Get a case template by ID

GET /api/cases/templates/{template_id}

Api key auth Basic auth

Spaces method and path for this operation:

get /s/{space_id}/api/cases/templates/{template_id}

Refer to Spaces for more information.

Returns the details of a case template. Requires the Cases feature to be enabled in the space.

Path parameters

template_id string Required

The identifier for the template.

Maximum length is 36.

Query parameters

version integer

The version number of the template to retrieve. If omitted, the latest version is returned.

Minimum value is 1.

Responses

200 application/json

Indicates a successful call.
Hide response attributes Show response attributes object
- author string
  
  The username of the template author.
  
  Maximum length is 1000.
- definition Required
  
  The parsed template definition.
- definitionString string Required
  
  The raw YAML definition string.
  
  Maximum length is 30000.
- deletedAt string(date-time) | null Required
  
  The date the template was soft-deleted, or null if active.
- description string
  
  A human-readable description of the template.
  
  Maximum length is 30000.
- fieldCount integer
  
  The number of fields defined in the template.
- fieldDefinitions array[object]
  
  Metadata about each field defined in the template.
  
  Hide fieldDefinitions attributes Show fieldDefinitions attributes object
  
  control string Required
  
  Maximum length is 50.
  
  label string Required
  
  Maximum length is 256.
  
  name string Required
  
  Maximum length is 256.
  
  type string Required
  
  Maximum length is 50.
- isDefault boolean
  
  Whether this is the default template for its owner.
- isEnabled boolean
  
  Whether the template is enabled.
- isLatest boolean Required
  
  Whether this is the latest version of the template.
- lastUsedAt string(date-time)
  
  The date the template was last used to create a case.
- latestVersion integer Required
  
  The latest version number of this template.
- name string Required
  
  The display name of the template.
  
  Maximum length is 100.
- owner string Required
  
  The owning solution (e.g. cases, observability, securitySolution).
  
  Maximum length is 50.
- tags array[string]
  
  The words and phrases that help categorize templates. It can be an empty array.
  
  Not more than 200 elements. Maximum length of each is 256.
- templateId string Required
  
  The unique identifier of the template, shared across all versions.
  
  Maximum length is 36.
- templateVersion integer Required
  
  The version number of this template revision.
- usageCount integer
  
  The number of times this template has been used to create a case.
401 application/json

Authorization information is missing or invalid.
Hide response attributes Show response attributes object
- error string
- message string
- statusCode integer
404 application/json

The template was not found.
Hide response attributes Show response attributes object
- error string
- message string
- statusCode integer

GET /api/cases/templates/{template_id}

curl \
 --request GET 'https://localhost:5601/api/cases/templates/9da1ea2a-09f8-4d0e-bf9d-09bf8c9d0f42' \
 --header "Authorization: $API_KEY"

Response examples (200)

{
  "definition": {},
  "definitionString": "fields: []",
  "deletedAt": null,
  "isLatest": true,
  "latestVersion": 1,
  "name": "My Template",
  "owner": "cases",
  "templateId": "9da1ea2a-09f8-4d0e-bf9d-09bf8c9d0f42",
  "templateVersion": 1
}

Response examples (401)

{
  "error": "Unauthorized",
  "message": "Unable to authenticate with the provided credentials.",
  "statusCode": 401
}

Response examples (404)

{
  "error": "Not Found",
  "message": "Saved object [cases-template/9da1ea2a-09f8-4d0e-bf9d-09bf8c9d0f42] not found",
  "statusCode": 404
}