Get caseedit

Returns the specified case.

Console supports only Elasticsearch APIs. Console doesn’t allow interactions with Kibana APIs. You must use curl or another HTTP tool instead. For more information, refer to Run Elasticsearch API requests.

Request URLedit

GET <kibana host>:<port>/api/cases/<case ID>

URL partsedit

The URL must include the case ID of the case you are retrieving. Call Find cases to retrieve case IDs.

URL query parametersedit

Name Type Description Required



Determines whether case comments are returned.

No, defaults to true.

Example requestedit

Returns case ID a18b38a0-71b0-11ea-a0b2-c51ea50a58e2 without comments:

GET api/cases/a18b38a0-71b0-11ea-a0b2-c51ea50a58e2?includeComments=false

Response codeedit

Indicates a successful call.

Response payloadedit

The requested case JSON object.

Response exampleedit

  "id": "a18b38a0-71b0-11ea-a0b2-c51ea50a58e2",
  "version": "Wzk4LDFd",
  "comments": [],
  "totalComment": 0,
  "closed_at": null,
  "closed_by": null,
  "created_at": "2020-03-29T11:30:02.658Z",
  "created_by": {
    "email": "",
    "full_name": "Alan Hunley",
    "username": "ahunley"
  "external_service": null,
  "updated_at": "2020-03-29T12:01:50.244Z",
  "updated_by": {
    "full_name": "Classified",
    "email": "",
    "username": "M"
  "description": "James Bond clicked on a highly suspicious email banner advertising cheap holidays for underpaid civil servants. Operation bubblegum is active. Repeat - operation bubblegum is now active!",
  "title": "This case will self-destruct in 5 seconds",
  "status": "open",
  "connector": {
    "id": "131d4448-abe0-4789-939d-8ef60680b498",
    "name": "My connector",
    "type": ".jira",
    "fields": {
      "issueType": "10006",
      "priority": "High",
  "settings": {
    "syncAlerts": true
  "owner": "securitySolution",
  "tags": [
    "social engineering",