Get the fields applicable to a case

GET /api/cases/fields

Spaces method and path for this operation:

get /s/{space_id}/api/cases/fields

Refer to Spaces for more information.

Returns the fields you can write to a case's extended_fields when creating a case for the given owner. Includes the owner's global (library-wide) fields and, when templateId is supplied, that template's fields. Migrated legacy custom fields appear as global fields. Requires the Cases feature to be enabled in the space.

Query parameters

owner string Required

The application that owns the cases (for example cases, observability, or securitySolution).

Maximum length is 30.
templateId string

The identifier of a template to include the template's fields in the response.

Maximum length is 36.

Responses

200 application/json

Indicates a successful call.
Hide response attribute Show response attribute object
- fields array[object] Required
  
  Hide fields attributes Show fields attributes object
  
  control string Required
  
  The UI control for the field, such as INPUT_TEXT, INPUT_NUMBER, SELECT_BASIC, TOGGLE, or MARKDOWN.
  
  defaultValue string
  
  The default value, as a string, when the field definition declares one.
  
  displayOnly boolean Required
  
  When true the field is display-only (for example a MARKDOWN block): it is returned so the full form shape is visible, but it holds no value and its key cannot be written to extended_fields.
  
  isGlobal boolean Required
  
  Whether the field is a global (library-wide) definition.
  
  key string Required
  
  The storage key to write in the case extended_fields map. Follows the <field_name>_as_<storage_type> convention (for example priority_as_keyword).
  
  label string Required
  
  The human-readable label. Falls back to name when no label is authored.
  
  name string Required
  
  The field name as authored in the field definition.
  
  options array[string]
  
  The allowed values for SELECT_BASIC, RADIO_GROUP, and CHECKBOX_GROUP fields.
  
  type string Required
  
  The storage type: keyword, integer, long, boolean, or date.
  
  required boolean Required
  
  Whether a value must be supplied at write time.
  
  requiredOnClose boolean Required
  
  Whether the field must be filled before the case can be closed.
  
  source string Required
  
  Where the field comes from: global for a library-wide (isGlobal) definition writable on any case, or template for a field contributed by the applied template.
  
  Values are global or template.
400 application/json

The request is invalid, for example when the templateId does not exist for the owner or its definition is invalid.
Hide response attributes Show response attributes object
- error string
- message string
- statusCode integer
401 application/json

Authorization information is missing or invalid.
Hide response attributes Show response attributes object
- error string
- message string
- statusCode integer
403 application/json

The user does not have access to the requested owner.
Hide response attributes Show response attributes object
- error string
- message string
- statusCode integer

GET /api/cases/fields

curl \
 --request GET 'https://localhost:5601/api/cases/fields?owner=cases' \
 --header "Authorization: $API_KEY"

Response examples (200)

{
  "fields": [
    {
      "control": "SELECT_BASIC",
      "defaultValue": "medium",
      "displayOnly": false,
      "isGlobal": true,
      "key": "priority_as_keyword",
      "label": "Priority",
      "name": "priority",
      "options": [
        "low",
        "medium",
        "high"
      ],
      "type": "keyword",
      "required": true,
      "requiredOnClose": false,
      "source": "global"
    },
    {
      "control": "TEXTAREA",
      "displayOnly": false,
      "isGlobal": false,
      "key": "rollout_notes_as_keyword",
      "label": "Rollout notes",
      "name": "rollout_notes",
      "type": "keyword",
      "required": false,
      "requiredOnClose": true,
      "source": "template"
    },
    {
      "control": "MARKDOWN",
      "displayOnly": true,
      "isGlobal": false,
      "key": "instructions_as_keyword",
      "label": "Instructions",
      "name": "instructions",
      "type": "keyword",
      "required": false,
      "requiredOnClose": false,
      "source": "template"
    }
  ]
}

Response examples (400)

{
  "error": "Bad Request",
  "message": "Template [invalid-template-id] not found for owner [cases]",
  "statusCode": 400
}

Response examples (401)

{
  "error": "Unauthorized",
  "message": "Unable to authenticate with the provided credentials.",
  "statusCode": 401
}

Response examples (403)

{
  "error": "Forbidden",
  "message": "Unauthorized to access cases",
  "statusCode": 403
}