GET /api/cases/{caseId}
Api key auth Basic auth

Spaces method and path for this operation:

get /s/{space_id}/api/cases/{caseId}

Refer to Spaces for more information.

Returns case details. The response does not include a comments property; use the find case comments API to retrieve comments. The totalComment field reflects the actual number of user comments on the case. You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're seeking.

Path parameters

  • caseId string Required

    The identifier for the case. To retrieve case IDs, use the search cases (_find) API. All non-ASCII characters must be URL encoded.

Responses

  • 200 application/json

    Indicates a successful call.

    Hide response attributes Show response attributes object
    • assignees array[object] | null

      An array containing users that are assigned to the case.

      Not more than 10 elements.

      Hide assignees attribute Show assignees attribute object
      • uid string Required

        A unique identifier for the user profile. These identifiers can be found by using the suggest user profile API.

    • category string | null

      The case category.

    • closed_at string(date-time) | null Required
    • closed_by object | null Required
      Hide closed_by attributes Show closed_by attributes object | null
      • email string | null Required
      • full_name string | null Required
      • profile_uid string
      • username string | null Required

    • connector object Required

      One of:
      .none object .cases-webhook object .jira object .resilient object .servicenow object .servicenow-sir object .swimlane object
    • created_at string(date-time) Required
    • created_by object Required
      Hide created_by attributes Show created_by attributes object
      • email string | null Required
      • full_name string | null Required
      • profile_uid string
      • username string | null Required
    • customFields array[object]

      Custom field values for the case.

      Hide customFields attributes Show customFields attributes object
      • key string

        The unique identifier for the custom field. The key value must exist in the case configuration settings.

      • type string

        The custom field type. It must match the type specified in the case configuration settings.

        Values are text or toggle.

      • value string | null | boolean

        The custom field value. If the custom field is required, it cannot be explicitly set to null. However, for cases that existed when the required custom field was added, the default value stored in Elasticsearch is undefined. The value returned in the API and user interface in this case is null.

        One of:
        string-1 string | null boolean-2 boolean

        Minimum length is 1, maximum length is 160.

    • description string Required
    • duration integer | null Required

      The elapsed time from the creation of the case to its closure (in seconds). If the case has not been closed, the duration is set to null. If the case was closed after less than half a second, the duration is rounded down to zero.

    • external_service object | null Required
      Hide external_service attributes Show external_service attributes object | null
      • connector_id string
      • connector_name string
      • external_id string
      • external_title string
      • external_url string
      • pushed_at string(date-time)
      • pushed_by object | null
        Hide pushed_by attributes Show pushed_by attributes object | null
        • email string | null
        • full_name string | null
        • profile_uid string
        • username string | null
    • id string Required
    • incremental_id integer | null

      A monotonically increasing number assigned to each case, unique per space. This value is generated asynchronously after the case is created and may not be present immediately in the response.

    • observables array[object] Required

      Observables attached to the case.

      Hide observables attributes Show observables attributes object

      A single observable attached to a case.

      • createdAt string(date-time) Required

        When the observable was created.

      • description string | null Required

        An optional description for the observable.

      • id string Required

        The observable identifier.

      • typeKey string Required

        The observable type key.

      • updatedAt string(date-time) | null Required

        When the observable was last updated.

      • value string Required

        The observable value.

    • owner string Required

      The application that owns the cases: Stack Management, Observability, or Elastic Security.

      Values are cases, observability, or securitySolution.

    • settings object Required

      An object that contains the case settings.

      Hide settings attributes Show settings attributes object
      • extractObservables boolean

        When true, observables (e.g. IPs, hashes, URLs) are automatically extracted from case comments. Optional; defaults to false when omitted.

      • syncAlerts boolean Required

        Turns alert syncing on or off.

    • severity string Required

      The severity of the case.

      Values are critical, high, low, or medium.

    • status string Required

      The status of the case.

      Values are closed, in-progress, or open.

    • tags array[string] Required
    • title string Required
    • total_observables integer | null Required

      The number of observables attached to the case.

    • totalAlerts integer Required
    • totalComment integer Required

      The number of user comments on the case. Use the find case comments API to retrieve comment content.

    • totalEvents integer

      The number of events attached to the case.

    • updated_at string(date-time) | null Required
    • updated_by object | null Required
      Hide updated_by attributes Show updated_by attributes object | null
      • email string | null Required
      • full_name string | null Required
      • profile_uid string
      • username string | null Required
    • version string Required
  • 401 application/json

    Authorization information is missing or invalid.

    Hide response attributes Show response attributes object
    • error string
    • message string
    • statusCode integer
GET /api/cases/{caseId} 
curl \
 --request GET 'https://localhost:5601/api/cases/9c235210-6834-11ea-a78c-6ffb38a34414' \
 --header "Authorization: $API_KEY"
Response examples (200) 
{
  "assignees": [
    {
      "uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0"
    }
  ],
  "category": null,
  "closed_at": null,
  "closed_by": null,
  "connector": {
    "fields": null,
    "id": "none",
    "name": "none",
    "type": ".none"
  },
  "created_at": "2023-10-13T15:33:50.604Z",
  "created_by": {
    "email": null,
    "full_name": null,
    "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
    "username": "elastic"
  },
  "customFields": [
    {
      "key": "d312efda-ec2b-42ec-9e2c-84981795c581",
      "type": "text",
      "value": "My field value"
    },
    {
      "key": "fcc6840d-eb14-42df-8aaf-232201a705ec",
      "type": "toggle",
      "value": null
    }
  ],
  "description": "A case description",
  "duration": null,
  "external_service": null,
  "id": "31cdada0-02c1-11ed-85f2-4f7c222ca2fa",
  "incremental_id": 1,
  "observables": [],
  "owner": "cases",
  "settings": {
    "extractObservables": false,
    "syncAlerts": true
  },
  "severity": "low",
  "status": "open",
  "tags": [
    "tag 1"
  ],
  "title": "Case title 1",
  "total_observables": 0,
  "totalAlerts": 1,
  "totalComment": 1,
  "totalEvents": 0,
  "updated_at": "2023-10-13T15:40:32.335Z",
  "updated_by": {
    "email": null,
    "full_name": null,
    "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
    "username": "elastic"
  },
  "version": "WzM2LDFd"
}
{
  "assignees": [
    {
      "uid": "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
    }
  ],
  "category": null,
  "closed_at": null,
  "closed_by": null,
  "connector": {
    "fields": null,
    "id": "none",
    "name": "none",
    "type": ".none"
  },
  "created_at": "2023-11-06T19:29:04.086Z",
  "created_by": {
    "email": null,
    "full_name": null,
    "username": "elastic"
  },
  "customFields": [],
  "description": "An Observability case description.",
  "duration": null,
  "external_service": null,
  "id": "c3ff7550-def1-4e90-b6bc-c9969a4a09b1",
  "observables": [],
  "owner": "observability",
  "settings": {
    "extractObservables": false,
    "syncAlerts": false
  },
  "severity": "low",
  "status": "in-progress",
  "tags": [
    "observability",
    "tag 1"
  ],
  "title": "Observability case title 1",
  "total_observables": 0,
  "totalAlerts": 1,
  "totalComment": 1,
  "totalEvents": 0,
  "updated_at": "2023-11-06T19:47:55.662Z",
  "updated_by": {
    "email": null,
    "full_name": null,
    "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
    "username": "elastic"
  },
  "version": "WzI0NywyXQ=="
}
Response examples (401) 
{
  "error": "Unauthorized",
  "message": "Unable to authenticate with the provided credentials.",
  "statusCode": 401
}