none
              type: string
            name:
              description: The name of the connector. If you do not want a default connector, use `none`. To retrieve connector names, use the find connectors API.
              example: none
              type: string
            type:
              $ref: '#/components/schemas/Cases_connector_types'
          required:
          - fields
          - id
          - name
          - type
        customFields:
          description: Custom fields case configuration.
          items:
            type: object
            properties:
              defaultValue:
                description: 'A default value for the custom field. If the `type` is `text`, the default value must be a string. If the `type` is `toggle`, the default value must be boolean.

                  '
                oneOf:
                - type: string
                - type: boolean
              key:
                description: 'A unique key for the custom field. Must be lower case and composed only of a-z, 0-9, ''_'', and ''-'' characters. It is used in API calls to refer to a specific custom field.

                  '
                maxLength: 36
                minLength: 1
                type: string
              label:
                description: The custom field label that is displayed in the case.
                maxLength: 50
                minLength: 1
                type: string
              type:
                description: The type of the custom field.
                enum:
                - text
                - toggle
                type: string
              required:
                description: 'Indicates whether the field is required. If `false`, the custom field can be set to null or omitted when a case is created or updated.

                  '
                type: boolean
            required:
            - key
            - label
            - required
            - type
          maxItems: 10
          minItems: 0
          type: array
        owner:
          $ref: '#/components/schemas/Cases_owner'
        templates:
          $ref: '#/components/schemas/Cases_templates'
      required:
      - closure_type
      - connector
      - owner
      title: Set case configuration request
      type: object
    Cases_add_case_file_request:
      description: Defines the file that will be attached to the case. Optional parameters will be generated automatically from the file metadata if not defined.
      type: object
      properties:
        file:
          description: The file being attached to the case.
          format: binary
          type: string
        filename:
          description: The desired name of the file being attached to the case, it can be different than the name of the file in the filesystem. **This should not include the file extension.**
          type: string
      required:
      - file
      title: Add case file request properties
    Cases_payload_alert_comment:
      type: object
      properties:
        comment:
          type: object
          properties:
            alertId:
              oneOf:
              - example: 1c0b056b-cc9f-4b61-b5c9-cb801abd5e1d
                type: string
              - items:
                  type: string
                type: array
            index:
              oneOf:
              - example: .alerts-observability.logs.alerts-default
                type: string
              - items:
                  type: string
                type: array
            owner:
              $ref: '#/components/schemas/Cases_owner'
            rule:
              type: object
              properties:
                id:
                  description: The rule identifier.
                  example: 94d80550-aaf4-11ec-985f-97e55adae8b9
                  type:
                  - string
                  - 'null'
                name:
                  description: The rule name.
                  example: security_rule
                  type:
                  - string
                  - 'null'
            type:
              enum:
              - alert
              type: string
    Cases_case_category:
      description: A word or phrase that categorizes the case.
      maxLength: 50
      type: string
    Cases_external_service:
      type:
      - object
      - 'null'
      properties:
        connector_id:
          type: string
        connector_name:
          type: string
        external_id:
          type: string
        external_title:
          type: string
        external_url:
          type: string
        pushed_at:
          format: date-time
          type: string
        pushed_by:
          type:
          - object
          - 'null'
          properties:
            email:
              example: null
              type:
              - string
              - 'null'
            full_name:
              example: null
              type:
              - string
              - 'null'
            profile_uid:
              example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
              type: string
            username:
              example: elastic
              type:
              - string
              - 'null'
    Cases_payload_delete:
      description: If the `action` is `delete` and the `type` is `delete_case`, the payload is nullable.
      type:
      - object
      - 'null'
    Cases_template_write_request:
      description: 'The body for creating or fully replacing a case template. Server-managed attributes (author, usage statistics, field summaries, version flags) are computed and cannot be set.


        Resource limits (enforced on write; a violation returns `400`): an owner may have at most 200 templates per space, and a definition may declare at most 200 fields. Version history is intentionally uncapped. A single stored extended-field value may not exceed 30000 UTF-8 bytes. The YAML `definition` string itself may not exceed 30000 characters (enforced on create, update, and `dry_run`).

        '
      properties:
        definition:
          description: 'The template definition as a YAML string: case defaults (name, severity, category, tags, assignees, connector, settings) and a `fields` array of inline field definitions or `$ref` entries pointing into the owner''s field library. Stored field values appear on cases under `extended_fields` keys shaped `<field_name>_as_<storage_type>`.

            '
          example: "name: Security incident\nseverity: high\ntags: [security]\nfields:\n  - name: priority\n    label: Priority\n    type: keyword\n    control: SELECT_BASIC\n    metadata:\n      options: [low, medium, high]\n      default: medium\n  - $ref: risk_score\n"
          maxLength: 30000
          type: string
        description:
          description: A description of the template.
          maxLength: 1000
          type: string
        isEnabled:
          default: true
          description: Disabled templates are hidden from the case creation flow.
          type: boolean
        name:
          description: 'The template identity name, unique per owner (case-insensitive). May be omitted when the YAML definition provides a case-default title (`name:`), which is then used as the identity name.

            '
          maxLength: 50
          minLength: 1
          type: string
        owner:
          $ref: '#/components/schemas/Cases_owner'
        tags:
          $ref: '#/components/schemas/Cases_template_tags'
      required:
      - owner
      - definition
      title: Template write request
      type: object
    Cases_user_actions_find_response_properties:
      type: object
      properties:
        action:
          $ref: '#/components/schemas/Cases_actions'
        comment_id:
          example: 578608d0-03b1-11ed-920c-974bfa104448
          type:
          - string
          - 'null'
        created_at:
          example: '2022-05-13T09:16:17.416Z'
          format: date-time
          type: string
        created_by:
          type: object
          properties:
            email:
              example: null
              type:
              - string
              - 'null'
            full_name:
              example: null
              type:
              - string
              - 'null'
            profile_uid:
              example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
              type: string
            username:
              example: elastic
              type:
              - string
              - 'null'
          required:
          - email
          - full_name
          - username
        id:
          example: 22fd3e30-03b1-11ed-920c-974bfa104448
          type: string
        owner:
          $ref: '#/components/schemas/Cases_owner'
        payload:
          oneOf:
          - $ref: '#/components/schemas/Cases_payload_alert_comment'
          - $ref: '#/components/schemas/Cases_payload_assignees'
          - $ref: '#/components/schemas/Cases_payload_connector'
          - $ref: '#/components/schemas/Cases_payload_create_case'
          - $ref: '#/components/schemas/Cases_payload_delete'
          - $ref: '#/components/schemas/Cases_payload_description'
          - $ref: '#/components/schemas/Cases_payload_pushed'
          - $ref: '#/components/schemas/Cases_payload_settings'
          - $ref: '#/components/schemas/Cases_payload_severity'
          - $ref: '#/components/schemas/Cases_payload_status'
          - $ref: '#/components/schemas/Cases_payload_tags'
          - $ref: '#/components/schemas/Cases_payload_title'
          - $ref: '#/components/schemas/Cases_payload_user_comment'
        type:
          description: The type of action.
          enum:
          - assignees
          - category
          - comment
          - connector
          - create_case
          - customFields
          - delete_case
          - description
          - extended_fields
          - observables
          - pushed
          - settings
          - severity
          - status
          - tags
          - title
          example: create_case
          type: string
        version:
          example: WzM1ODg4LDFd
          type: string
      required:
      - action
      - comment_id
      - created_at
      - created_by
      - id
      - owner
      - payload
      - type
      - version
    Cases_case_title:
      description: A title for the case.
      maxLength: 160
      type: string
    Cases_update_user_comment_request_properties:
      description: Defines properties for case comment requests when type is user.
      properties:
        comment:
          description: The new comment. It is required only when `type` is `user`.
          example: A new comment.
          maxLength: 30000
          type: string
        id:
          description: 'The identifier for the comment. To retrieve comment IDs, use the get comments API.

            '
          example: 8af6ac20-74f6-11ea-b83a-553aecdb28b6
          type: string
        owner:
          $ref: '#/components/schemas/Cases_owner'
        type:
          description: The type of comment.
          enum:
          - user
          example: user
          type: string
        version:
          description: 'The current comment version. To retrieve version values, use the get comments API.

            '
          example: Wzk1LDFd
          type: string
      required:
      - comment
      - id
      - owner
      - type
      - version
      title: Update case comment request properties for user comments
      type: object
    Cases_case_close_sync_reason:
      description: 'The close reason to sync to attached alerts when closing the case. Can be one of following predefined reasons: [false_positive, duplicate, true_positive, benign_positive, automated_closure, other] or a custom reason provided by the user.

        '
      oneOf:
      - enum:
        - false_positive
        - duplicate
        - true_positive
        - benign_positive
        - automated_closure
        - other
        type: string
      - type: string
    Cases_searchFieldsTypeArray:
      items:
        $ref: '#/components/schemas/Cases_searchFieldsType'
      type: array
    Cases_settings:
      description: An object that contains the case settings.
      type: object
      properties:
        extractObservables:
          description: 'When true, observables (e.g. IPs, hashes, URLs) are automatically extracted from case comments. Optional; defaults to false when omitted.

            '
          example: false
          type: boolean
        syncAlerts:
          description: Turns alert syncing on or off.
          example: true
          type: boolean
      required:
      - syncAlerts
    Cases_payload_status:
      type: object
      properties:
        status:
          $ref: '#/components/schemas/Cases_case_status'
  parameters:
    Cases_sort_order:
      description: Determines the sort order.
      example: desc
      in: query
      name: sortOrder
      required: false
      schema:
        default: desc
        enum:
        - asc
        - desc
        type: string
    Cases_template_sort_field:
      description: Determines which field is used to sort the results.
      example: name
      in: query
      name: sortField
      required: false
      schema:
        default: name
        enum:
        - templateId
        - name
        - templateVersion
        - owner
        - deletedAt
        - author
        - usageCount
        - fieldCount
        - lastUsedAt
        - isDefault
        - isLatest
        type: string
    Cases_page_size:
      description: The number of items to return. Limited to 100 items.
      example: 20
      in: query
      name: perPage
      required: false
      schema:
        default: 20
        maximum: 100
        type: integer
    Cases_status:
      description: Filters the returned cases by state.
      example: open
      in: query
      name: status
      schema:
        enum:
        - closed
        - in-progress
        - open
        type: string
    Cases_assignees_filter:
      description: 'Filters the returned cases by assignees. Valid values are `none` or unique identifiers for the user profiles. These identifiers can be found by using the suggest user profile API.

        '
      in: query
      name: assignees
      schema:
        oneOf:
        - $ref: '#/components/schemas/Cases_string'
        - $ref: '#/components/schemas/Cases_string_array'
    Cases_configuration_id:
      description: An identifier for the configuration.
      in: path
      name: configurationId
      required: true
      schema:
        example: 3297a0f0-b5ec-11ec-b141-0fdb20a7f9a9
        type: string
    Cases_template_version:
      description: The version number of the template to retrieve. If omitted, the latest version is returned.
      example: 1
      in: query
      name: version
      required: false
      schema:
        minimum: 1
        type: integer
    Cases_template_is_enabled:
      description: Filters the returned templates by their enabled state.
      example: true
      in: query
      name: isEnabled
      schema:
        type: boolean
    Cases_comment_id:
      description: 'The identifier for the comment. To retrieve comment IDs, use the get case or search cases (`_find`) APIs.

        '
      in: path
      name: commentId
      required: true
      schema:
        example: 71ec1870-725b-11ea-a0b2-c51ea50a58e2
        type: string
    Cases_sortField:
      description: Determines which field is used to sort the results.
      example: updatedAt
      in: query
      name: sortField
      schema:
        default: createdAt
        enum:
        - createdAt
        - updatedAt
        - closedAt
        - title
        - category
        - status
        - severity
        type: string
    Cases_connector_id:
      description: An identifier for the connector. To retrieve connector IDs, use the find connectors API.
      in: path
      name: connectorId
      required: true
      schema:
        example: abed3a70-71bd-11ea-a0b2-c51ea50a58e2
        type: string
    Cases_alert_id:
      description: An identifier for the alert.
      in: path
      name: alertId
      required: true
      schema:
        example: 09f0c261e39e36351d75995b78bb83673774d1bc2cca9df2d15f0e5c0a99a540
        type: string
    Cases_tags:
      description: Filters the returned cases by tags.
      example: tag-1
      in: query
      name: tags
      schema:
        oneOf:
        - $ref: '#/components/schemas/Cases_string'
        - $ref: '#/components/schemas/Cases_string_array'
    Cases_user_action_types:
      description: Determines the types of user actions to return.
      in: query
      name: types
      schema:
        items:
          enum:
          - action
          - alert
          - assignees
          - attachment
          - comment
          - connector
          - create_case
          - description
          - pushed
          - settings
          - severity
          - status
          - tags
          - title
          - user
          example: create_case
          type: string
        type: array
    Cases_template_author:
      description: Filters the returned templates by author username.
      example: elastic
      in: query
      name: author
      schema:
        oneOf:
        - $ref: '#/components/schemas/Cases_string'
        - $ref: '#/components/schemas/Cases_string_array'
    Cases_owner_filter:
      description: 'A filter to limit the response to a specific set of applications. If this parameter is omitted, the response contains information about all the cases that the user has access to read.

        '
      example: cases
      in: query
      name: owner
      schema:
        oneOf:
        - $ref: '#/components/schemas/Cases_owner'
        - $ref: '#/components/schemas/Cases_owners'
    Cases_to:
      description: 'Returns only cases that were created before a specific date. The date must be specified as a KQL data range or date match expression.

        '
      example: now+1d
      in: query
      name: to
      schema:
        type: string
    Cases_template_tags:
      description: Filters the returned templates by tags.
      example: tag-1
      in: query
      name: tags
      schema:
        oneOf:
        - $ref: '#/components/schemas/Cases_string'
        - $ref: '#/components/schemas/Cases_string_array'
    Cases_search:
      description: An Elasticsearch simple_query_string query that filters the objects in the response.
      example: Case title 1
      in: query
      name: search
      schema:
        type: string
    Cases_ids:
      description: 'The cases that you want to removed. To get the case identifiers, use the search cases (`_find`) API. In the Dev Console, you can specify the array of cases in the following format: `ids=["e58e77e3-ef8e-4251-926f-efb115f3c4ec"]`. In `curl`, all non-ASCII characters must be URL encoded. For example: `ids=%5B%22e58e77e3-ef8e-4251-926f-efb115f3c4ec%22%5D`

        '
      in: query
      name: ids
      required: true
      schema:
        items:
          example: d4e7abb0-b462-11ec-9a8d-698504725a43
          maxItems: 100
          minItems: 1
          type: string
        type: array
    Cases_category:
      description: Filters the returned cases by category.
      in: query
      name: category
      schema:
        oneOf:
        - $ref: '#/components/schemas/Cases_case_category'
        - $ref: '#/components/schemas/Cases_case_categories'
    Cases_from:
      description: 'Returns only cases that were created after a specific date. The date must be specified as a KQL data range or date match expression.

        '
      in: query
      name: from
      schema:
        example: now-1d
        type: string
    Cases_defaultSearchOperator:
      description: he default operator to use for the simple_query_string.
      example: OR
      in: query
      name: defaultSearchOperator
      schema:
        default: OR
        type: string
    Cases_severity:
      description: The severity of the case.
      example: low
      in: query
      name: severity
      schema:
        enum:
        - critical
        - high
        - low
        - medium
        type: string
    Cases_case_id:
      description: The identifier for the case. To retrieve case IDs, use the search cases (`_find)` API. All non-ASCII characters must be URL encoded.
      in: path
      name: caseId
      required: true
      schema:
        example: 9c235210-6834-11ea-a78c-6ffb38a34414
        type: string
    Cases_searchFields:
      description: The fields to perform the simple_query_string parsed query against.
      in: query
      name: searchFields
      schema:
        oneOf:
        - $ref: '#/components/schemas/Cases_searchFieldsType'
        - $ref: '#/components/schemas/Cases_searchFieldsTypeArray'
    Cases_kbn_xsrf:
      description: Cross-site request forgery protection
      in: header
      name: kbn-xsrf
      required: true
      schema:
        type: string
    Cases_reporters:
      description: Filters the returned cases by the user name of the reporter.
      example: elastic
      in: query
      name: reporters
      schema:
        oneOf:
        - $ref: '#/components/schemas/Cases_string'
        - $ref: '#/components/schemas/Cases_string_array'
    Cases_page_index:
      description: The page number to return.
      example: 1
      in: query
      name: page
      required: false
      schema:
        default: 1
        type: integer
    Cases_template_id:
      description: The identifier for the template.
      example: 9da1ea2a-09f8-4d0e-bf9d-09bf8c9d0f42
      in: path
      name: template_id
      required: true
      schema:
        maxLength: 36
        type: string
  securitySchemes:
    apiKeyAuth:
      description: 'These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: `Authorization: ApiKey base64AccessApiKey`

        '
      in: header
      name: Authorization
      type: apiKey
    basicAuth:
      scheme: basic
      type: http
x-topics:
- title: Kibana spaces
  content: "Spaces enable you to organize your dashboards and other saved objects into meaningful categories.\nYou can use the default space or create your own spaces.\n\nTo run APIs in non-default spaces, you must add `s/{space_id}/` to the path.\nFor example:\n\n```bash\ncurl -X GET \"http://${KIBANA_URL}/s/marketing/api/data_views\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n```\n\nIf you use the Kibana console to send API requests, it automatically adds the appropriate space identifier.\n\nTo learn more, check out [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces).\n"