Create a case template Technical preview

POST /api/cases/templates
Api key auth Basic auth

Spaces method and path for this operation:

post /s/{space_id}/api/cases/templates

Refer to Spaces for more information.

Creates a case template from a YAML definition. You must have the "Manage templates" sub-privilege for the Cases feature of the owning solution. Set dry_run=true to run the full validation (body, YAML definition, name uniqueness, authorization) without creating anything. Requires the Cases feature to be enabled in the space.

Query parameters

  • dry_run boolean

    When true, validates the request without creating the template and returns {"valid": true}.

    Default value is false.

application/json

Body Required

  • definition string Required

    The template definition as a YAML string: case defaults (name, severity, category, tags, assignees, connector, settings) and a fields array of inline field definitions or $ref entries pointing into the owner's field library. Stored field values appear on cases under extended_fields keys shaped <field_name>_as_<storage_type>.

    Maximum length is 30000.

  • description string

    A description of the template.

    Maximum length is 1000.

  • isEnabled boolean

    Disabled templates are hidden from the case creation flow.

    Default value is true.

  • name string

    The template identity name, unique per owner (case-insensitive). May be omitted when the YAML definition provides a case-default title (name:), which is then used as the identity name.

    Minimum length is 1, maximum length is 50.

  • owner string Required

    The application that owns the cases: Stack Management, Observability, or Elastic Security.

    Values are cases, observability, or securitySolution.

  • tags array[string]

    The words and phrases that help categorize templates. It can be an empty array.

    Not more than 200 elements. Maximum length of each is 256.

Responses

  • 200 application/json

    Indicates a successful call. Returns the created template, or {"valid": true} for a dry run.

    One of:
    Cases_template_v2_response object Template write dry run response object
  • 400 application/json

    The request body, YAML definition, or template name is invalid, or a resource limit was exceeded (max 200 templates per owner, max 200 fields per template).

    Hide response attributes Show response attributes object
    • error string
    • message string
    • statusCode integer
  • 401 application/json

    Authorization information is missing or invalid.

    Hide response attributes Show response attributes object
    • error string
    • message string
    • statusCode integer
  • 403 application/json

    The user does not have the manage templates privilege for the owner.

    Hide response attributes Show response attributes object
    • error string
    • message string
    • statusCode integer
  • 409 application/json

    A template with the same name already exists for the owner.

    Hide response attributes Show response attributes object
    • error string
    • message string
    • statusCode integer
POST /api/cases/templates 
curl \
 --request POST 'https://localhost:5601/api/cases/templates' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --data '"{\n  \"definition\": \"name: Security incident\\nseverity: high\\ntags: [security]\\nfields:\\n  - name: priority\\n    label: Priority\\n    type: keyword\\n    control: SELECT_BASIC\\n    metadata:\\n      options: [low, medium, high]\\n      default: medium\\n\",\n  \"description\": \"Default template for security incidents.\",\n  \"isEnabled\": true,\n  \"name\": \"Security incident\",\n  \"owner\": \"cases\",\n  \"tags\": [\n    \"security\"\n  ]\n}"'
Request example 
{
  "definition": "name: Security incident\nseverity: high\ntags: [security]\nfields:\n  - name: priority\n    label: Priority\n    type: keyword\n    control: SELECT_BASIC\n    metadata:\n      options: [low, medium, high]\n      default: medium\n",
  "description": "Default template for security incidents.",
  "isEnabled": true,
  "name": "Security incident",
  "owner": "cases",
  "tags": [
    "security"
  ]
}
Response examples (200) 
{
  "definition": {},
  "definitionString": "fields: []",
  "deletedAt": null,
  "isLatest": true,
  "latestVersion": 1,
  "name": "My Template",
  "owner": "cases",
  "templateId": "9da1ea2a-09f8-4d0e-bf9d-09bf8c9d0f42",
  "templateVersion": 1
}
{
  "valid": true
}
Response examples (400) 
{
  "error": "Bad Request",
  "message": "A template cannot define more than 200 fields.",
  "statusCode": 400
}
Response examples (401) 
{
  "error": "Unauthorized",
  "message": "Unable to authenticate with the provided credentials.",
  "statusCode": 401
}
Response examples (403) 
{
  "error": "Forbidden",
  "message": "Unauthorized to access cases",
  "statusCode": 403
}
Response examples (409) 
{
  "error": "Conflict",
  "message": "Template name \"Security incident\" already exists for owner \"cases\"",
  "statusCode": 409
}