openapi: 3.0.3
info:
  contact:
    name: Kibana Team
  description: 'The Kibana REST APIs enable you to manage resources such as connectors, data views, and saved objects.

    The API calls are stateless.

    Each request that you make happens in isolation from other calls and must include all of the necessary information for Kibana to fulfill the

    request.

    API requests return JSON output, which is a format that is machine-readable and works well for automation.


    To interact with Kibana APIs, use the following operations:


    - GET: Fetches the information.

    - PATCH: Applies partial modifications to the existing information.

    - POST: Adds new information.

    - PUT: Updates the existing information.

    - DELETE: Removes the information.


    You can prepend any Kibana API endpoint with `kbn:` and run the request in **Dev Tools → Console**.

    For example:


    ```

    GET kbn:/api/data_views

    ```


    For more information about the console, refer to [Run API requests](https://www.elastic.co/docs/explore-analyze/query-filter/tools/console).


    NOTE: Access to internal Kibana API endpoints will be restricted in Kibana version 9.0. Please move any integrations to publicly documented APIs.


    ## Documentation source and versions


    This documentation is derived from the `main` branch of the [kibana](https://github.com/elastic/kibana) repository.

    It is provided under license [Attribution-NonCommercial-NoDerivatives 4.0 International](https://creativecommons.org/licenses/by-nc-nd/4.0/).


    This documentation contains work-in-progress information for future Elastic Stack releases.

    '
  title: Kibana APIs Actions cases API
  version: ''
  x-doc-license:
    name: Attribution-NonCommercial-NoDerivatives 4.0 International
    url: https://creativecommons.org/licenses/by-nc-nd/4.0/
  x-feedbackLink:
    label: Feedback
    url: https://github.com/elastic/docs-content/issues/new?assignees=&labels=feedback%2Ccommunity&projects=&template=api-feedback.yaml&title=%5BFeedback%5D%3A+
servers:
- url: https://{kibana_url}
  variables:
    kibana_url:
      default: localhost:5601
security:
- apiKeyAuth: []
- basicAuth: []
tags:
- description: 'Cases are used to open and track issues. You can add assignees and tags to your cases, set their severity and status, and add alerts, comments, and visualizations. You can also send cases to external incident management systems by configuring connectors.

    '
  name: cases
  externalDocs:
    description: Cases documentation
    url: https://www.elastic.co/docs/explore-analyze/alerts-cases/cases
  x-displayName: Cases
paths:
  /api/cases:
    delete:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        You must have `read` or `all` privileges and the `delete` sub-feature privilege for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you''re deleting.

        '
      operationId: deleteCaseDefaultSpace
      parameters:
      - $ref: '#/components/parameters/Cases_kbn_xsrf'
      - $ref: '#/components/parameters/Cases_ids'
      responses:
        '204':
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Delete cases
      tags:
      - cases
      x-codeSamples:
      - label: curl
        lang: curl
        source: "curl \\\n  --request DELETE 'https://localhost:5601/api/cases?ids=%5B%22030e6e34-6470-4001-864f-b229511ad188%22%2C%22e662ff34-0493-4538-b9d1-6706ced02ff2%22%5D' \\\n  --header \"Authorization: $API_KEY\" \\\n  --header \"Content-Type: application/json\" \\\n  --header \"kbn-xsrf: true\"\n"
      - label: Console
        lang: console
        source: 'DELETE kbn:/api/cases?ids=["030e6e34-6470-4001-864f-b229511ad188","e662ff34-0493-4538-b9d1-6706ced02ff2"]

          '
      x-metaTags:
      - content: Kibana
        name: product_name
    patch:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb patch">patch</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        You must have `all` privileges for the **Cases** feature in the  **Management**, **Observability**, or **Security** section of the Kibana  feature privileges, depending on the owner of the case you''re updating.

        '
      operationId: updateCaseDefaultSpace
      parameters:
      - $ref: '#/components/parameters/Cases_kbn_xsrf'
      requestBody:
        content:
          application/json:
            examples:
              updateCaseRequest:
                $ref: '#/components/examples/Cases_update_case_request'
            schema:
              $ref: '#/components/schemas/Cases_update_case_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                updateCaseResponse:
                  $ref: '#/components/examples/Cases_update_case_response'
              schema:
                items:
                  $ref: '#/components/schemas/Cases_case_response_properties'
                type: array
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Update cases
      tags:
      - cases
      x-metaTags:
      - content: Kibana
        name: product_name
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana  feature privileges, depending on the owner of the case you''re creating.

        '
      operationId: createCaseDefaultSpace
      parameters:
      - $ref: '#/components/parameters/Cases_kbn_xsrf'
      requestBody:
        content:
          application/json:
            examples:
              createCaseRequest:
                $ref: '#/components/examples/Cases_create_case_request'
            schema:
              $ref: '#/components/schemas/Cases_create_case_request'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                createCaseResponse:
                  $ref: '#/components/examples/Cases_create_case_response'
              schema:
                $ref: '#/components/schemas/Cases_case_response_properties'
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Create a case
      tags:
      - cases
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/cases/_find:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/_find</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you''re seeking.

        '
      operationId: findCasesDefaultSpace
      parameters:
      - $ref: '#/components/parameters/Cases_assignees_filter'
      - $ref: '#/components/parameters/Cases_category'
      - $ref: '#/components/parameters/Cases_defaultSearchOperator'
      - $ref: '#/components/parameters/Cases_from'
      - $ref: '#/components/parameters/Cases_owner_filter'
      - $ref: '#/components/parameters/Cases_page_index'
      - $ref: '#/components/parameters/Cases_page_size'
      - $ref: '#/components/parameters/Cases_reporters'
      - $ref: '#/components/parameters/Cases_search'
      - $ref: '#/components/parameters/Cases_searchFields'
      - $ref: '#/components/parameters/Cases_severity'
      - $ref: '#/components/parameters/Cases_sortField'
      - $ref: '#/components/parameters/Cases_sort_order'
      - $ref: '#/components/parameters/Cases_status'
      - $ref: '#/components/parameters/Cases_tags'
      - $ref: '#/components/parameters/Cases_to'
      responses:
        '200':
          content:
            application/json:
              examples:
                findCaseResponse:
                  $ref: '#/components/examples/Cases_find_case_response'
              schema:
                type: object
                properties:
                  cases:
                    items:
                      $ref: '#/components/schemas/Cases_case_response_properties'
                    maxItems: 10000
                    type: array
                  count_closed_cases:
                    type: integer
                  count_in_progress_cases:
                    type: integer
                  count_open_cases:
                    type: integer
                  page:
                    type: integer
                  per_page:
                    type: integer
                  total:
                    type: integer
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Search cases
      tags:
      - cases
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/cases/{caseId}:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/{caseId}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Returns case details. The response does not include a comments property;  use the find case comments API to retrieve comments. The totalComment field  reflects the actual number of user comments on the case. You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you''re seeking.

        '
      operationId: getCaseDefaultSpace
      parameters:
      - $ref: '#/components/parameters/Cases_case_id'
      responses:
        '200':
          content:
            application/json:
              examples:
                getDefaultCaseResponse:
                  $ref: '#/components/examples/Cases_get_case_response'
                getDefaultObservabilityCaseResponse:
                  $ref: '#/components/examples/Cases_get_case_observability_response'
              schema:
                $ref: '#/components/schemas/Cases_case_response_get_case'
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Get case information
      tags:
      - cases
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/cases/{caseId}/alerts:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/{caseId}/alerts</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you''re seeking.

        '
      operationId: getCaseAlertsDefaultSpace
      parameters:
      - $ref: '#/components/parameters/Cases_case_id'
      responses:
        '200':
          content:
            application/json:
              examples:
                getCaseAlertsResponse:
                  $ref: '#/components/examples/Cases_get_case_alerts_response'
              schema:
                items:
                  $ref: '#/components/schemas/Cases_alert_response_properties'
                type: array
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Get all alerts for a case
      tags:
      - cases
      x-state: Technical preview
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/cases/{caseId}/comments:
    delete:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/{caseId}/comments</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Deletes all comments and alerts from a case. You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you''re deleting.

        '
      operationId: deleteCaseCommentsDefaultSpace
      parameters:
      - $ref: '#/components/parameters/Cases_kbn_xsrf'
      - $ref: '#/components/parameters/Cases_case_id'
      responses:
        '204':
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Delete all case comments and alerts
      tags:
      - cases
      x-codeSamples:
      - label: curl
        lang: curl
        source: "curl \\\n  --request DELETE 'https://localhost:5601/api/cases/9c235210-6834-11ea-a78c-6ffb38a34414/comments' \\\n  --header \"Authorization: $API_KEY\" \\\n  --header \"kbn-xsrf: true\"\n"
      - label: Console
        lang: console
        source: 'DELETE kbn:/api/cases/9c235210-6834-11ea-a78c-6ffb38a34414/comments

          '
      x-metaTags:
      - content: Kibana
        name: product_name
    patch:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb patch">patch</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/{caseId}/comments</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you''re updating. NOTE: You cannot change the comment type or the owner of a comment.

        '
      operationId: updateCaseCommentDefaultSpace
      parameters:
      - $ref: '#/components/parameters/Cases_kbn_xsrf'
      - $ref: '#/components/parameters/Cases_case_id'
      requestBody:
        content:
          application/json:
            examples:
              updateCaseCommentRequest:
                $ref: '#/components/examples/Cases_update_comment_request'
            schema:
              $ref: '#/components/schemas/Cases_update_case_comment_request'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                updateCaseCommentResponse:
                  $ref: '#/components/examples/Cases_update_comment_response'
              schema:
                $ref: '#/components/schemas/Cases_case_response_properties'
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Update a case comment or alert
      tags:
      - cases
      x-metaTags:
      - content: Kibana
        name: product_name
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/{caseId}/comments</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you''re creating. NOTE: Each case can have a maximum of 1,000 alerts.

        '
      operationId: addCaseCommentDefaultSpace
      parameters:
      - $ref: '#/components/parameters/Cases_kbn_xsrf'
      - $ref: '#/components/parameters/Cases_case_id'
      requestBody:
        content:
          application/json:
            examples:
              createCaseCommentRequest:
                $ref: '#/components/examples/Cases_add_comment_request'
            schema:
              $ref: '#/components/schemas/Cases_add_case_comment_request'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                createCaseCommentResponse:
                  $ref: '#/components/examples/Cases_add_comment_response'
              schema:
                $ref: '#/components/schemas/Cases_case_response_properties'
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Add a case comment or alert
      tags:
      - cases
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/cases/{caseId}/comments/_find:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/{caseId}/comments/_find</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Retrieves a paginated list of comments for a case. You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases with the comments you''re seeking.

        '
      operationId: findCaseCommentsDefaultSpace
      parameters:
      - $ref: '#/components/parameters/Cases_case_id'
      - $ref: '#/components/parameters/Cases_page_index'
      - $ref: '#/components/parameters/Cases_page_size'
      - $ref: '#/components/parameters/Cases_sort_order'
      responses:
        '200':
          content:
            application/json:
              examples:
                findCaseCommentsResponse:
                  $ref: '#/components/examples/Cases_find_case_comments_response'
              schema:
                $ref: '#/components/schemas/Cases_find_comments_response'
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Find case comments
      tags:
      - cases
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/cases/{caseId}/comments/{commentId}:
    delete:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/{caseId}/comments/{commentId}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you''re deleting.

        '
      operationId: deleteCaseCommentDefaultSpace
      parameters:
      - $ref: '#/components/parameters/Cases_kbn_xsrf'
      - $ref: '#/components/parameters/Cases_case_id'
      - $ref: '#/components/parameters/Cases_comment_id'
      responses:
        '204':
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Delete a case comment or alert
      tags:
      - cases
      x-codeSamples:
      - label: curl
        lang: curl
        source: "curl \\\n  --request DELETE 'https://localhost:5601/api/cases/9c235210-6834-11ea-a78c-6ffb38a34414/comments/71ec1870-725b-11ea-a0b2-c51ea50a58e2' \\\n  --header \"Authorization: $API_KEY\" \\\n  --header \"kbn-xsrf: true\"\n"
      - label: Console
        lang: console
        source: 'DELETE kbn:/api/cases/9c235210-6834-11ea-a78c-6ffb38a34414/comments/71ec1870-725b-11ea-a0b2-c51ea50a58e2

          '
      x-metaTags:
      - content: Kibana
        name: product_name
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/{caseId}/comments/{commentId}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases with the comments you''re seeking.

        '
      operationId: getCaseCommentDefaultSpace
      parameters:
      - $ref: '#/components/parameters/Cases_case_id'
      - $ref: '#/components/parameters/Cases_comment_id'
      responses:
        '200':
          content:
            application/json:
              examples:
                getCaseCommentResponse:
                  $ref: '#/components/examples/Cases_get_comment_response'
              schema:
                oneOf:
                - $ref: '#/components/schemas/Cases_alert_comment_response_properties'
                - $ref: '#/components/schemas/Cases_user_comment_response_properties'
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Get a case comment or alert
      tags:
      - cases
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/cases/{caseId}/connector/{connectorId}/_push:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/{caseId}/connector/{connectorId}/_push</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        You must have `all` privileges for the **Actions and Connectors** feature in the **Management** section of the Kibana feature privileges. You must also have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you''re pushing.

        '
      operationId: pushCaseDefaultSpace
      parameters:
      - $ref: '#/components/parameters/Cases_case_id'
      - $ref: '#/components/parameters/Cases_connector_id'
      - $ref: '#/components/parameters/Cases_kbn_xsrf'
      requestBody:
        content:
          application/json:
            examples:
              pushCaseRequest:
                summary: Push a case to an external service. No request body is required.
                value: null
            schema:
              nullable: true
              type: object
      responses:
        '200':
          content:
            application/json:
              examples:
                pushCaseResponse:
                  $ref: '#/components/examples/Cases_push_case_response'
              schema:
                $ref: '#/components/schemas/Cases_case_response_properties'
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Push a case to an external service
      tags:
      - cases
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/cases/{caseId}/files:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/{caseId}/files</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Attach a file to a case. You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you''re updating. The request must include:

        - The `Content-Type: multipart/form-data` HTTP header.

        - The location of the file that is being uploaded.

        '
      operationId: addCaseFileDefaultSpace
      parameters:
      - $ref: '#/components/parameters/Cases_kbn_xsrf'
      - $ref: '#/components/parameters/Cases_case_id'
      requestBody:
        content:
          multipart/form-data:
            examples:
              addCaseFileRequest:
                summary: Attach a plain text file named "my_attachment".
                value:
                  filename: my_attachment
            schema:
              $ref: '#/components/schemas/Cases_add_case_file_request'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                addCaseFileResponse:
                  $ref: '#/components/examples/Cases_add_comment_response'
              schema:
                $ref: '#/components/schemas/Cases_case_response_properties'
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Attach a file to a case
      tags:
      - cases
      x-codeSamples:
      - label: curl
        lang: curl
        source: "curl \\\n  --request POST 'https://localhost:5601/api/cases/9c235210-6834-11ea-a78c-6ffb38a34414/files' \\\n  --header \"Authorization: $API_KEY\" \\\n  --header \"kbn-xsrf: true\" \\\n  --form \"file=@/path/to/my_attachment.txt\" \\\n  --form \"filename=my_attachment\"\n"
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/cases/{caseId}/user_actions/_find:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/{caseId}/user_actions/_find</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Retrieves a paginated list of user activity for a case. You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you''re seeking.

        '
      operationId: findCaseActivityDefaultSpace
      parameters:
      - $ref: '#/components/parameters/Cases_case_id'
      - $ref: '#/components/parameters/Cases_page_index'
      - $ref: '#/components/parameters/Cases_page_size'
      - $ref: '#/components/parameters/Cases_sort_order'
      - $ref: '#/components/parameters/Cases_user_action_types'
      responses:
        '200':
          content:
            application/json:
              examples:
                findCaseActivityResponse:
                  $ref: '#/components/examples/Cases_find_case_activity_response'
              schema:
                type: object
                properties:
                  page:
                    type: integer
                  perPage:
                    type: integer
                  total:
                    type: integer
                  userActions:
                    items:
                      $ref: '#/components/schemas/Cases_user_actions_find_response_properties'
                    maxItems: 10000
                    type: array
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Find case activity
      tags:
      - cases
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/cases/alerts/{alertId}:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/alerts/{alertId}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you''re seeking.

        '
      operationId: getCasesByAlertDefaultSpace
      parameters:
      - $ref: '#/components/parameters/Cases_alert_id'
      - $ref: '#/components/parameters/Cases_owner_filter'
      responses:
        '200':
          content:
            application/json:
              examples:
                getCasesByAlertResponse:
                  summary: Cases associated with a given alert.
                  value:
                  - createdAt: '2020-02-19T23:06:33.798Z'
                    description: Investigating suspicious activity
                    id: 06116b80-e1c3-11ec-be9b-9b1838238ee6
                    status: open
                    title: security_case
                    totals:
                      alerts: 1
                      events: 0
                      userComments: 0
              schema:
                items:
                  $ref: '#/components/schemas/Cases_related_case'
                maxItems: 10000
                type: array
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Get cases for an alert
      tags:
      - cases
      x-state: Technical preview
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/cases/configure:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/configure</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get setting details such as the closure type, custom fields, templates, and the default connector for cases. You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on where the cases were created.

        '
      operationId: getCaseConfigurationDefaultSpace
      parameters:
      - $ref: '#/components/parameters/Cases_owner_filter'
      responses:
        '200':
          content:
            application/json:
              examples:
                getConfigurationResponse:
                  $ref: '#/components/examples/Cases_get_case_configuration_response'
              schema:
                items:
                  type: object
                  properties:
                    closure_type:
                      $ref: '#/components/schemas/Cases_closure_types'
                    connector:
                      type: object
                      properties:
                        fields:
                          description: The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to `null`.
                          nullable: true
                          type: object
                        id:
                          description: The identifier for the connector. If you do not want a default connector, use `none`. To retrieve connector IDs, use the find connectors API.
                          example: none
                          type: string
                        name:
                          description: The name of the connector. If you do not want a default connector, use `none`. To retrieve connector names, use the find connectors API.
                          example: none
                          type: string
                        type:
                          $ref: '#/components/schemas/Cases_connector_types'
                    created_at:
                      example: '2022-06-01T17:07:17.767Z'
                      format: date-time
                      type: string
                    created_by:
                      type: object
                      properties:
                        email:
                          example: null
                          nullable: true
                          type: string
                        full_name:
                          example: null
                          nullable: true
                          type: string
                        profile_uid:
                          example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
                          type: string
                        username:
                          example: elastic
                          nullable: true
                          type: string
                      required:
                      - email
                      - full_name
                      - username
                    customFields:
                      description: Custom fields configuration details.
                      items:
                        type: object
                        properties:
                          defaultValue:
                            description: 'A default value for the custom field. If the `type` is `text`, the default value must be a string. If the `type` is `toggle`, the default value must be boolean.

                              '
                            oneOf:
                            - type: string
                            - type: boolean
                          key:
                            description: 'A unique key for the custom field. Must be lower case and composed only of a-z, 0-9, ''_'', and ''-'' characters. It is used in API calls to refer to a specific custom field.

                              '
                            maxLength: 36
                            minLength: 1
                            type: string
                          label:
                            description: The custom field label that is displayed in the case.
                            maxLength: 50
                            minLength: 1
                            type: string
                          type:
                            description: The type of the custom field.
                            enum:
                            - text
                            - toggle
                            type: string
                          required:
                            description: 'Indicates whether the field is required. If `false`, the custom field can be set to null or omitted when a case is created or updated.

                              '
                            type: boolean
                      type: array
                    error:
                      example: null
                      nullable: true
                      type: string
                    id:
                      example: 4a97a440-e1cd-11ec-be9b-9b1838238ee6
                      type: string
                    mappings:
                      items:
                        type: object
                        properties:
                          action_type:
                            example: overwrite
                            type: string
                          source:
                            example: title
                            type: string
                          target:
                            example: summary
                            type: string
                      type: array
                    observableTypes:
                      description: Custom observable type configuration details.
                      items:
                        type: object
                        properties:
                          key:
                            description: The observable type key.
                            example: d312efda-ec2b-42ec-9e2c-84981795c581
                            type: string
                          label:
                            description: The observable type label.
                            example: My observable type
                            type: string
                      type: array
                    owner:
                      $ref: '#/components/schemas/Cases_owner'
                    templates:
                      $ref: '#/components/schemas/Cases_templates'
                    updated_at:
                      example: '2022-06-01T19:58:48.169Z'
                      format: date-time
                      nullable: true
                      type: string
                    updated_by:
                      nullable: true
                      type: object
                      properties:
                        email:
                          example: null
                          nullable: true
                          type: string
                        full_name:
                          example: null
                          nullable: true
                          type: string
                        profile_uid:
                          example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
                          type: string
                        username:
                          example: elastic
                          nullable: true
                          type: string
                      required:
                      - email
                      - full_name
                      - username
                    version:
                      example: WzIwNzMsMV0=
                      type: string
                type: array
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Get case settings
      tags:
      - cases
      x-metaTags:
      - content: Kibana
        name: product_name
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/configure</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Case settings include external connection details, custom fields, and templates. Connectors are used to interface with external systems. You must create a connector before you can use it in your cases. If you set a default connector, it is automatically selected when you create cases in Kibana. If you use the create case API, however, you must still specify all of the connector details. You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on where you are creating cases.

        '
      operationId: setCaseConfigurationDefaultSpace
      parameters:
      - $ref: '#/components/parameters/Cases_kbn_xsrf'
      requestBody:
        content:
          application/json:
            examples:
              setCaseConfigRequest:
                $ref: '#/components/examples/Cases_set_case_configuration_request'
            schema:
              $ref: '#/components/schemas/Cases_set_case_configuration_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                setCaseConfigResponse:
                  $ref: '#/components/examples/Cases_set_case_configuration_response'
              schema:
                type: object
                properties:
                  closure_type:
                    $ref: '#/components/schemas/Cases_closure_types'
                  connector:
                    type: object
                    properties:
                      fields:
                        description: The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to `null`.
                        nullable: true
                        type: object
                      id:
                        description: The identifier for the connector. If you do not want a default connector, use `none`. To retrieve connector IDs, use the find connectors API.
                        example: none
                        type: string
                      name:
                        description: The name of the connector. If you do not want a default connector, use `none`. To retrieve connector names, use the find connectors API.
                        example: none
                        type: string
                      type:
                        $ref: '#/components/schemas/Cases_connector_types'
                  created_at:
                    example: '2022-06-01T17:07:17.767Z'
                    format: date-time
                    type: string
                  created_by:
                    type: object
                    properties:
                      email:
                        example: null
                        nullable: true
                        type: string
                      full_name:
                        example: null
                        nullable: true
                        type: string
                      profile_uid:
                        example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
                        type: string
                      username:
                        example: elastic
                        nullable: true
                        type: string
                    required:
                    - email
                    - full_name
                    - username
                  customFields:
                    description: Custom fields configuration details.
                    items:
                      type: object
                      properties:
                        defaultValue:
                          description: 'A default value for the custom field. If the `type` is `text`, the default value must be a string. If the `type` is `toggle`, the default value must be boolean.

                            '
                          oneOf:
                          - type: string
                          - type: boolean
                        key:
                          description: 'A unique key for the custom field. Must be lower case and composed only of a-z, 0-9, ''_'', and ''-'' characters. It is used in API calls to refer to a specific custom field.

                            '
                          maxLength: 36
                          minLength: 1
                          type: string
                        label:
                          description: The custom field label that is displayed in the case.
                          maxLength: 50
                          minLength: 1
                          type: string
                        type:
                          description: The type of the custom field.
                          enum:
                          - text
                          - toggle
                          type: string
                        required:
                          description: 'Indicates whether the field is required. If `false`, the custom field can be set to null or omitted when a case is created or updated.

                            '
                          type: boolean
                    type: array
                  error:
                    example: null
                    nullable: true
                    type: string
                  id:
                    example: 4a97a440-e1cd-11ec-be9b-9b1838238ee6
                    type: string
                  mappings:
                    items:
                      type: object
                      properties:
                        action_type:
                          example: overwrite
                          type: string
                        source:
                          example: title
                          type: string
                        target:
                          example: summary
                          type: string
                    type: array
                  observableTypes:
                    description: Custom observable type configuration details.
                    items:
                      type: object
                      properties:
                        key:
                          description: The observable type key.
                          example: d312efda-ec2b-42ec-9e2c-84981795c581
                          type: string
                        label:
                          description: The observable type label.
                          example: My observable type
                          type: string
                    type: array
                  owner:
                    $ref: '#/components/schemas/Cases_owner'
                  templates:
                    $ref: '#/components/schemas/Cases_templates'
                  updated_at:
                    example: '2022-06-01T19:58:48.169Z'
                    format: date-time
                    nullable: true
                    type: string
                  updated_by:
                    nullable: true
                    type: object
                    properties:
                      email:
                        example: null
                        nullable: true
                        type: string
                      full_name:
                        example: null
                        nullable: true
                        type: string
                      profile_uid:
                        example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
                        type: string
                      username:
                        example: elastic
                        nullable: true
                        type: string
                    required:
                    - email
                    - full_name
                    - username
                  version:
                    example: WzIwNzMsMV0=
                    type: string
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Add case settings
      tags:
      - cases
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/cases/configure/{configurationId}:
    patch:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb patch">patch</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/configure/{configurationId}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Updates setting details such as the closure type, custom fields, templates, and the default connector for cases. Connectors are used to interface with external systems. You must create a connector before you can use it in your cases. You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on where the case was created.

        '
      operationId: updateCaseConfigurationDefaultSpace
      parameters:
      - $ref: '#/components/parameters/Cases_kbn_xsrf'
      - $ref: '#/components/parameters/Cases_configuration_id'
      requestBody:
        content:
          application/json:
            examples:
              updateCaseConfigurationRequest:
                $ref: '#/components/examples/Cases_update_case_configuration_request'
            schema:
              $ref: '#/components/schemas/Cases_update_case_configuration_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                updateCaseConfigurationResponse:
                  $ref: '#/components/examples/Cases_update_case_configuration_response'
              schema:
                type: object
                properties:
                  closure_type:
                    $ref: '#/components/schemas/Cases_closure_types'
                  connector:
                    type: object
                    properties:
                      fields:
                        description: The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to `null`.
                        nullable: true
                        type: object
                      id:
                        description: The identifier for the connector. If you do not want a default connector, use `none`. To retrieve connector IDs, use the find connectors API.
                        example: none
                        type: string
                      name:
                        description: The name of the connector. If you do not want a default connector, use `none`. To retrieve connector names, use the find connectors API.
                        example: none
                        type: string
                      type:
                        $ref: '#/components/schemas/Cases_connector_types'
                  created_at:
                    example: '2022-06-01T17:07:17.767Z'
                    format: date-time
                    type: string
                  created_by:
                    type: object
                    properties:
                      email:
                        example: null
                        nullable: true
                        type: string
                      full_name:
                        example: null
                        nullable: true
                        type: string
                      profile_uid:
                        example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
                        type: string
                      username:
                        example: elastic
                        nullable: true
                        type: string
                    required:
                    - email
                    - full_name
                    - username
                  customFields:
                    description: Custom fields configuration details.
                    items:
                      type: object
                      properties:
                        defaultValue:
                          description: 'A default value for the custom field. If the `type` is `text`, the default value must be a string. If the `type` is `toggle`, the default value must be boolean.

                            '
                          oneOf:
                          - type: string
                          - type: boolean
                        key:
                          description: 'A unique key for the custom field. Must be lower case and composed only of a-z, 0-9, ''_'', and ''-'' characters. It is used in API calls to refer to a specific custom field.

                            '
                          maxLength: 36
                          minLength: 1
                          type: string
                        label:
                          description: The custom field label that is displayed in the case.
                          maxLength: 50
                          minLength: 1
                          type: string
                        type:
                          description: The type of the custom field.
                          enum:
                          - text
                          - toggle
                          type: string
                        required:
                          description: 'Indicates whether the field is required. If `false`, the custom field can be set to null or omitted when a case is created or updated.

                            '
                          type: boolean
                    type: array
                  error:
                    example: null
                    nullable: true
                    type: string
                  id:
                    example: 4a97a440-e1cd-11ec-be9b-9b1838238ee6
                    type: string
                  mappings:
                    items:
                      type: object
                      properties:
                        action_type:
                          example: overwrite
                          type: string
                        source:
                          example: title
                          type: string
                        target:
                          example: summary
                          type: string
                    type: array
                  observableTypes:
                    description: Custom observable type configuration details.
                    items:
                      type: object
                      properties:
                        key:
                          description: The observable type key.
                          example: d312efda-ec2b-42ec-9e2c-84981795c581
                          type: string
                        label:
                          description: The observable type label.
                          example: My observable type
                          type: string
                    type: array
                  owner:
                    $ref: '#/components/schemas/Cases_owner'
                  templates:
                    $ref: '#/components/schemas/Cases_templates'
                  updated_at:
                    example: '2022-06-01T19:58:48.169Z'
                    format: date-time
                    nullable: true
                    type: string
                  updated_by:
                    nullable: true
                    type: object
                    properties:
                      email:
                        example: null
                        nullable: true
                        type: string
                      full_name:
                        example: null
                        nullable: true
                        type: string
                      profile_uid:
                        example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
                        type: string
                      username:
                        example: elastic
                        nullable: true
                        type: string
                    required:
                    - email
                    - full_name
                    - username
                  version:
                    example: WzIwNzMsMV0=
                    type: string
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Update case settings
      tags:
      - cases
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/cases/configure/connectors/_find:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/configure/connectors/_find</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get information about connectors that are supported for use in cases. You must have `read` privileges for the **Actions and Connectors** feature in the **Management** section of the Kibana feature privileges.

        '
      operationId: findCaseConnectorsDefaultSpace
      responses:
        '200':
          content:
            application/json:
              examples:
                findConnectorResponse:
                  $ref: '#/components/examples/Cases_find_connector_response'
              schema:
                items:
                  type: object
                  properties:
                    actionTypeId:
                      $ref: '#/components/schemas/Cases_connector_types'
                    config:
                      additionalProperties: true
                      type: object
                      properties:
                        apiUrl:
                          type: string
                        projectKey:
                          type: string
                    id:
                      type: string
                    isDeprecated:
                      type: boolean
                    isMissingSecrets:
                      type: boolean
                    isPreconfigured:
                      type: boolean
                    name:
                      type: string
                    referencedByCount:
                      type: integer
                maxItems: 1000
                type: array
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Get case connectors
      tags:
      - cases
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/cases/reporters:
    get:
      description: 'Returns information about the users who opened cases. You must have read privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases. The API returns information about the users as they existed at the time of the case creation, including their name, full name, and email address. If any of those details change thereafter or if a user is deleted, the information returned by this API is unchanged.

        '
      operationId: getCaseReportersDefaultSpace
      parameters:
      - $ref: '#/components/parameters/Cases_owner_filter'
      responses:
        '200':
          content:
            application/json:
              examples:
                getReportersResponse:
                  $ref: '#/components/examples/Cases_get_reporters_response'
              schema:
                items:
                  type: object
                  properties:
                    email:
                      example: null
                      nullable: true
                      type: string
                    full_name:
                      example: null
                      nullable: true
                      type: string
                    profile_uid:
                      example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
                      type: string
                    username:
                      example: elastic
                      nullable: true
                      type: string
                  required:
                  - email
                  - full_name
                  - username
                maxItems: 10000
                type: array
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Get case creators
      tags:
      - cases
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/cases/tags:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/tags</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Aggregates and returns a list of case tags. You must have read privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you''re seeking.

        '
      operationId: getCaseTagsDefaultSpace
      parameters:
      - $ref: '#/components/parameters/Cases_owner_filter'
      responses:
        '200':
          content:
            application/json:
              examples:
                getTagsResponse:
                  $ref: '#/components/examples/Cases_get_tags_response'
              schema:
                items:
                  type: string
                maxItems: 10000
                type: array
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Get case tags
      tags:
      - cases
      x-metaTags:
      - content: Kibana
        name: product_name
components:
  schemas:
    Cases_assignees:
      description: An array containing users that are assigned to the case.
      items:
        type: object
        properties:
          uid:
            description: A unique identifier for the user profile. These identifiers can be found by using the suggest user profile API.
            example: u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0
            type: string
        required:
        - uid
      maxItems: 10
      nullable: true
      type: array
    Cases_alert_response_properties:
      type: object
      properties:
        attached_at:
          format: date-time
          type: string
        id:
          description: The alert identifier.
          type: string
        index:
          description: The alert index.
          type: string
    Cases_connector_properties_servicenow:
      description: Defines properties for connectors when type is `.servicenow`.
      type: object
      properties:
        fields:
          description: An object containing the connector fields. If you want to omit any individual field, specify null as its value.
          type: object
          properties:
            category:
              description: The category of the incident.
              nullable: true
              type: string
            impact:
              description: The effect an incident had on business.
              nullable: true
              type: string
            severity:
              description: The severity of the incident.
              nullable: true
              type: string
            subcategory:
              description: The subcategory of the incident.
              nullable: true
              type: string
            urgency:
              description: The extent to which the incident resolution can be delayed.
              nullable: true
              type: string
          required:
          - category
          - impact
          - severity
          - subcategory
          - urgency
        id:
          description: The identifier for the connector. To retrieve connector IDs, use the find connectors API.
          type: string
        name:
          description: The name of the connector.
          type: string
        type:
          description: The type of connector.
          enum:
          - .servicenow
          example: .servicenow
          type: string
      required:
      - fields
      - id
      - name
      - type
      title: Create case request properties for a ServiceNow ITSM connector
    Cases_case_response_properties:
      title: Case response properties
      type: object
      properties:
        assignees:
          $ref: '#/components/schemas/Cases_assignees'
        category:
          description: The case category.
          nullable: true
          type: string
        closed_at:
          format: date-time
          nullable: true
          type: string
        closed_by:
          $ref: '#/components/schemas/Cases_case_response_closed_by_properties'
        comments:
          description: An array of comment objects for the case.
          items:
            discriminator:
              mapping:
                alert: '#/components/schemas/Cases_alert_comment_response_properties'
                event: '#/components/schemas/Cases_event_comment_response_properties'
                user: '#/components/schemas/Cases_user_comment_response_properties'
              propertyName: type
            oneOf:
            - $ref: '#/components/schemas/Cases_alert_comment_response_properties'
            - $ref: '#/components/schemas/Cases_event_comment_response_properties'
            - $ref: '#/components/schemas/Cases_user_comment_response_properties'
          maxItems: 10000
          title: Case response properties for comments
          type: array
        connector:
          discriminator:
            mapping:
              .cases-webhook: '#/components/schemas/Cases_connector_properties_cases_webhook'
              .jira: '#/components/schemas/Cases_connector_properties_jira'
              .none: '#/components/schemas/Cases_connector_properties_none'
              .resilient: '#/components/schemas/Cases_connector_properties_resilient'
              .servicenow: '#/components/schemas/Cases_connector_properties_servicenow'
              .servicenow-sir: '#/components/schemas/Cases_connector_properties_servicenow_sir'
              .swimlane: '#/components/schemas/Cases_connector_properties_swimlane'
            propertyName: type
          oneOf:
          - $ref: '#/components/schemas/Cases_connector_properties_none'
          - $ref: '#/components/schemas/Cases_connector_properties_cases_webhook'
          - $ref: '#/components/schemas/Cases_connector_properties_jira'
          - $ref: '#/components/schemas/Cases_connector_properties_resilient'
          - $ref: '#/components/schemas/Cases_connector_properties_servicenow'
          - $ref: '#/components/schemas/Cases_connector_properties_servicenow_sir'
          - $ref: '#/components/schemas/Cases_connector_properties_swimlane'
          title: Case response properties for connectors
        created_at:
          example: '2022-05-13T09:16:17.416Z'
          format: date-time
          type: string
        created_by:
          $ref: '#/components/schemas/Cases_case_response_created_by_properties'
        customFields:
          description: Custom field values for the case.
          items:
            type: object
            properties:
              key:
                description: 'The unique identifier for the custom field. The key value must exist in the case configuration settings.

                  '
                type: string
              type:
                description: 'The custom field type. It must match the type specified in the case configuration settings.

                  '
                enum:
                - text
                - toggle
                type: string
              value:
                description: 'The custom field value. If the custom field is required, it cannot be explicitly set to null. However, for cases that existed when the required custom field was added, the default value stored in Elasticsearch is `undefined`. The value returned in the API and user interface in this case is `null`.

                  '
                oneOf:
                - maxLength: 160
                  minLength: 1
                  nullable: true
                  type: string
                - type: boolean
          type: array
        description:
          example: A case description.
          type: string
        duration:
          description: 'The elapsed time from the creation of the case to its closure (in seconds). If the case has not been closed, the duration is set to null. If the case was closed after less than half a second, the duration is rounded down to zero.

            '
          example: 120
          nullable: true
          type: integer
        external_service:
          $ref: '#/components/schemas/Cases_external_service'
        id:
          example: 66b9aa00-94fa-11ea-9f74-e7e108796192
          type: string
        incremental_id:
          description: 'A monotonically increasing number assigned to each case, unique per space. This value is generated asynchronously after the case is created and may not be present immediately in the response.

            '
          example: 1
          nullable: true
          type: integer
        observables:
          description: Observables attached to the case.
          items:
            $ref: '#/components/schemas/Cases_case_observable'
          type: array
        owner:
          $ref: '#/components/schemas/Cases_owner'
        settings:
          $ref: '#/components/schemas/Cases_settings'
        severity:
          $ref: '#/components/schemas/Cases_case_severity'
        status:
          $ref: '#/components/schemas/Cases_case_status'
        tags:
          example:
          - tag-1
          items:
            type: string
          type: array
        title:
          example: Case title 1
          type: string
        total_observables:
          description: The number of observables attached to the case.
          example: 0
          nullable: true
          type: integer
        totalAlerts:
          example: 0
          type: integer
        totalComment:
          example: 0
          type: integer
        totalEvents:
          description: The number of events attached to the case.
          example: 0
          type: integer
        updated_at:
          format: date-time
          nullable: true
          type: string
        updated_by:
          $ref: '#/components/schemas/Cases_case_response_updated_by_properties'
        version:
          example: WzUzMiwxXQ==
          type: string
      required:
      - closed_at
      - closed_by
      - comments
      - connector
      - created_at
      - created_by
      - description
      - duration
      - external_service
      - id
      - observables
      - owner
      - settings
      - severity
      - status
      - tags
      - title
      - totalAlerts
      - totalComment
      - total_observables
      - updated_at
      - updated_by
      - version
    Cases_owner:
      description: 'The application that owns the cases: Stack Management, Observability, or Elastic Security.

        '
      enum:
      - cases
      - observability
      - securitySolution
      example: cases
      type: string
    Cases_searchFieldsType:
      description: The fields to perform the `simple_query_string` parsed query against.
      enum:
      - description
      - title
      type: string
    Cases_update_case_comment_request:
      description: The update case comment API request body varies depending on whether you are updating an alert or a comment.
      discriminator:
        mapping:
          alert: '#/components/schemas/Cases_update_alert_comment_request_properties'
          user: '#/components/schemas/Cases_update_user_comment_request_properties'
        propertyName: type
      oneOf:
      - $ref: '#/components/schemas/Cases_update_alert_comment_request_properties'
      - $ref: '#/components/schemas/Cases_update_user_comment_request_properties'
      title: Update case comment request
    Cases_connector_properties_resilient:
      description: Defines properties for connectors when type is `.resilient`.
      type: object
      properties:
        fields:
          description: An object containing the connector fields. If you want to omit any individual field, specify null as its value.
          nullable: true
          type: object
          properties:
            issueTypes:
              description: The type of incident.
              items:
                type: string
              type: array
            severityCode:
              description: The severity code of the incident.
              type: string
          required:
          - issueTypes
          - severityCode
        id:
          description: The identifier for the connector.
          type: string
        name:
          description: The name of the connector.
          type: string
        type:
          description: The type of connector.
          enum:
          - .resilient
          example: .resilient
          type: string
      required:
      - fields
      - id
      - name
      - type
      title: Create case request properties for a IBM Resilient connector
    Cases_connector_properties_none:
      description: Defines properties for connectors when type is `.none`.
      type: object
      properties:
        fields:
          description: An object containing the connector fields. To create a case without a connector, specify null. To update a case to remove the connector, specify null.
          example: null
          nullable: true
          type: string
        id:
          description: The identifier for the connector. To create a case without a connector, use `none`. To update a case to remove the connector, specify `none`.
          example: none
          type: string
        name:
          description: The name of the connector. To create a case without a connector, use `none`. To update a case to remove the connector, specify `none`.
          example: none
          type: string
        type:
          description: The type of connector. To create a case without a connector, use `.none`. To update a case to remove the connector, specify `.none`.
          enum:
          - .none
          example: .none
          type: string
      required:
      - fields
      - id
      - name
      - type
      title: Create or update case request properties for no connector
    Cases_case_tags:
      description: 'The words and phrases that help categorize cases. It can be an empty array.

        '
      items:
        maxLength: 256
        type: string
      maxItems: 200
      type: array
    Cases_alert_indices:
      description: 'The alert indices. It is required only when `type` is `alert`. If you are adding multiple alerts to a case, use an array of strings; the position of each index name in the array must match the position of the corresponding alert identifier in the `alertId` array.  This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.

        '
      oneOf:
      - type: string
      - items:
          type: string
        maxItems: 1000
        type: array
      title: Alert indices
      x-state: Technical preview
    Cases_response_4xx:
      properties:
        error:
          example: Unauthorized
          type: string
        message:
          type: string
        statusCode:
          example: 401
          type: integer
      title: Unsuccessful cases API response
      type: object
    Cases_user_comment_response_properties:
      title: Case response properties for user comments
      type: object
      properties:
        comment:
          example: A new comment.
          type: string
        created_at:
          example: '2022-05-13T09:16:17.416Z'
          format: date-time
          type: string
        created_by:
          $ref: '#/components/schemas/Cases_case_response_created_by_properties'
        id:
          example: 8af6ac20-74f6-11ea-b83a-553aecdb28b6
          type: string
        owner:
          $ref: '#/components/schemas/Cases_owner'
        pushed_at:
          example: null
          format: date-time
          nullable: true
          type: string
        pushed_by:
          $ref: '#/components/schemas/Cases_case_response_pushed_by_properties'
        type:
          enum:
          - user
          example: user
          type: string
        updated_at:
          example: null
          format: date-time
          nullable: true
          type: string
        updated_by:
          $ref: '#/components/schemas/Cases_case_response_updated_by_properties'
        version:
          example: WzIwNDMxLDFd
          type: string
      required:
      - type
    Cases_case_response_created_by_properties:
      title: Case response properties for created_by
      type: object
      properties:
        email:
          example: null
          nullable: true
          type: string
        full_name:
          example: null
          nullable: true
          type: string
        profile_uid:
          example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
          type: string
        username:
          example: elastic
          nullable: true
          type: string
      required:
      - email
      - full_name
      - username
    Cases_payload_connector:
      type: object
      properties:
        connector:
          type: object
          properties:
            fields:
              description: An object containing the connector fields. To create a case without a connector, specify null. If you want to omit any individual field, specify null as its value.
              example: null
              nullable: true
              type: object
              properties:
                caseId:
                  description: The case identifier for Swimlane connectors.
                  type: string
                category:
                  description: The category of the incident for ServiceNow ITSM and ServiceNow SecOps connectors.
                  type: string
                destIp:
                  description: Indicates whether cases will send a comma-separated list of destination IPs for ServiceNow SecOps connectors.
                  nullable: true
                  type: boolean
                impact:
                  description: The effect an incident had on business for ServiceNow ITSM connectors.
                  type: string
                issueType:
                  description: The type of issue for Jira connectors.
                  type: string
                issueTypes:
                  description: The type of incident for IBM Resilient connectors.
                  items:
                    type: string
                  type: array
                malwareHash:
                  description: Indicates whether cases will send a comma-separated list of malware hashes for ServiceNow SecOps connectors.
                  nullable: true
                  type: boolean
                malwareUrl:
                  description: Indicates whether cases will send a comma-separated list of malware URLs for ServiceNow SecOps connectors.
                  nullable: true
                  type: boolean
                parent:
                  description: The key of the parent issue, when the issue type is sub-task for Jira connectors.
                  type: string
                priority:
                  description: The priority of the issue for Jira and ServiceNow SecOps connectors.
                  type: string
                severity:
                  description: The severity of the incident for ServiceNow ITSM connectors.
                  type: string
                severityCode:
                  description: The severity code of the incident for IBM Resilient connectors.
                  type: string
                sourceIp:
                  description: Indicates whether cases will send a comma-separated list of source IPs for ServiceNow SecOps connectors.
                  nullable: true
                  type: boolean
                subcategory:
                  description: The subcategory of the incident for ServiceNow ITSM connectors.
                  type: string
                urgency:
                  description: The extent to which the incident resolution can be delayed for ServiceNow ITSM connectors.
                  type: string
            id:
              description: The identifier for the connector. To create a case without a connector, use `none`.
              example: none
              type: string
            name:
              description: The name of the connector. To create a case without a connector, use `none`.
              example: none
              type: string
            type:
              $ref: '#/components/schemas/Cases_connector_types'
    Cases_payload_description:
      type: object
      properties:
        description:
          type: string
    Cases_payload_title:
      type: object
      properties:
        title:
          type: string
    Cases_case_severity:
      description: The severity of the case.
      enum:
      - critical
      - high
      - low
      - medium
      type: string
    Cases_payload_user_comment:
      type: object
      properties:
        comment:
          type: object
          properties:
            comment:
              type: string
            owner:
              $ref: '#/components/schemas/Cases_owner'
            type:
              enum:
              - user
              type: string
    Cases_payload_pushed:
      type: object
      properties:
        externalService:
          $ref: '#/components/schemas/Cases_external_service'
    Cases_case_category:
      description: A word or phrase that categorizes the case.
      maxLength: 50
      type: string
    Cases_case_response_closed_by_properties:
      nullable: true
      properties:
        email:
          example: null
          nullable: true
          type: string
        full_name:
          example: null
          nullable: true
          type: string
        profile_uid:
          example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
          type: string
        username:
          example: elastic
          nullable: true
          type: string
      required:
      - email
      - full_name
      - username
      title: Case response properties for closed_by
      type: object
    Cases_attachment_totals:
      description: Counts of alerts, events, and user comments attached to a case.
      properties:
        alerts:
          description: Number of alert attachments on the case.
          type: integer
        events:
          description: Number of event attachments on the case.
          type: integer
        userComments:
          description: Number of user comment attachments on the case.
          type: integer
      required:
      - alerts
      - events
      - userComments
      title: Attachment totals
      type: object
    Cases_settings:
      description: An object that contains the case settings.
      type: object
      properties:
        extractObservables:
          description: 'When true, observables (e.g. IPs, hashes, URLs) are automatically extracted from case comments. Optional; defaults to false when omitted.

            '
          example: false
          type: boolean
        syncAlerts:
          description: Turns alert syncing on or off.
          example: true
          type: boolean
      required:
      - syncAlerts
    Cases_find_comments_response:
      title: Find case comments response
      type: object
      properties:
        comments:
          description: Paginated list of user comments for the case.
          items:
            $ref: '#/components/schemas/Cases_user_comment_response_properties'
          type: array
        page:
          description: The current page index.
          type: integer
        per_page:
          description: The number of items per page.
          type: integer
        total:
          description: The total number of comments.
          type: integer
      required:
      - comments
      - page
      - per_page
      - total
    Cases_payload_settings:
      type: object
      properties:
        settings:
          $ref: '#/components/schemas/Cases_settings'
    Cases_template_tags:
      description: 'The words and phrases that help categorize templates. It can be an empty array.

        '
      items:
        maxLength: 256
        type: string
      maxItems: 200
      type: array
    Cases_set_case_configuration_request:
      description: External connection details, such as the closure type and default connector for cases.
      properties:
        closure_type:
          $ref: '#/components/schemas/Cases_closure_types'
        connector:
          description: An object that contains the connector configuration.
          type: object
          properties:
            fields:
              description: The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to `null`.
              nullable: true
              type: object
            id:
              description: The identifier for the connector. If you do not want a default connector, use `none`. To retrieve connector IDs, use the find connectors API.
              example: none
              type: string
            name:
              description: The name of the connector. If you do not want a default connector, use `none`. To retrieve connector names, use the find connectors API.
              example: none
              type: string
            type:
              $ref: '#/components/schemas/Cases_connector_types'
          required:
          - fields
          - id
          - name
          - type
        customFields:
          description: Custom fields case configuration.
          items:
            type: object
            properties:
              defaultValue:
                description: 'A default value for the custom field. If the `type` is `text`, the default value must be a string. If the `type` is `toggle`, the default value must be boolean.

                  '
                oneOf:
                - type: string
                - type: boolean
              key:
                description: 'A unique key for the custom field. Must be lower case and composed only of a-z, 0-9, ''_'', and ''-'' characters. It is used in API calls to refer to a specific custom field.

                  '
                maxLength: 36
                minLength: 1
                type: string
              label:
                description: The custom field label that is displayed in the case.
                maxLength: 50
                minLength: 1
                type: string
              type:
                description: The type of the custom field.
                enum:
                - text
                - toggle
                type: string
              required:
                description: 'Indicates whether the field is required. If `false`, the custom field can be set to null or omitted when a case is created or updated.

                  '
                type: boolean
            required:
            - key
            - label
            - required
            - type
          maxItems: 10
          minItems: 0
          type: array
        owner:
          $ref: '#/components/schemas/Cases_owner'
        templates:
          $ref: '#/components/schemas/Cases_templates'
      required:
      - closure_type
      - connector
      - owner
      title: Set case configuration request
      type: object
    Cases_create_case_request:
      description: The create case API request body varies depending on the type of connector.
      properties:
        assignees:
          $ref: '#/components/schemas/Cases_assignees'
        category:
          $ref: '#/components/schemas/Cases_case_category'
        connector:
          oneOf:
          - $ref: '#/components/schemas/Cases_connector_properties_none'
          - $ref: '#/components/schemas/Cases_connector_properties_cases_webhook'
          - $ref: '#/components/schemas/Cases_connector_properties_jira'
          - $ref: '#/components/schemas/Cases_connector_properties_resilient'
          - $ref: '#/components/schemas/Cases_connector_properties_servicenow'
          - $ref: '#/components/schemas/Cases_connector_properties_servicenow_sir'
          - $ref: '#/components/schemas/Cases_connector_properties_swimlane'
        customFields:
          description: 'Custom field values for a case. Any optional custom fields that are not specified in the request are set to null.

            '
          items:
            type: object
            properties:
              key:
                description: 'The unique identifier for the custom field. The key value must exist in the case configuration settings.

                  '
                type: string
              type:
                description: 'The custom field type. It must match the type specified in the case configuration settings.

                  '
                enum:
                - text
                - toggle
                type: string
              value:
                description: 'The custom field value. If the custom field is required, it cannot be explicitly set to null. However, for cases that existed when the required custom field was added, the default value stored in Elasticsearch is `undefined`. The value returned in the API and user interface in this case is `null`.

                  '
                oneOf:
                - maxLength: 160
                  minLength: 1
                  nullable: true
                  type: string
                - type: boolean
            required:
            - key
            - type
            - value
          maxItems: 10
          minItems: 0
          type: array
        description:
          $ref: '#/components/schemas/Cases_case_description'
        owner:
          $ref: '#/components/schemas/Cases_owner'
        settings:
          $ref: '#/components/schemas/Cases_settings'
        severity:
          $ref: '#/components/schemas/Cases_case_severity'
        tags:
          $ref: '#/components/schemas/Cases_case_tags'
        title:
          $ref: '#/components/schemas/Cases_case_title'
      required:
      - connector
      - description
      - owner
      - settings
      - tags
      - title
      title: Create case request
      type: object
    Cases_update_case_request:
      description: The update case API request body varies depending on the type of connector.
      properties:
        cases:
          description: An array containing one or more case objects.
          items:
            type: object
            properties:
              assignees:
                $ref: '#/components/schemas/Cases_assignees'
              category:
                $ref: '#/components/schemas/Cases_case_category'
              closeReason:
                $ref: '#/components/schemas/Cases_case_close_sync_reason'
              connector:
                oneOf:
                - $ref: '#/components/schemas/Cases_connector_properties_none'
                - $ref: '#/components/schemas/Cases_connector_properties_cases_webhook'
                - $ref: '#/components/schemas/Cases_connector_properties_jira'
                - $ref: '#/components/schemas/Cases_connector_properties_resilient'
                - $ref: '#/components/schemas/Cases_connector_properties_servicenow'
                - $ref: '#/components/schemas/Cases_connector_properties_servicenow_sir'
                - $ref: '#/components/schemas/Cases_connector_properties_swimlane'
              customFields:
                description: 'Custom field values for a case. Any optional custom fields that are not specified in the request are set to null.

                  '
                items:
                  type: object
                  properties:
                    key:
                      description: 'The unique identifier for the custom field. The key value must exist in the case configuration settings.

                        '
                      type: string
                    type:
                      description: 'The custom field type. It must match the type specified in the case configuration settings.

                        '
                      enum:
                      - text
                      - toggle
                      type: string
                    value:
                      description: 'The custom field value. If the custom field is required, it cannot be explicitly set to null. However, for cases that existed when the required custom field was added, the default value stored in Elasticsearch is `undefined`. The value returned in the API and user interface in this case is `null`.

                        '
                      oneOf:
                      - maxLength: 160
                        minLength: 1
                        nullable: true
                        type: string
                      - type: boolean
                  required:
                  - key
                  - type
                  - value
                maxItems: 10
                minItems: 0
                type: array
              description:
                $ref: '#/components/schemas/Cases_case_description'
              id:
                description: The identifier for the case.
                maxLength: 30000
                type: string
              settings:
                $ref: '#/components/schemas/Cases_settings'
              severity:
                $ref: '#/components/schemas/Cases_case_severity'
              status:
                $ref: '#/components/schemas/Cases_case_status'
              tags:
                $ref: '#/components/schemas/Cases_case_tags'
              title:
                $ref: '#/components/schemas/Cases_case_title'
              version:
                description: 'The current version of the case. To determine this value, use the get case or search cases (`_find`) APIs.

                  '
                type: string
            required:
            - id
            - version
          maxItems: 100
          minItems: 1
          type: array
      required:
      - cases
      title: Update case request
      type: object
    Cases_update_alert_comment_request_properties:
      description: Defines properties for case comment requests when type is alert.
      type: object
      properties:
        alertId:
          $ref: '#/components/schemas/Cases_alert_identifiers'
        id:
          description: 'The identifier for the comment. To retrieve comment IDs, use the get comments API.

            '
          example: 8af6ac20-74f6-11ea-b83a-553aecdb28b6
          type: string
        index:
          $ref: '#/components/schemas/Cases_alert_indices'
        owner:
          $ref: '#/components/schemas/Cases_owner'
        rule:
          $ref: '#/components/schemas/Cases_rule'
        type:
          description: The type of comment.
          enum:
          - alert
          example: alert
          type: string
        version:
          description: 'The current comment version. To retrieve version values, use the get comments API.

            '
          example: Wzk1LDFd
          type: string
      required:
      - alertId
      - id
      - index
      - owner
      - rule
      - type
      - version
      title: Update case comment request properties for alerts
    Cases_connector_properties_cases_webhook:
      description: Defines properties for connectors when type is `.cases-webhook`.
      type: object
      properties:
        fields:
          example: null
          nullable: true
          type: string
        id:
          description: The identifier for the connector. To retrieve connector IDs, use the find connectors API.
          type: string
        name:
          description: The name of the connector.
          type: string
        type:
          description: The type of connector.
          enum:
          - .cases-webhook
          example: .cases-webhook
          type: string
      required:
      - fields
      - id
      - name
      - type
      title: Create or upate case request properties for Cases Webhook connector
    Cases_alert_comment_response_properties:
      title: Add case comment response properties for alerts
      type: object
      properties:
        alertId:
          items:
            example: a6e12ac4-7bce-457b-84f6-d7ce8deb8446
            type: string
          type: array
        created_at:
          example: '2023-11-06T19:29:38.424Z'
          format: date-time
          type: string
        created_by:
          type: object
          properties:
            email:
              example: null
              nullable: true
              type: string
            full_name:
              example: null
              nullable: true
              type: string
            profile_uid:
              example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
              type: string
            username:
              example: elastic
              nullable: true
              type: string
          required:
          - email
          - full_name
          - username
        id:
          example: 73362370-ab1a-11ec-985f-97e55adae8b9
          type: string
        index:
          items:
            example: .internal.alerts-security.alerts-default-000001
            type: string
          type: array
        owner:
          $ref: '#/components/schemas/Cases_owner'
        pushed_at:
          example: null
          format: date-time
          nullable: true
          type: string
        pushed_by:
          nullable: true
          type: object
          properties:
            email:
              example: null
              nullable: true
              type: string
            full_name:
              example: null
              nullable: true
              type: string
            profile_uid:
              example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
              type: string
            username:
              example: elastic
              nullable: true
              type: string
          required:
          - email
          - full_name
          - username
        rule:
          type: object
          properties:
            id:
              description: The rule identifier.
              example: 94d80550-aaf4-11ec-985f-97e55adae8b9
              nullable: true
              type: string
            name:
              description: The rule name.
              example: security_rule
              nullable: true
              type: string
        type:
          enum:
          - alert
          example: alert
          type: string
        updated_at:
          format: date-time
          nullable: true
          type: string
        updated_by:
          nullable: true
          type: object
          properties:
            email:
              example: null
              nullable: true
              type: string
            full_name:
              example: null
              nullable: true
              type: string
            profile_uid:
              example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
              type: string
            username:
              example: elastic
              nullable: true
              type: string
          required:
          - email
          - full_name
          - username
        version:
          example: WzMwNDgsMV0=
          type: string
      required:
      - type
    Cases_user_actions_find_response_properties:
      type: object
      properties:
        action:
          $ref: '#/components/schemas/Cases_actions'
        comment_id:
          example: 578608d0-03b1-11ed-920c-974bfa104448
          nullable: true
          type: string
        created_at:
          example: '2022-05-13T09:16:17.416Z'
          format: date-time
          type: string
        created_by:
          type: object
          properties:
            email:
              example: null
              nullable: true
              type: string
            full_name:
              example: null
              nullable: true
              type: string
            profile_uid:
              example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
              type: string
            username:
              example: elastic
              nullable: true
              type: string
          required:
          - email
          - full_name
          - username
        id:
          example: 22fd3e30-03b1-11ed-920c-974bfa104448
          type: string
        owner:
          $ref: '#/components/schemas/Cases_owner'
        payload:
          oneOf:
          - $ref: '#/components/schemas/Cases_payload_alert_comment'
          - $ref: '#/components/schemas/Cases_payload_assignees'
          - $ref: '#/components/schemas/Cases_payload_connector'
          - $ref: '#/components/schemas/Cases_payload_create_case'
          - $ref: '#/components/schemas/Cases_payload_delete'
          - $ref: '#/components/schemas/Cases_payload_description'
          - $ref: '#/components/schemas/Cases_payload_pushed'
          - $ref: '#/components/schemas/Cases_payload_settings'
          - $ref: '#/components/schemas/Cases_payload_severity'
          - $ref: '#/components/schemas/Cases_payload_status'
          - $ref: '#/components/schemas/Cases_payload_tags'
          - $ref: '#/components/schemas/Cases_payload_title'
          - $ref: '#/components/schemas/Cases_payload_user_comment'
        type:
          description: The type of action.
          enum:
          - assignees
          - category
          - comment
          - connector
          - create_case
          - customFields
          - delete_case
          - description
          - extended_fields
          - observables
          - pushed
          - settings
          - severity
          - status
          - tags
          - title
          example: create_case
          type: string
        version:
          example: WzM1ODg4LDFd
          type: string
      required:
      - action
      - comment_id
      - created_at
      - created_by
      - id
      - owner
      - payload
      - type
      - version
    Cases_case_observable:
      description: A single observable attached to a case.
      properties:
        createdAt:
          description: When the observable was created.
          example: '2024-11-14T10:00:00.000Z'
          format: date-time
          type: string
        description:
          description: An optional description for the observable.
          example: Source IP
          nullable: true
          type: string
        id:
          description: The observable identifier.
          example: df927ab8-54ed-47d6-be07-9948c255c097
          type: string
        typeKey:
          description: The observable type key.
          example: observable-type-ipv4
          type: string
        updatedAt:
          description: When the observable was last updated.
          example: '2024-11-14T10:00:00.000Z'
          format: date-time
          nullable: true
          type: string
        value:
          description: The observable value.
          example: 10.0.0.8
          type: string
      required:
      - id
      - typeKey
      - value
      - description
      - createdAt
      - updatedAt
      title: Case observable
      type: object
    Cases_case_status:
      description: The status of the case.
      enum:
      - closed
      - in-progress
      - open
      type: string
    Cases_string_array:
      items:
        $ref: '#/components/schemas/Cases_string'
      maxItems: 100
      type: array
    Cases_add_alert_comment_request_properties:
      description: Defines properties for case comment requests when type is alert.
      type: object
      properties:
        alertId:
          $ref: '#/components/schemas/Cases_alert_identifiers'
        index:
          $ref: '#/components/schemas/Cases_alert_indices'
        owner:
          $ref: '#/components/schemas/Cases_owner'
        rule:
          $ref: '#/components/schemas/Cases_rule'
        type:
          description: The type of comment.
          enum:
          - alert
          example: alert
          type: string
      required:
      - alertId
      - index
      - owner
      - rule
      - type
      title: Add case comment request properties for alerts
    Cases_payload_severity:
      type: object
      properties:
        severity:
          $ref: '#/components/schemas/Cases_case_severity'
    Cases_searchFieldsTypeArray:
      items:
        $ref: '#/components/schemas/Cases_searchFieldsType'
      type: array
    Cases_case_title:
      description: A title for the case.
      maxLength: 160
      type: string
    Cases_case_categories:
      items:
        $ref: '#/components/schemas/Cases_case_category'
      maxItems: 100
      type: array
    Cases_string:
      type: string
    Cases_connector_properties_swimlane:
      description: Defines properties for connectors when type is `.swimlane`.
      type: object
      properties:
        fields:
          description: An object containing the connector fields. If you want to omit any individual field, specify null as its value.
          type: object
          properties:
            caseId:
              description: The case identifier for Swimlane connectors.
              nullable: true
              type: string
          required:
          - caseId
        id:
          description: The identifier for the connector. To retrieve connector IDs, use the find connectors API.
          type: string
        name:
          description: The name of the connector.
          type: string
        type:
          description: The type of connector.
          enum:
          - .swimlane
          example: .swimlane
          type: string
      required:
      - fields
      - id
      - name
      - type
      title: Create case request properties for a Swimlane connector
    Cases_add_user_comment_request_properties:
      description: Defines properties for case comment requests when type is user.
      properties:
        comment:
          description: The new comment. It is required only when `type` is `user`.
          example: A new comment.
          maxLength: 30000
          type: string
        owner:
          $ref: '#/components/schemas/Cases_owner'
        type:
          description: The type of comment.
          enum:
          - user
          example: user
          type: string
      required:
      - comment
      - owner
      - type
      title: Add case comment request properties for user comments
      type: object
    Cases_related_case:
      description: 'Summary of a case returned when listing cases that contain a given alert. This is a subset of the full case response.

        '
      properties:
        createdAt:
          description: When the case was created.
          format: date-time
          type: string
        description:
          description: The case description.
          type: string
        id:
          description: The case identifier.
          type: string
        status:
          $ref: '#/components/schemas/Cases_case_status'
        title:
          description: The case title.
          type: string
        totals:
          $ref: '#/components/schemas/Cases_attachment_totals'
      required:
      - id
      - title
      - description
      - status
      - createdAt
      - totals
      title: Related case
      type: object
    Cases_payload_status:
      type: object
      properties:
        status:
          $ref: '#/components/schemas/Cases_case_status'
    Cases_payload_delete:
      description: If the `action` is `delete` and the `type` is `delete_case`, the payload is nullable.
      nullable: true
      type: object
    Cases_payload_create_case:
      type: object
      properties:
        assignees:
          $ref: '#/components/schemas/Cases_assignees'
        connector:
          type: object
          properties:
            fields:
              description: An object containing the connector fields. To create a case without a connector, specify null. If you want to omit any individual field, specify null as its value.
              example: null
              nullable: true
              type: object
              properties:
                caseId:
                  description: The case identifier for Swimlane connectors.
                  type: string
                category:
                  description: The category of the incident for ServiceNow ITSM and ServiceNow SecOps connectors.
                  type: string
                destIp:
                  description: Indicates whether cases will send a comma-separated list of destination IPs for ServiceNow SecOps connectors.
                  nullable: true
                  type: boolean
                impact:
                  description: The effect an incident had on business for ServiceNow ITSM connectors.
                  type: string
                issueType:
                  description: The type of issue for Jira connectors.
                  type: string
                issueTypes:
                  description: The type of incident for IBM Resilient connectors.
                  items:
                    type: string
                  type: array
                malwareHash:
                  description: Indicates whether cases will send a comma-separated list of malware hashes for ServiceNow SecOps connectors.
                  nullable: true
                  type: boolean
                malwareUrl:
                  description: Indicates whether cases will send a comma-separated list of malware URLs for ServiceNow SecOps connectors.
                  nullable: true
                  type: boolean
                parent:
                  description: The key of the parent issue, when the issue type is sub-task for Jira connectors.
                  type: string
                priority:
                  description: The priority of the issue for Jira and ServiceNow SecOps connectors.
                  type: string
                severity:
                  description: The severity of the incident for ServiceNow ITSM connectors.
                  type: string
                severityCode:
                  description: The severity code of the incident for IBM Resilient connectors.
                  type: string
                sourceIp:
                  description: Indicates whether cases will send a comma-separated list of source IPs for ServiceNow SecOps connectors.
                  nullable: true
                  type: boolean
                subcategory:
                  description: The subcategory of the incident for ServiceNow ITSM connectors.
                  type: string
                urgency:
                  description: The extent to which the incident resolution can be delayed for ServiceNow ITSM connectors.
                  type: string
            id:
              description: The identifier for the connector. To create a case without a connector, use `none`.
              example: none
              type: string
            name:
              description: The name of the connector. To create a case without a connector, use `none`.
              example: none
              type: string
            type:
              $ref: '#/components/schemas/Cases_connector_types'
        description:
          type: string
        owner:
          $ref: '#/components/schemas/Cases_owner'
        settings:
          $ref: '#/components/schemas/Cases_settings'
        severity:
          $ref: '#/components/schemas/Cases_case_severity'
        status:
          $ref: '#/components/schemas/Cases_case_status'
        tags:
          example:
          - tag-1
          items:
            type: string
          type: array
        title:
          type: string
    Cases_owners:
      items:
        $ref: '#/components/schemas/Cases_owner'
      type: array
    Cases_event_comment_response_properties:
      title: Case response properties for event comments
      type: object
      properties:
        created_at:
          example: '2022-05-13T09:16:17.416Z'
          format: date-time
          type: string
        created_by:
          $ref: '#/components/schemas/Cases_case_response_created_by_properties'
        eventId:
          items:
            example: 7605e6a6f9f4f990ad9f8f6901e5f082f1f1f1665cbaf2f0f2c6f8f6b0d8a39f
            type: string
          type: array
        id:
          example: 8af6ac20-74f6-11ea-b83a-553aecdb28b6
          type: string
        index:
          items:
            example: .internal.alerts-security.alerts-default-000001
            type: string
          type: array
        owner:
          $ref: '#/components/schemas/Cases_owner'
        pushed_at:
          example: null
          format: date-time
          nullable: true
          type: string
        pushed_by:
          $ref: '#/components/schemas/Cases_case_response_pushed_by_properties'
        type:
          enum:
          - event
          example: event
          type: string
        updated_at:
          example: null
          format: date-time
          nullable: true
          type: string
        updated_by:
          $ref: '#/components/schemas/Cases_case_response_updated_by_properties'
        version:
          example: WzIwNDMxLDFd
          type: string
      required:
      - type
    Cases_alert_identifiers:
      description: 'The alert identifiers. It is required only when `type` is `alert`. You can use an array of strings to add multiple alerts to a case, provided that they all relate to the same rule; `index` must also be an array with the same length or number of elements. Adding multiple alerts in this manner is recommended rather than calling the API multiple times. This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.

        '
      example: 6b24c4dc44bc720cfc92797f3d61fff952f2b2627db1fb4f8cc49f4530c4ff42
      oneOf:
      - type: string
      - items:
          type: string
        maxItems: 1000
        type: array
      title: Alert identifiers
      x-state: Technical preview
    Cases_case_response_updated_by_properties:
      nullable: true
      properties:
        email:
          example: null
          nullable: true
          type: string
        full_name:
          example: null
          nullable: true
          type: string
        profile_uid:
          example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
          type: string
        username:
          example: elastic
          nullable: true
          type: string
      required:
      - email
      - full_name
      - username
      title: Case response properties for updated_by
      type: object
    Cases_external_service:
      nullable: true
      type: object
      properties:
        connector_id:
          type: string
        connector_name:
          type: string
        external_id:
          type: string
        external_title:
          type: string
        external_url:
          type: string
        pushed_at:
          format: date-time
          type: string
        pushed_by:
          nullable: true
          type: object
          properties:
            email:
              example: null
              nullable: true
              type: string
            full_name:
              example: null
              nullable: true
              type: string
            profile_uid:
              example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
              type: string
            username:
              example: elastic
              nullable: true
              type: string
    Cases_add_case_comment_request:
      description: The add comment to case API request body varies depending on whether you are adding an alert or a comment.
      discriminator:
        mapping:
          alert: '#/components/schemas/Cases_add_alert_comment_request_properties'
          user: '#/components/schemas/Cases_add_user_comment_request_properties'
        propertyName: type
      oneOf:
      - $ref: '#/components/schemas/Cases_add_alert_comment_request_properties'
      - $ref: '#/components/schemas/Cases_add_user_comment_request_properties'
      title: Add case comment request
    Cases_connector_properties_servicenow_sir:
      description: Defines properties for connectors when type is `.servicenow-sir`.
      type: object
      properties:
        fields:
          description: An object containing the connector fields. If you want to omit any individual field, specify null as its value.
          type: object
          properties:
            category:
              description: The category of the incident.
              nullable: true
              type: string
            destIp:
              description: Indicates whether cases will send a comma-separated list of destination IPs.
              nullable: true
              type: boolean
            malwareHash:
              description: Indicates whether cases will send a comma-separated list of malware hashes.
              nullable: true
              type: boolean
            malwareUrl:
              description: Indicates whether cases will send a comma-separated list of malware URLs.
              nullable: true
              type: boolean
            priority:
              description: The priority of the issue.
              nullable: true
              type: string
            sourceIp:
              description: Indicates whether cases will send a comma-separated list of source IPs.
              nullable: true
              type: boolean
            subcategory:
              description: The subcategory of the incident.
              nullable: true
              type: string
          required:
          - category
          - destIp
          - malwareHash
          - malwareUrl
          - priority
          - sourceIp
          - subcategory
        id:
          description: The identifier for the connector. To retrieve connector IDs, use the find connectors API.
          type: string
        name:
          description: The name of the connector.
          type: string
        type:
          description: The type of connector.
          enum:
          - .servicenow-sir
          example: .servicenow-sir
          type: string
      required:
      - fields
      - id
      - name
      - type
      title: Create case request properties for a ServiceNow SecOps connector
    Cases_connector_types:
      description: The type of connector.
      enum:
      - .cases-webhook
      - .jira
      - .none
      - .resilient
      - .servicenow
      - .servicenow-sir
      - .swimlane
      example: .none
      type: string
    Cases_case_response_get_case:
      description: 'Case details returned by the get case API. The comments property is not included in the response. Use the find case comments API to retrieve comments. totalComment reflects the actual number of user comments.

        '
      properties:
        assignees:
          $ref: '#/components/schemas/Cases_assignees'
        category:
          description: The case category.
          nullable: true
          type: string
        closed_at:
          format: date-time
          nullable: true
          type: string
        closed_by:
          $ref: '#/components/schemas/Cases_case_response_closed_by_properties'
        connector:
          discriminator:
            mapping:
              .cases-webhook: '#/components/schemas/Cases_connector_properties_cases_webhook'
              .jira: '#/components/schemas/Cases_connector_properties_jira'
              .none: '#/components/schemas/Cases_connector_properties_none'
              .resilient: '#/components/schemas/Cases_connector_properties_resilient'
              .servicenow: '#/components/schemas/Cases_connector_properties_servicenow'
              .servicenow-sir: '#/components/schemas/Cases_connector_properties_servicenow_sir'
              .swimlane: '#/components/schemas/Cases_connector_properties_swimlane'
            propertyName: type
          oneOf:
          - $ref: '#/components/schemas/Cases_connector_properties_none'
          - $ref: '#/components/schemas/Cases_connector_properties_cases_webhook'
          - $ref: '#/components/schemas/Cases_connector_properties_jira'
          - $ref: '#/components/schemas/Cases_connector_properties_resilient'
          - $ref: '#/components/schemas/Cases_connector_properties_servicenow'
          - $ref: '#/components/schemas/Cases_connector_properties_servicenow_sir'
          - $ref: '#/components/schemas/Cases_connector_properties_swimlane'
          title: Case response properties for connectors
        created_at:
          example: '2022-05-13T09:16:17.416Z'
          format: date-time
          type: string
        created_by:
          $ref: '#/components/schemas/Cases_case_response_created_by_properties'
        customFields:
          description: Custom field values for the case.
          items:
            type: object
            properties:
              key:
                description: 'The unique identifier for the custom field. The key value must exist in the case configuration settings.

                  '
                type: string
              type:
                description: 'The custom field type. It must match the type specified in the case configuration settings.

                  '
                enum:
                - text
                - toggle
                type: string
              value:
                description: 'The custom field value. If the custom field is required, it cannot be explicitly set to null. However, for cases that existed when the required custom field was added, the default value stored in Elasticsearch is `undefined`. The value returned in the API and user interface in this case is `null`.

                  '
                oneOf:
                - maxLength: 160
                  minLength: 1
                  nullable: true
                  type: string
                - type: boolean
          type: array
        description:
          example: A case description.
          type: string
        duration:
          description: 'The elapsed time from the creation of the case to its closure (in seconds). If the case has not been closed, the duration is set to null. If the case was closed after less than half a second, the duration is rounded down to zero.

            '
          example: 120
          nullable: true
          type: integer
        external_service:
          $ref: '#/components/schemas/Cases_external_service'
        id:
          example: 66b9aa00-94fa-11ea-9f74-e7e108796192
          type: string
        incremental_id:
          description: 'A monotonically increasing number assigned to each case, unique per space. This value is generated asynchronously after the case is created and may not be present immediately in the response.

            '
          example: 1
          nullable: true
          type: integer
        observables:
          description: Observables attached to the case.
          items:
            $ref: '#/components/schemas/Cases_case_observable'
          type: array
        owner:
          $ref: '#/components/schemas/Cases_owner'
        settings:
          $ref: '#/components/schemas/Cases_settings'
        severity:
          $ref: '#/components/schemas/Cases_case_severity'
        status:
          $ref: '#/components/schemas/Cases_case_status'
        tags:
          example:
          - tag-1
          items:
            type: string
          type: array
        title:
          example: Case title 1
          type: string
        total_observables:
          description: The number of observables attached to the case.
          example: 0
          nullable: true
          type: integer
        totalAlerts:
          example: 0
          type: integer
        totalComment:
          description: The number of user comments on the case. Use the find case comments API to retrieve comment content.
          example: 1
          type: integer
        totalEvents:
          description: The number of events attached to the case.
          example: 0
          type: integer
        updated_at:
          format: date-time
          nullable: true
          type: string
        updated_by:
          $ref: '#/components/schemas/Cases_case_response_updated_by_properties'
        version:
          example: WzUzMiwxXQ==
          type: string
      required:
      - closed_at
      - closed_by
      - connector
      - created_at
      - created_by
      - description
      - duration
      - external_service
      - id
      - observables
      - owner
      - settings
      - severity
      - status
      - tags
      - title
      - totalAlerts
      - totalComment
      - total_observables
      - updated_at
      - updated_by
      - version
      title: Get case response
      type: object
    Cases_update_case_configuration_request:
      description: 'You can update settings such as the closure type, custom fields, templates, and the default connector for cases.

        '
      properties:
        closure_type:
          $ref: '#/components/schemas/Cases_closure_types'
        connector:
          description: An object that contains the connector configuration.
          type: object
          properties:
            fields:
              description: The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to `null`.
              nullable: true
              type: object
            id:
              description: The identifier for the connector. If you do not want a default connector, use `none`. To retrieve connector IDs, use the find connectors API.
              example: none
              type: string
            name:
              description: The name of the connector. If you do not want a default connector, use `none`. To retrieve connector names, use the find connectors API.
              example: none
              type: string
            type:
              $ref: '#/components/schemas/Cases_connector_types'
          required:
          - fields
          - id
          - name
          - type
        customFields:
          description: Custom fields case configuration.
          items:
            type: object
            properties:
              defaultValue:
                description: 'A default value for the custom field. If the `type` is `text`, the default value must be a string. If the `type` is `toggle`, the default value must be boolean.

                  '
                oneOf:
                - type: string
                - type: boolean
              key:
                description: 'A unique key for the custom field. Must be lower case and composed only of a-z, 0-9, ''_'', and ''-'' characters. It is used in API calls to refer to a specific custom field.

                  '
                maxLength: 36
                minLength: 1
                type: string
              label:
                description: The custom field label that is displayed in the case.
                maxLength: 50
                minLength: 1
                type: string
              type:
                description: The type of the custom field.
                enum:
                - text
                - toggle
                type: string
              required:
                description: 'Indicates whether the field is required. If `false`, the custom field can be set to null or omitted when a case is created or updated.

                  '
                type: boolean
            required:
            - key
            - label
            - required
            - type
          type: array
        templates:
          $ref: '#/components/schemas/Cases_templates'
        version:
          description: 'The version of the connector. To retrieve the version value, use the get configuration API.

            '
          example: WzIwMiwxXQ==
          type: string
      required:
      - version
      title: Update case configuration request
      type: object
    Cases_case_description:
      description: The description for the case.
      maxLength: 30000
      type: string
    Cases_connector_properties_jira:
      description: Defines properties for connectors when type is `.jira`.
      type: object
      properties:
        fields:
          description: An object containing the connector fields. If you want to omit any individual field, specify null as its value.
          type: object
          properties:
            issueType:
              description: The type of issue.
              nullable: true
              type: string
            parent:
              description: The key of the parent issue, when the issue type is sub-task.
              nullable: true
              type: string
            priority:
              description: The priority of the issue.
              nullable: true
              type: string
          required:
          - issueType
          - parent
          - priority
        id:
          description: The identifier for the connector. To retrieve connector IDs, use the find connectors API.
          type: string
        name:
          description: The name of the connector.
          type: string
        type:
          description: The type of connector.
          enum:
          - .jira
          example: .jira
          type: string
      required:
      - fields
      - id
      - name
      - type
      title: Create or update case request properties for a Jira connector
    Cases_payload_assignees:
      type: object
      properties:
        assignees:
          $ref: '#/components/schemas/Cases_assignees'
    Cases_rule:
      description: 'The rule that is associated with the alerts. It is required only when `type` is `alert`. This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.

        '
      title: Alerting rule
      type: object
      properties:
        id:
          description: The rule identifier.
          example: 94d80550-aaf4-11ec-985f-97e55adae8b9
          type: string
        name:
          description: The rule name.
          example: security_rule
          type: string
      x-state: Technical preview
    Cases_payload_alert_comment:
      type: object
      properties:
        comment:
          type: object
          properties:
            alertId:
              oneOf:
              - example: 1c0b056b-cc9f-4b61-b5c9-cb801abd5e1d
                type: string
              - items:
                  type: string
                type: array
            index:
              oneOf:
              - example: .alerts-observability.logs.alerts-default
                type: string
              - items:
                  type: string
                type: array
            owner:
              $ref: '#/components/schemas/Cases_owner'
            rule:
              type: object
              properties:
                id:
                  description: The rule identifier.
                  example: 94d80550-aaf4-11ec-985f-97e55adae8b9
                  nullable: true
                  type: string
                name:
                  description: The rule name.
                  example: security_rule
                  nullable: true
                  type: string
            type:
              enum:
              - alert
              type: string
    Cases_templates:
      items:
        type: object
        properties:
          caseFields:
            type: object
            properties:
              assignees:
                $ref: '#/components/schemas/Cases_assignees'
              category:
                $ref: '#/components/schemas/Cases_case_category'
              connector:
                type: object
                properties:
                  fields:
                    description: The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to `null`.
                    nullable: true
                    type: object
                  id:
                    description: The identifier for the connector. If you do not want a default connector, use `none`. To retrieve connector IDs, use the find connectors API.
                    example: none
                    type: string
                  name:
                    description: The name of the connector. If you do not want a default connector, use `none`. To retrieve connector names, use the find connectors API.
                    example: none
                    type: string
                  type:
                    $ref: '#/components/schemas/Cases_connector_types'
              customFields:
                description: Custom field values in the template.
                items:
                  type: object
                  properties:
                    key:
                      description: The unique key for the custom field.
                      type: string
                    type:
                      description: The type of the custom field.
                      enum:
                      - text
                      - toggle
                      type: string
                    value:
                      description: 'The default value for the custom field when a case uses the template. If the `type` is `text`, the default value must be a string. If the `type` is `toggle`, the default value must be boolean.

                        '
                      oneOf:
                      - type: string
                      - type: boolean
                type: array
                x-state: Technical preview
              description:
                $ref: '#/components/schemas/Cases_case_description'
              settings:
                $ref: '#/components/schemas/Cases_settings'
              severity:
                $ref: '#/components/schemas/Cases_case_severity'
              tags:
                $ref: '#/components/schemas/Cases_case_tags'
              title:
                $ref: '#/components/schemas/Cases_case_title'
          description:
            description: A description for the template.
            type: string
          key:
            description: 'A unique key for the template. Must be lower case and composed only of a-z, 0-9, ''_'', and ''-'' characters. It is used in API calls to refer to a specific template.

              '
            type: string
          name:
            description: The name of the template.
            type: string
          tags:
            $ref: '#/components/schemas/Cases_template_tags'
      type: array
      x-state: Technical preview
    Cases_add_case_file_request:
      description: Defines the file that will be attached to the case. Optional parameters will be generated automatically from the file metadata if not defined.
      type: object
      properties:
        file:
          description: The file being attached to the case.
          format: binary
          type: string
        filename:
          description: The desired name of the file being attached to the case, it can be different than the name of the file in the filesystem. **This should not include the file extension.**
          type: string
      required:
      - file
      title: Add case file request properties
    Cases_case_response_pushed_by_properties:
      nullable: true
      properties:
        email:
          example: null
          nullable: true
          type: string
        full_name:
          example: null
          nullable: true
          type: string
        profile_uid:
          example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
          type: string
        username:
          example: elastic
          nullable: true
          type: string
      required:
      - email
      - full_name
      - username
      title: Case response properties for pushed_by
      type: object
    Cases_payload_tags:
      type: object
      properties:
        tags:
          example:
          - tag-1
          items:
            type: string
          type: array
    Cases_update_user_comment_request_properties:
      description: Defines properties for case comment requests when type is user.
      properties:
        comment:
          description: The new comment. It is required only when `type` is `user`.
          example: A new comment.
          maxLength: 30000
          type: string
        id:
          description: 'The identifier for the comment. To retrieve comment IDs, use the get comments API.

            '
          example: 8af6ac20-74f6-11ea-b83a-553aecdb28b6
          type: string
        owner:
          $ref: '#/components/schemas/Cases_owner'
        type:
          description: The type of comment.
          enum:
          - user
          example: user
          type: string
        version:
          description: 'The current comment version. To retrieve version values, use the get comments API.

            '
          example: Wzk1LDFd
          type: string
      required:
      - comment
      - id
      - owner
      - type
      - version
      title: Update case comment request properties for user comments
      type: object
    Cases_actions:
      enum:
      - add
      - create
      - delete
      - push_to_service
      - update
      example: create
      type: string
    Cases_case_close_sync_reason:
      description: 'The close reason to sync to attached alerts when closing the case. Can be one of following predefined reasons: [false_positive, duplicate, true_positive, benign_positive, automated_closure, other] or a custom reason provided by the user.

        '
      oneOf:
      - enum:
        - false_positive
        - duplicate
        - true_positive
        - benign_positive
        - automated_closure
        - other
        type: string
      - type: string
    Cases_closure_types:
      description: Indicates whether a case is automatically closed when it is pushed to external systems (`close-by-pushing`) or not automatically closed (`close-by-user`).
      enum:
      - close-by-pushing
      - close-by-user
      example: close-by-user
      type: string
  parameters:
    Cases_category:
      description: Filters the returned cases by category.
      in: query
      name: category
      schema:
        oneOf:
        - $ref: '#/components/schemas/Cases_case_category'
        - $ref: '#/components/schemas/Cases_case_categories'
    Cases_user_action_types:
      description: Determines the types of user actions to return.
      in: query
      name: types
      schema:
        items:
          enum:
          - action
          - alert
          - assignees
          - attachment
          - comment
          - connector
          - create_case
          - description
          - pushed
          - settings
          - severity
          - status
          - tags
          - title
          - user
          example: create_case
          type: string
        type: array
    Cases_from:
      description: 'Returns only cases that were created after a specific date. The date must be specified as a KQL data range or date match expression.

        '
      in: query
      name: from
      schema:
        example: now-1d
        type: string
    Cases_comment_id:
      description: 'The identifier for the comment. To retrieve comment IDs, use the get case or search cases (`_find`) APIs.

        '
      in: path
      name: commentId
      required: true
      schema:
        example: 71ec1870-725b-11ea-a0b2-c51ea50a58e2
        type: string
    Cases_severity:
      description: The severity of the case.
      example: low
      in: query
      name: severity
      schema:
        enum:
        - critical
        - high
        - low
        - medium
        type: string
    Cases_tags:
      description: Filters the returned cases by tags.
      example: tag-1
      in: query
      name: tags
      schema:
        oneOf:
        - $ref: '#/components/schemas/Cases_string'
        - $ref: '#/components/schemas/Cases_string_array'
    Cases_page_index:
      description: The page number to return.
      example: 1
      in: query
      name: page
      required: false
      schema:
        default: 1
        type: integer
    Cases_status:
      description: Filters the returned cases by state.
      example: open
      in: query
      name: status
      schema:
        enum:
        - closed
        - in-progress
        - open
        type: string
    Cases_sortField:
      description: Determines which field is used to sort the results.
      example: updatedAt
      in: query
      name: sortField
      schema:
        default: createdAt
        enum:
        - createdAt
        - updatedAt
        - closedAt
        - title
        - category
        - status
        - severity
        type: string
    Cases_connector_id:
      description: An identifier for the connector. To retrieve connector IDs, use the find connectors API.
      in: path
      name: connectorId
      required: true
      schema:
        example: abed3a70-71bd-11ea-a0b2-c51ea50a58e2
        type: string
    Cases_configuration_id:
      description: An identifier for the configuration.
      in: path
      name: configurationId
      required: true
      schema:
        example: 3297a0f0-b5ec-11ec-b141-0fdb20a7f9a9
        type: string
    Cases_sort_order:
      description: Determines the sort order.
      example: desc
      in: query
      name: sortOrder
      required: false
      schema:
        default: desc
        enum:
        - asc
        - desc
        type: string
    Cases_case_id:
      description: The identifier for the case. To retrieve case IDs, use the search cases (`_find)` API. All non-ASCII characters must be URL encoded.
      in: path
      name: caseId
      required: true
      schema:
        example: 9c235210-6834-11ea-a78c-6ffb38a34414
        type: string
    Cases_owner_filter:
      description: 'A filter to limit the response to a specific set of applications. If this parameter is omitted, the response contains information about all the cases that the user has access to read.

        '
      example: cases
      in: query
      name: owner
      schema:
        oneOf:
        - $ref: '#/components/schemas/Cases_owner'
        - $ref: '#/components/schemas/Cases_owners'
    Cases_kbn_xsrf:
      description: Cross-site request forgery protection
      in: header
      name: kbn-xsrf
      required: true
      schema:
        type: string
    Cases_defaultSearchOperator:
      description: he default operator to use for the simple_query_string.
      example: OR
      in: query
      name: defaultSearchOperator
      schema:
        default: OR
        type: string
    Cases_ids:
      description: 'The cases that you want to removed. To get the case identifiers, use the search cases (`_find`) API. In the Dev Console, you can specify the array of cases in the following format: `ids=["e58e77e3-ef8e-4251-926f-efb115f3c4ec"]`. In `curl`, all non-ASCII characters must be URL encoded. For example: `ids=%5B%22e58e77e3-ef8e-4251-926f-efb115f3c4ec%22%5D`

        '
      in: query
      name: ids
      required: true
      schema:
        items:
          example: d4e7abb0-b462-11ec-9a8d-698504725a43
          maxItems: 100
          minItems: 1
          type: string
        type: array
    Cases_reporters:
      description: Filters the returned cases by the user name of the reporter.
      example: elastic
      in: query
      name: reporters
      schema:
        oneOf:
        - $ref: '#/components/schemas/Cases_string'
        - $ref: '#/components/schemas/Cases_string_array'
    Cases_assignees_filter:
      description: 'Filters the returned cases by assignees. Valid values are `none` or unique identifiers for the user profiles. These identifiers can be found by using the suggest user profile API.

        '
      in: query
      name: assignees
      schema:
        oneOf:
        - $ref: '#/components/schemas/Cases_string'
        - $ref: '#/components/schemas/Cases_string_array'
    Cases_alert_id:
      description: An identifier for the alert.
      in: path
      name: alertId
      required: true
      schema:
        example: 09f0c261e39e36351d75995b78bb83673774d1bc2cca9df2d15f0e5c0a99a540
        type: string
    Cases_searchFields:
      description: The fields to perform the simple_query_string parsed query against.
      in: query
      name: searchFields
      schema:
        oneOf:
        - $ref: '#/components/schemas/Cases_searchFieldsType'
        - $ref: '#/components/schemas/Cases_searchFieldsTypeArray'
    Cases_to:
      description: 'Returns only cases that were created before a specific date. The date must be specified as a KQL data range or date match expression.

        '
      example: now+1d
      in: query
      name: to
      schema:
        type: string
    Cases_page_size:
      description: The number of items to return. Limited to 100 items.
      example: 20
      in: query
      name: perPage
      required: false
      schema:
        default: 20
        maximum: 100
        type: integer
    Cases_search:
      description: An Elasticsearch simple_query_string query that filters the objects in the response.
      example: Case title 1
      in: query
      name: search
      schema:
        type: string
  examples:
    Cases_update_case_configuration_response:
      summary: This is an example response when the case configuration was updated.
      value:
        closure_type: close-by-user
        connector:
          fields: null
          id: 5e656730-e1ca-11ec-be9b-9b1838238ee6
          name: my-jira-connector
          type: .jira
        created_at: '2024-07-01T17:07:17.767Z'
        created_by:
          email: null
          full_name: null
          profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
          username: elastic
        customFields:
        - defaultValue: A new default value.
          key: d312efda-ec2b-42ec-9e2c-84981795c581
          label: my-text-field
          type: text
          required: true
        - key: fcc6840d-eb14-42df-8aaf-232201a705ec
          label: my-toggle
          type: toggle
          required: false
        error: null
        id: 4a97a440-e1cd-11ec-be9b-9b1838238ee6
        mappings:
        - action_type: overwrite
          source: title
          target: summary
        - action_type: overwrite
          source: description
          target: description
        - action_type: overwrite
          source: tags
          target: labels
        - action_type: append
          source: comments
          target: comments
        owner: cases
        templates: []
        updated_at: '2024-07-19T00:52:42.401Z'
        updated_by:
          email: null
          full_name: null
          profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
          username: elastic
        version: WzI2LDNd
    Cases_update_comment_response:
      summary: The add comment to case API returns a JSON object that contains details about the case and its comments.
      value:
        assignees: []
        category: null
        closed_at: null
        closed_by: null
        comments:
        - comment: An updated comment.
          created_at: '2023-10-24T00:37:10.832Z'
          created_by:
            email: null
            full_name: null
            profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
            username: elastic
          id: 8af6ac20-74f6-11ea-b83a-553aecdb28b6
          owner: cases
          pushed_at: null
          pushed_by: null
          type: user
          updated_at: '2023-10-24T01:27:06.210Z'
          updated_by:
            email: null
            full_name: null
            profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
            username: elastic
          version: WzIwNjM3LDFd
        connector:
          fields: null
          id: none
          name: none
          type: .none
        created_at: '2023-10-24T00:37:03.906Z'
        created_by:
          email: null
          full_name: null
          profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
          username: elastic
        customFields:
        - key: d312efda-ec2b-42ec-9e2c-84981795c581
          type: text
          value: My new field value
        - key: fcc6840d-eb14-42df-8aaf-232201a705ec
          type: toggle
          value: false
        description: A case description.
        duration: null
        external_service: null
        id: 293f1bc0-74f6-11ea-b83a-553aecdb28b6
        owner: cases
        settings:
          syncAlerts: false
        severity: low
        status: open
        tags:
        - tag 1
        title: Case title 1
        totalAlerts: 0
        totalComment: 1
        totalEvents: 0
        updated_at: '2023-10-24T01:27:06.210Z'
        updated_by:
          email: null
          full_name: null
          profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
          username: elastic
        version: WzIwNjM2LDFd
    Cases_get_case_response:
      summary: Get case response. Comments are not included; use the find case comments API. totalComment reflects the actual count.
      value:
        assignees:
        - uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
        category: null
        closed_at: null
        closed_by: null
        connector:
          fields: null
          id: none
          name: none
          type: .none
        created_at: '2023-10-13T15:33:50.604Z'
        created_by:
          email: null
          full_name: null
          profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
          username: elastic
        customFields:
        - key: d312efda-ec2b-42ec-9e2c-84981795c581
          type: text
          value: My field value
        - key: fcc6840d-eb14-42df-8aaf-232201a705ec
          type: toggle
          value: null
        description: A case description
        duration: null
        external_service: null
        id: 31cdada0-02c1-11ed-85f2-4f7c222ca2fa
        incremental_id: 1
        observables: []
        owner: cases
        settings:
          extractObservables: false
          syncAlerts: true
        severity: low
        status: open
        tags:
        - tag 1
        title: Case title 1
        total_observables: 0
        totalAlerts: 1
        totalComment: 1
        totalEvents: 0
        updated_at: '2023-10-13T15:40:32.335Z'
        updated_by:
          email: null
          full_name: null
          profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
          username: elastic
        version: WzM2LDFd
    Cases_update_case_request:
      summary: Update the case description, tags, and connector.
      value:
        cases:
        - connector:
            fields:
              issueType: '10006'
              parent: null
              priority: null
            id: 131d4448-abe0-4789-939d-8ef60680b498
            name: My connector
            type: .jira
          customFields:
          - key: fcc6840d-eb14-42df-8aaf-232201a705ec
            type: toggle
            value: false
          - key: d312efda-ec2b-42ec-9e2c-84981795c581
            type: text
            value: My new field value
          description: A case description.
          id: a18b38a0-71b0-11ea-a0b2-c51ea50a58e2
          settings:
            extractObservables: false
            syncAlerts: true
          tags:
          - tag-1
          version: WzIzLDFd
    Cases_response_401:
      summary: Authorization information is missing or invalid.
      value:
        error: Unauthorized
        message: Unable to authenticate with the provided credentials.
        statusCode: 401
    Cases_get_comment_response:
      summary: A single user comment retrieved from a case
      value:
        comment: A new comment
        created_at: '2023-10-07T19:32:13.104Z'
        created_by:
          email: null
          full_name: null
          profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
          username: elastic
        id: 8048b460-fe2b-11ec-b15d-779a7c8bbcc3
        owner: cases
        pushed_at: null
        pushed_by: null
        type: user
        updated_at: null
        updated_by: null
        version: WzIzLDFd
    Cases_find_case_activity_response:
      summary: Retrieves all activity for a case
      value:
        page: 1
        perPage: 20
        total: 3
        userActions:
        - action: create
          comment_id: null
          created_at: '2023-10-20T01:17:22.150Z'
          created_by:
            email: null
            full_name: null
            profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
            username: elastic
          id: b4cd0770-07c9-11ed-a5fd-47154cb8767e
          owner: cases
          payload:
            assignees: []
            category: null
            connector:
              fields: null
              id: none
              name: none
              type: .none
            customFields:
            - key: d312efda-ec2b-42ec-9e2c-84981795c581
              type: text
              value: My field value
            - key: fcc6840d-eb14-42df-8aaf-232201a705ec
              type: toggle
              value: null
            description: A case description.
            owner: cases
            settings:
              syncAlerts: false
            severity: low
            status: open
            tags:
            - tag 1
            title: Case title 1
          type: create_case
          version: WzM1ODg4LDFd
        - action: create
          comment_id: 578608d0-03b1-11ed-920c-974bfa104448
          created_at: '2023-10-14T20:12:53.354Z'
          created_by:
            email: null
            full_name: null
            profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
            username: elastic
          id: 57af14a0-03b1-11ed-920c-974bfa104448
          owner: cases
          payload:
            comment:
              comment: A new comment
              owner: cases
              type: user
          type: comment
          version: WzM1ODg4LDFa
        - action: add
          comment_id: null
          created_at: '2023-10-20T01:10:28.238Z'
          created_by:
            email: null
            full_name: null
            profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
            username: elastic
          id: 573c6980-6123-11ed-aa41-81a0a61fe447
          owner: cases
          payload:
            assignees:
            - uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
          type: assignees
          version: WzM1ODg4LDFb
    Cases_add_comment_request:
      summary: Adds a comment to a case.
      value:
        comment: A new comment.
        owner: cases
        type: user
    Cases_create_case_response:
      summary: The create case API returns a JSON object that contains details about the case.
      value:
        assignees: []
        closed_at: null
        closed_by: null
        comments: []
        connector:
          fields:
            issueType: '10006'
            parent: null
            priority: High
          id: 131d4448-abe0-4789-939d-8ef60680b498
          name: My connector
          type: .jira
        created_at: '2022-10-13T15:33:50.604Z'
        created_by:
          email: null
          full_name: null
          profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
          username: elastic
        customFields:
        - key: d312efda-ec2b-42ec-9e2c-84981795c581
          type: text
          value: My field value
        - key: fcc6840d-eb14-42df-8aaf-232201a705ec
          type: toggle
          value: null
        description: A case description.
        duration: null
        external_service: null
        id: 66b9aa00-94fa-11ea-9f74-e7e108796192
        observables: []
        owner: cases
        settings:
          extractObservables: false
          syncAlerts: true
        severity: low
        status: open
        tags:
        - tag 1
        title: Case title 1
        total_observables: 0
        totalAlerts: 0
        totalComment: 0
        totalEvents: 0
        updated_at: null
        updated_by: null
        version: WzUzMiwxXQ==
    Cases_update_comment_request:
      summary: Updates a comment of a case.
      value:
        comment: An updated comment.
        id: 8af6ac20-74f6-11ea-b83a-553aecdb28b6
        owner: cases
        type: user
        version: Wzk1LDFd
    Cases_update_case_configuration_request:
      summary: Update the case settings.
      value:
        closure_type: close-by-user
        connector:
          fields: null
          id: 5e656730-e1ca-11ec-be9b-9b1838238ee6
          name: my-jira-connector
          type: .jira
        customFields:
        - defaultValue: A new default value.
          key: d312efda-ec2b-42ec-9e2c-84981795c581
          label: my-text-field
          type: text
          required: true
        - key: fcc6840d-eb14-42df-8aaf-232201a705ec
          label: my-toggle
          type: toggle
          required: false
        version: WzExOSw0XQ==
    Cases_push_case_response:
      summary: The push case API returns a JSON object with details about the case and the external service.
      value:
        assignees: []
        category: null
        closed_at: null
        closed_by: null
        comments: []
        connector:
          fields:
            issueType: '10006'
            parent: null
            priority: Low
          id: 09f8c0b0-0eda-11ed-bd18-65557fe66949
          name: My connector
          type: .jira
        created_at: '2022-07-29T00:59:39.444Z'
        created_by:
          email: null
          full_name: null
          profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
          username: elastic
        customFields: []
        description: A case description.
        duration: null
        external_service:
          connector_id: 09f8c0b0-0eda-11ed-bd18-65557fe66949
          connector_name: My connector
          external_id: '71926'
          external_title: ES-554
          external_url: https://cases.jira.com
          pushed_at: '2022-07-29T01:20:58.436Z'
          pushed_by:
            email: null
            full_name: null
            username: elastic
        id: b917f300-0ed9-11ed-bd18-65557fe66949
        observables: []
        owner: cases
        settings:
          extractObservables: false
          syncAlerts: true
        severity: low
        status: open
        tags:
        - tag 1
        title: Case title 1
        total_observables: 0
        totalAlerts: 0
        totalComment: 0
        totalEvents: 0
        updated_at: '2022-07-29T01:20:58.436Z'
        updated_by:
          email: null
          full_name: null
          profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
          username: elastic
        version: WzE3NjgsM10=
    Cases_get_case_alerts_response:
      summary: Retrieves all alerts attached to a case
      value:
      - attached_at: '2022-07-25T20:09:40.963Z'
        id: f6a7d0c3-d52d-432c-b2e6-447cd7fce04d
        index: .alerts-observability.logs.alerts-default
    Cases_set_case_configuration_response:
      summary: This is an example response for case settings.
      value:
        closure_type: close-by-user
        connector:
          fields: null
          id: 5e656730-e1ca-11ec-be9b-9b1838238ee6
          name: my-jira-connector
          type: .jira
        created_at: '2024-07-01T17:07:17.767Z'
        created_by:
          email: null,
          full_name: null
          profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
          username: elastic
        customFields:
        - defaultValue: My custom field default value.
          key: d312efda-ec2b-42ec-9e2c-84981795c581
          label: my-text-field
          type: text
          required: false
        error: null
        id: 4a97a440-e1cd-11ec-be9b-9b1838238ee6
        mappings:
        - action_type: overwrite
          source: title
          target: summary
        - action_type: overwrite
          source: description
          target: description
        - action_type: append
          source: comments
          target: comments
        - action_type: overwrite
          source: tags
          target: labels
        owner: cases
        templates:
        - caseFields:
            assignees:
            - uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
            category: Default-category
            customFields:
            - key: d312efda-ec2b-42ec-9e2c-84981795c581
              type: text
              value: A text field value for the template.
            description: A default description for cases.
            tags:
            - Default case tag
            title: Default case title
          description: A description of the template.
          key: 505932fe-ee3a-4960-a661-c781b5acdb05
          name: template-1
          tags:
          - Template tag 1
        updated_at: null
        updated_by: null
        version: WzIwNzMsMV0=
    Cases_set_case_configuration_request:
      summary: Set the closure type, custom fields, and default connector for Stack Management cases.
      value:
        closure_type: close-by-user
        connector:
          fields: null
          id: 5e656730-e1ca-11ec-be9b-9b1838238ee6
          name: my-jira-connector
          type: .jira
        customFields:
        - defaultValue: My custom field default value.
          key: d312efda-ec2b-42ec-9e2c-84981795c581
          label: my-text-field
          type: text
          required: false
        owner: cases
        templates:
        - caseFields:
            assignees:
            - uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
            category: Default-category
            customFields:
            - key: d312efda-ec2b-42ec-9e2c-84981795c581
              type: text
              value: A text field value for the template.
            description: A default description for cases.
            tags:
            - Default case tag
            title: Default case title
          description: A description of the template.
          key: 505932fe-ee3a-4960-a661-c781b5acdb05
          name: template-1
          tags:
          - Template tag 1
    Cases_find_case_comments_response:
      summary: Paginated list of user comments for a case
      value:
        comments:
        - comment: A new comment
          created_at: '2023-10-07T19:32:13.104Z'
          created_by:
            email: null
            full_name: null
            profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
            username: elastic
          id: 8048b460-fe2b-11ec-b15d-779a7c8bbcc3
          owner: cases
          pushed_at: null
          pushed_by: null
          type: user
          updated_at: null
          updated_by: null
          version: WzIzLDFd
        page: 1
        per_page: 20
        total: 1
    Cases_get_case_configuration_response:
      summary: Get the case configuration.
      value:
      - closure_type: close-by-user
        connector:
          fields: null
          id: none
          name: none
          type: .none
        created_at: '2024-07-01T17:07:17.767Z'
        created_by:
          email: null
          full_name: null
          username: elastic
        customFields:
        - defaultValue: Custom text field value.
          key: d312efda-ec2b-42ec-9e2c-84981795c581
          label: my-text-field
          type: text
          required: false
        error: null
        id: 856ee650-6c82-11ee-a20a-6164169afa58
        mappings: []
        observableTypes: []
        owner: cases
        templates:
        - caseFields:
            assignees:
            - uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
            category: Default-category
            connector:
              fields: null
              id: none
              name: none
              type: .none
            customFields:
            - key: d312efda-ec2b-42ec-9e2c-84981795c581
              type: text
              value: Default text field value.
            description: A default description for cases.
            settings:
              syncAlerts: false
            tags:
            - Default case tag
            title: Default case title
          description: A description of the template.
          key: 505932fe-ee3a-4960-a661-c781b5acdb05
          name: template-1
          tags:
          - Template tag 1
        updated_at: null
        updated_by: null
        version: WzEyLDNd
    Cases_update_case_response:
      summary: This is an example response when the case description, tags, and connector were updated.
      value:
      - assignees: []
        category: null
        closed_at: null
        closed_by: null
        comments: []
        connector:
          fields:
            issueType: '10006'
            parent: null
            priority: null
          id: 131d4448-abe0-4789-939d-8ef60680b498
          name: My connector
          type: .jira
        created_at: '2023-10-13T09:16:17.416Z'
        created_by:
          email: null
          full_name: null
          profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
          username: elastic
        customFields:
        - key: d312efda-ec2b-42ec-9e2c-84981795c581
          type: text
          value: My new field value
        - key: fcc6840d-eb14-42df-8aaf-232201a705ec
          type: toggle
          value: false
        description: A case description.
        duration: null
        external_service:
          connector_id: 05da469f-1fde-4058-99a3-91e4807e2de8
          connector_name: Jira
          external_id: '10003'
          external_title: IS-4
          external_url: https://hms.atlassian.net/browse/IS-4
          pushed_at: '2023-10-13T09:20:40.672Z'
          pushed_by:
            email: null
            full_name: null
            username: elastic
        id: 66b9aa00-94fa-11ea-9f74-e7e108796192
        observables: []
        owner: cases
        settings:
          extractObservables: false
          syncAlerts: true
        severity: low
        status: open
        tags:
        - tag-1
        title: Case title 1
        total_observables: 0
        totalAlerts: 0
        totalComment: 0
        totalEvents: 0
        updated_at: '2023-10-13T09:48:33.043Z'
        updated_by:
          email: null
          full_name: null
          profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
          username: elastic
        version: WzU0OCwxXQ==
    Cases_get_tags_response:
      summary: A list of tags that are used in cases
      value:
      - observability
      - security
      - tag 1
      - tag 2
    Cases_get_case_observability_response:
      summary: Get case response (Observability). Comments are not included; use the find case comments API. totalComment reflects the actual count.
      value:
        assignees:
        - uid: u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0
        category: null
        closed_at: null
        closed_by: null
        connector:
          fields: null
          id: none
          name: none
          type: .none
        created_at: '2023-11-06T19:29:04.086Z'
        created_by:
          email: null
          full_name: null
          username: elastic
        customFields: []
        description: An Observability case description.
        duration: null
        external_service: null
        id: c3ff7550-def1-4e90-b6bc-c9969a4a09b1
        observables: []
        owner: observability
        settings:
          extractObservables: false
          syncAlerts: false
        severity: low
        status: in-progress
        tags:
        - observability
        - tag 1
        title: Observability case title 1
        total_observables: 0
        totalAlerts: 1
        totalComment: 1
        totalEvents: 0
        updated_at: '2023-11-06T19:47:55.662Z'
        updated_by:
          email: null
          full_name: null
          profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
          username: elastic
        version: WzI0NywyXQ==
    Cases_create_case_request:
      summary: Create a security case that uses a Jira connector.
      value:
        connector:
          fields:
            issueType: '10006'
            parent: null
            priority: High
          id: 131d4448-abe0-4789-939d-8ef60680b498
          name: My connector
          type: .jira
        customFields:
        - key: d312efda-ec2b-42ec-9e2c-84981795c581
          type: text
          value: My field value
        description: A case description.
        owner: cases
        settings:
          extractObservables: false
          syncAlerts: true
        tags:
        - tag-1
        title: Case title 1
    Cases_add_comment_response:
      summary: The add comment to case API returns a JSON object that contains details about the case and its comments.
      value:
        assignees: []
        category: null
        closed_at: null
        closed_by: null
        comments:
        - comment: A new comment.
          created_at: '2022-10-02T00:49:47.716Z'
          created_by:
            email: null
            full_name: null
            profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
            username: elastic
          id: 8af6ac20-74f6-11ea-b83a-553aecdb28b6
          owner: cases
          pushed_at: null
          pushed_by: null
          type: user
          updated_at: null
          updated_by: null
          version: WzIwNDMxLDFd
        connector:
          fields: null
          id: none
          name: none
          type: .none
        created_at: '2022-03-24T00:37:03.906Z'
        created_by:
          email: null
          full_name: null
          profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
          username: elastic
        customFields:
        - key: d312efda-ec2b-42ec-9e2c-84981795c581
          type: text
          value: Field value
        - key: fcc6840d-eb14-42df-8aaf-232201a705ec
          type: toggle
          value: true
        description: A case description.
        duration: null
        external_service: null
        id: 293f1bc0-74f6-11ea-b83a-553aecdb28b6
        observables: []
        owner: cases
        settings:
          syncAlerts: false
        severity: low
        status: open
        tags:
        - tag 1
        title: Case title 1
        total_observables: 0
        totalAlerts: 0
        totalComment: 1
        totalEvents: 0
        updated_at: '2022-06-03T00:49:47.716Z'
        updated_by:
          email: null
          full_name: null
          profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
          username: elastic
        version: WzIzMzgsMV0=
    Cases_find_connector_response:
      summary: Retrieve information about the connectors and their settings.
      value:
      - actionTypeId: .jira
        config:
          apiUrl: https://elastic.atlassian.net/
          projectKey: ES
        id: 61787f53-4eee-4741-8df6-8fe84fa616f7
        isDeprecated: false
        isMissingSecrets: false
        isPreconfigured: false
        name: my-Jira
        referencedByCount: 0
    Cases_find_case_response:
      summary: Retrieve the first five cases with the `tag-1` tag, in ascending order by last update time.
      value:
        cases:
        - assignees: []
          category: null
          closed_at: null
          closed_by: null
          comments: []
          connector:
            fields: null
            id: none
            name: none
            type: .none
          created_at: '2023-10-12T00:16:36.371Z'
          created_by:
            email: null
            full_name: null
            profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
            username: elastic
          customFields:
          - key: d312efda-ec2b-42ec-9e2c-84981795c581
            type: text
            value: My field value
          - key: fcc6840d-eb14-42df-8aaf-232201a705ec
            type: toggle
            value: null
          description: Case description
          duration: null
          external_service: null
          id: abed3a70-71bd-11ea-a0b2-c51ea50a58e2
          incremental_id: 1
          observables: []
          owner: cases
          settings:
            extractObservables: false
            syncAlerts: true
          severity: low
          status: open
          tags:
          - tag-1
          title: Case title
          total_observables: 0
          totalAlerts: 0
          totalComment: 1
          totalEvents: 0
          updated_at: '2023-10-12T00:27:58.162Z'
          updated_by:
            email: null
            full_name: null
            profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
            username: elastic
          version: WzExMCwxXQ==
        count_closed_cases: 0
        count_in_progress_cases: 0
        count_open_cases: 1
        page: 1
        per_page: 5
        total: 1
    Cases_get_reporters_response:
      summary: A list of two users that opened cases
      value:
      - email: null
        full_name: null
        profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
        username: elastic
      - email: jdoe@example.com
        full_name: Jane Doe
        profile_uid: u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0
        username: jdoe
  securitySchemes:
    apiKeyAuth:
      description: 'These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: `Authorization: ApiKey base64AccessApiKey`

        '
      in: header
      name: Authorization
      type: apiKey
    basicAuth:
      scheme: basic
      type: http
x-topics:
- title: Kibana spaces
  content: "Spaces enable you to organize your dashboards and other saved objects into meaningful categories.\nYou can use the default space or create your own spaces.\n\nTo run APIs in non-default spaces, you must add `s/{space_id}/` to the path.\nFor example:\n\n```bash\ncurl -X GET \"http://${KIBANA_URL}/s/marketing/api/data_views\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n```\n\nIf you use the Kibana console to send API requests, it automatically adds the appropriate space identifier.\n\nTo learn more, check out [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces).\n"