Query parameters

• page integer

  The page number to return.

  Default value is 1.

• perPage integer

  The number of items to return. Limited to 100 items.

  Maximum value is 100. Default value is 20.

• sortField string

  Determines which field is used to sort the results.

  Values are templateId, name, templateVersion, owner, deletedAt, author, usageCount, fieldCount, lastUsedAt, isDefault, or isLatest. Default value is name.

• sortOrder string

  Determines the sort order.

  Values are asc or desc. Default value is desc.

• search string

  An Elasticsearch simple_query_string query that filters the objects in the response.

• owner string | array[string]

  A filter to limit the response to a specific set of applications. If this parameter is omitted, the response contains information about all the cases that the user has access to read.

  Values are cases, observability, or securitySolution.

• tags string | array[string]

  Filters the returned templates by tags.

• author string | array[string]

  Filters the returned templates by author username.

• isEnabled boolean

  Filters the returned templates by their enabled state.

Responses

• 200 application/json

  Indicates a successful call.

  Hide response attributes Show response attributes object

  • page integer Required

    The page number of the returned results.

  • perPage integer Required

    The number of results per page.

  • templates array[object] Required
    Hide templates attributes Show templates attributes object

    • author string

      The username of the template author.

      Maximum length is 1000.

    • definition Required

      The parsed template definition.

    • definitionString string Required

      The raw YAML definition string.

      Maximum length is 30000.

    • deletedAt string(date-time) | null Required

      The date the template was soft-deleted, or null if active.

    • description string

      A human-readable description of the template.

      Maximum length is 30000.

    • fieldCount integer

      The number of fields defined in the template.

    • fieldDefinitions array[object]

      Metadata about each field defined in the template.

      Hide fieldDefinitions attributes Show fieldDefinitions attributes object

      • control string Required

        Maximum length is 50.

      • label string Required

        Maximum length is 256.

      • name string Required

        Maximum length is 256.

      • type string Required

        Maximum length is 50.

    • isDefault boolean

      Whether this is the default template for its owner.

    • isEnabled boolean

      Whether the template is enabled.

    • isLatest boolean Required

      Whether this is the latest version of the template.

    • lastUsedAt string(date-time)

      The date the template was last used to create a case.

    • latestVersion integer Required

      The latest version number of this template.

    • name string Required

      The display name of the template.

      Maximum length is 100.

    • owner string Required

      The owning solution (e.g. cases, observability, securitySolution).

      Maximum length is 50.

    • tags array[string]

      The words and phrases that help categorize templates. It can be an empty array.

      Not more than 200 elements. Maximum length of each is 256.

    • templateId string Required

      The unique identifier of the template, shared across all versions.

      Maximum length is 36.

    • templateVersion integer Required

      The version number of this template revision.

    • usageCount integer

      The number of times this template has been used to create a case.

    • fieldSearchMatches boolean Required

      Whether the search query matched a field name in this template.

  • total integer Required

    The total number of templates matching the query.

• 401 application/json

  Authorization information is missing or invalid.

  Hide response attributes Show response attributes object

  • error string
  • message string
  • statusCode integer