Query parameters

• owner string | array[string] Required

  The application that owns the field definitions (for example cases, observability, or securitySolution). Required.

• isGlobal boolean

  When true, returns only global field definitions (rendered on every case). When false, returns all definitions. Omit to return all.

• page integer

  The page number to return.

  Default value is 1.

• perPage integer

  The number of items to return. Limited to 100 items.

  Maximum value is 100. Default value is 20.

• sortField string

  The field to sort by. When omitted, results are sorted by fieldDefinitionId ascending and sortOrder is ignored.

  Values are name, owner, isGlobal, or displayOrder.

• sortOrder string

  Determines the sort order.

  Values are asc or desc. Default value is desc.

• search string

  A case-insensitive substring to match against each definition's name and description fields. Definitions where neither field contains the substring are excluded.

  Maximum length is 1000.

Responses

• 200 application/json

  Indicates a successful call.

  Hide response attributes Show response attributes object

  • fieldDefinitions array[object] Required

    A field definition from the field library. The legacyKey attribute, which is a server-managed link to a migrated custom field, is not included in the public API response.

    Hide fieldDefinitions attributes Show fieldDefinitions attributes object

    A field definition from the field library. The legacyKey attribute, which is a server-managed link to a migrated custom field, is not included in the public API response.

    • definition string Required

      The field definition as a YAML string. New definitions are limited to 30 000 characters, but existing definitions created via internal tooling may be longer.

    • description string

      Optional human-readable description of the field's purpose.

    • displayOrder integer

      Position of a global field in the case details view. Assigned by the server and changed via the Field Library reorder controls.

      Minimum value is 0.

    • fieldDefinitionId string Required

      Unique server-assigned identifier for the field definition (UUID). May be UUIDv4 for definitions created through the public API, or UUIDv5 for definitions created by internal migration processes.

      Maximum length is 36.

    • isGlobal boolean

      When true, this field is rendered in every case regardless of which template the case uses.

    • name string Required

      The field name. Must match the name property in the YAML definition and is unique per owner (case-insensitive). Immutable after creation.

    • owner string Required

      The application that owns this field definition.

      Maximum length is 50.

  • page integer Required

    The current page number.

    Minimum value is 1.

  • perPage integer Required

    The number of items per page.

    Minimum value is 1, maximum value is 100.

  • total integer Required

    The total number of field definitions matching the query (before pagination).

    Minimum value is 0.

• 400 application/json

  The request is invalid. For example, the owner query parameter is missing or page/perPage are not integers.

  Hide response attributes Show response attributes object

  • error string
  • message string
  • statusCode integer
• 401 application/json

  Authorization information is missing or invalid.

  Hide response attributes Show response attributes object

  • error string
  • message string
  • statusCode integer
• 403 application/json

  The user does not have permission to read field definitions for the owner.

  Hide response attributes Show response attributes object

  • error string
  • message string
  • statusCode integer