Update case settings

Base URL
https://{kibana_url}
Auth

Updates setting details such as the closure type, custom fields, templates, and the default connector for cases. Connectors are used to interface with external systems. You must create a connector before you can use it in your cases. You must have all privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on where the case was created.

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

configurationId string required

An identifier for the configuration.

Example: 3297a0f0-b5ec-11ec-b141-0fdb20a7f9a9

Header parameters

kbn-xsrf string required

Cross-site request forgery protection

Request body

closure_type enum

Indicates whether a case is automatically closed when it is pushed to external systems (close-by-pushing) or not automatically closed (close-by-user).

Values: close-by-pushing close-by-user
extractObservables boolean

Indicates whether observables (for example, IPs, hashes, and URLs) are automatically extracted from case comments and events. Observable extraction is available only for Security cases. For Stack and Observability cases, changing it to true returns a 400 error. A request that keeps an already stored true is accepted.

version string required

The version of the connector. To retrieve the version value, use the get configuration API.

workflowTags string[] · max items: 100

Workflow tags that limit which workflows appear in Cases workflow selectors. An empty array shows all workflows.

Responses

Indicates a successful call.

application/json
closure_type enum

Indicates whether a case is automatically closed when it is pushed to external systems (close-by-pushing) or not automatically closed (close-by-user).

Values: close-by-pushing close-by-user
created_at string · format: date-time
error string nullable
extractObservables boolean

Indicates whether observables (for example, IPs, hashes, and URLs) are automatically extracted from case comments and events.

id string
owner enum

The application that owns the cases: Stack Management, Observability, or Elastic Security.

Values: cases observability securitySolution
templates object[] deprecated

Configuration-embedded templates. Deprecated: use the templates API (GET /api/cases/templates) and case extended_fields instead.

Same fields as templates
updated_at string · format: date-time nullable
version string
workflowTags string[] · max items: 100

Workflow tags that limit which workflows appear in Cases workflow selectors. An empty array shows all workflows.

Base URL
https://{kibana_url}