Create a case template

Base URL
https://{kibana_url}
  • POST /api/cases/templates
Auth

Creates a case template from a YAML definition. You must have the "Manage templates" sub-privilege for the Cases feature of the owning solution. Set dry_run=true to run the full validation (body, YAML definition, name uniqueness, authorization) without creating anything. Requires the Cases feature to be enabled in the space.

Query parameters

dry_run boolean · default: false

When true, validates the request without creating the template and returns {"valid": true}.

Request body

definition string · max length: 30000 required

The template definition as a YAML string: case defaults (name, severity, category, tags, assignees, connector, settings) and a fields array of inline field definitions or $ref entries pointing into the owner's field library. Stored field values appear on cases under extended_fields keys shaped <field_name>_as_<storage_type>.

description string · max length: 1000

A description of the template.

isEnabled boolean · default: true

Disabled templates are hidden from the case creation flow.

name string · min length: 1 · max length: 50

The template identity name, unique per owner (case-insensitive). May be omitted when the YAML definition provides a case-default title (name:), which is then used as the identity name.

owner enum required

The application that owns the cases: Stack Management, Observability, or Elastic Security.

Values: cases observability securitySolution
tags string[] · max items: 200

The words and phrases that help categorize templates. It can be an empty array.

Responses

Indicates a successful call. Returns the created template, or {"valid": true} for a dry run.

application/json
One of:

A case template (v2).

author string · max length: 1000

The username of the template author.

definition object required

The parsed template definition.

definitionString string · max length: 30000 required

The raw YAML definition string.

deletedAt string · format: date-time required nullable

The date the template was soft-deleted, or null if active.

description string · max length: 30000

A human-readable description of the template.

fieldCount integer

The number of fields defined in the template.

isDefault boolean

Whether this is the default template for its owner.

isEnabled boolean

Whether the template is enabled.

isLatest boolean required

Whether this is the latest version of the template.

lastUsedAt string · format: date-time

The date the template was last used to create a case.

latestVersion integer required

The latest version number of this template.

name string · max length: 100 required

The display name of the template.

owner string · max length: 50 required

The owning solution (e.g. cases, observability, securitySolution).

tags string[] · max items: 200

The words and phrases that help categorize templates. It can be an empty array.

templateId string · max length: 36 required

The unique identifier of the template, shared across all versions.

templateVersion integer required

The version number of this template revision.

usageCount integer

The number of times this template has been used to create a case.

Base URL
https://{kibana_url}