Elastic Stack

Elastic Stack (ELK Stack) Cases API

Cases are used to open and track issues. You can add assignees and tags to your cases, set their severity and status, and add alerts, comments, and visualizations. You can also send cases to external incident management systems by configuring connectors.

GitHub OpenAPI

Operations 29

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

DELETE /api/cases Delete one or more cases · Delete cases #
Ask an LLM
“How do I permanently delete several Kibana cases at once?”
“Does deleting a case also remove its comments and attachments?”
Tell an agent destructive · confirm first
Delete cases {ids}.
Permanently remove the case with ID {ids}.
PATCH /api/cases Update fields on existing cases · Update cases #
Ask an LLM
“How do I close a case or change its status programmatically?”
“Can I bulk-update severity or title on several existing cases in one call?”
Tell an agent
Apply these case updates {cases}.
Mark the existing cases in {cases} as closed.
POST /api/cases Open a new case · Create a case #
Ask an LLM
“How do I open a new security or observability case in Kibana from a script?”
“Can I set severity, assignees and tags when I first create a case?”
Tell an agent
Open a case titled {title} described as {description}, owned by {owner}, tagged {tags}.
Create a {severity} severity case {title} and assign it to {assignees}.
GET /api/cases/_find Search and filter cases · Search cases #
Ask an LLM
“Which open cases are assigned to me?”
“Can I find critical-severity cases created in the last week?”
Tell an agent
Find cases with status {status} and severity {severity}.
Search cases for {search} tagged {tags}.
GET /api/cases/{caseId} Get a case's details · Get case information #
Ask an LLM
“What's the current status and description of a specific case?”
“Who opened a given case and when?”
Tell an agent
Show me the details of case {caseId}.
Fetch case {caseId} with its title, status and severity.
GET /api/cases/{caseId}/alerts List alerts attached to a case · Get all alerts for a case #
Ask an LLM
“Which detection alerts have been attached to this case?”
“How can I see every alert linked to one case?”
Tell an agent
List all alerts attached to case {caseId}.
Get the alert IDs linked to case {caseId}.
DELETE /api/cases/{caseId}/comments Delete every comment and alert on a case · Delete all case comments and alerts #
Ask an LLM
“How do I wipe all comments and attached alerts from a case in one go?”
“Can I clear a case's entire comment history?”
Tell an agent destructive · confirm first
Delete all comments and alerts from case {caseId}.
Clear the whole comment history on case {caseId}.
PATCH /api/cases/{caseId}/comments Edit an existing case comment or alert · Update a case comment or alert #
Ask an LLM
“How do I fix a typo in a comment I already posted on a case?”
“Can I change an existing alert attachment on a case?”
Tell an agent
Edit an existing comment on case {caseId}.
Update the text of a comment I already posted to case {caseId}.
POST /api/cases/{caseId}/comments Add a comment or alert to a case · Add a case comment or alert #
Ask an LLM
“How do I post a note on a case?”
“Can I attach an alert to a case as a new case attachment?”
Tell an agent
Add a new comment to case {caseId}.
Attach an alert to case {caseId}.
GET /api/cases/{caseId}/comments/_find Page through a case's comments · Find case comments #
Ask an LLM
“What comments have been left on this case, newest first?”
“Can I paginate through a long comment thread on a case?”
Tell an agent
Find comments on case {caseId}, sorted {sortOrder}.
Show page {page} of comments on case {caseId}, {perPage} per page.
DELETE /api/cases/{caseId}/comments/{commentId} Delete a single case comment or alert · Delete a case comment or alert #
Ask an LLM
“How do I remove just one comment from a case?”
“Can I detach a single alert from a case without touching the other comments?”
Tell an agent destructive · confirm first
Delete comment {commentId} from case {caseId}.
Remove only attachment {commentId} on case {caseId}.
GET /api/cases/{caseId}/comments/{commentId} Get one case comment or alert · Get a case comment or alert #
Ask an LLM
“How do I read a single comment on a case by its ID?”
“What does a specific alert attachment on a case contain?”
Tell an agent
Get comment {commentId} on case {caseId}.
Show the attachment {commentId} from case {caseId}.
POST /api/cases/{caseId}/connector/{connectorId}/_push Push a case to an external ticketing system · Push a case to an external service #
Ask an LLM
“How do I send a case to an external incident system like Jira or ServiceNow through its connector?”
“Can I sync the latest case updates to the external service it's linked to?”
Tell an agent
Push case {caseId} through connector {connectorId}.
Sync case {caseId} to the external service behind connector {connectorId}.
GET /api/cases/{caseId}/fields Get fields applicable to an existing case · Get the fields applicable to an existing case #
Ask an LLM
“Which custom fields apply to a case that's already open?”
“What fields can I fill in on this particular case?”
Tell an agent
Get the applicable fields for existing case {caseId}.
List the custom fields that apply to case {caseId}.
POST /api/cases/{caseId}/files Attach a file to a case · Attach a file to a case #
Ask an LLM
“How do I upload a screenshot or log file to a case?”
“Can I set a custom filename when attaching a file to a case?”
Tell an agent
Attach file {file} to case {caseId}.
Upload {file} to case {caseId} named {filename}.
GET /api/cases/{caseId}/user_actions/_find Review a case's activity history · Find case activity #
Ask an LLM
“Who changed what on this case and when?”
“Can I filter a case's activity log to only status changes or comments?”
Tell an agent
Show the activity history for case {caseId}.
Find user actions of types {types} on case {caseId}.
GET /api/cases/alerts/{alertId} Find cases that contain an alert · Get cases for an alert #
Ask an LLM
“Which cases is this alert already attached to?”
“Has a given alert been added to any security case yet?”
Tell an agent
Find the cases that include alert {alertId}.
List {owner} cases containing alert {alertId}.
GET /api/cases/configure Get case settings · Get case settings #
Ask an LLM
“How are cases configured to close and which connector do they use by default?”
“What custom fields and templates are set up in case settings?”
Tell an agent
Show the case settings for {owner}.
Get the current case configuration, including default connector and closure type.
POST /api/cases/configure Create case settings · Add case settings #
Ask an LLM
“How do I set up the default connector and closure behaviour for cases the first time?”
“Can I make cases close automatically when they're pushed to an external system?”
Tell an agent
Create case settings for {owner} with closure type {closure_type} and connector {connector}.
Add initial case settings for {owner} with custom fields {customFields}.
PATCH /api/cases/configure/{configurationId} Change existing case settings · Update case settings #
Ask an LLM
“How do I switch the default connector on case settings I already created?”
“Why do I need to pass a version when editing case settings?”
Tell an agent
Update case settings {configurationId} at version {version} to closure type {closure_type}.
Change the connector on configuration {configurationId} (version {version}) to {connector}.
GET /api/cases/configure/connectors/_find List connectors usable by cases · Get case connectors #
Ask an LLM
“Which external connectors can cases be pushed to?”
“What case connectors are available in this space?”
Tell an agent
List the connectors available for cases.
Show which ticketing connectors I can attach to cases.
GET /api/cases/fields Get fields available to new cases · Get the fields applicable to a case #
Ask an LLM
“What fields would a new case have for a given solution before I open it?”
“Which fields does a case template add?”
Tell an agent
Get the fields applicable to {owner} cases.
Show fields a new {owner} case would get from template {templateId}.
GET /api/cases/reporters List users who opened cases · Get case creators #
Ask an LLM
“Who has been opening cases?”
“Can I see the list of case creators for just security cases?”
Tell an agent
List the users who opened cases.
Show case reporters for {owner}.
GET /api/cases/tags List tags used on cases · Get case tags #
Ask an LLM
“What tags are in use across all my cases?”
“Which case tags exist for observability cases?”
Tell an agent
List every tag used on cases.
Get the case tags for {owner}.
GET /api/cases/templates List case templates · Get all case templates #
Ask an LLM
“What case templates have been defined?”
“Can I list only enabled case templates by a certain author?”
Tell an agent
List all case templates.
Search case templates for {search} where enabled is {isEnabled}.
POST /api/cases/templates Create a case template · Create a case template #
Ask an LLM
“How do I create a reusable template for new cases?”
“Can I validate a case template with a dry run before saving it?”
Tell an agent
Create a case template {name} for {owner} with definition {definition}.
Dry-run a new case template for {owner} using definition {definition}.
DELETE /api/cases/templates/{template_id} Delete a case template · Delete a case template #
Ask an LLM
“How do I delete a case template I no longer use?”
“Can I remove a case template by its ID?”
Tell an agent destructive · confirm first
Delete case template {template_id}.
Remove the case template with ID {template_id}.
GET /api/cases/templates/{template_id} Get a case template · Get a case template by ID #
Ask an LLM
“What does a specific case template define?”
“Can I fetch an older version of a case template?”
Tell an agent
Get case template {template_id}.
Show version {version} of case template {template_id}.
PUT /api/cases/templates/{template_id} Update a case template · Update a case template #
Ask an LLM
“How do I change the definition of an existing case template?”
“Can I disable a case template without deleting it?”
Tell an agent
Replace case template {template_id} for {owner} with definition {definition}.
Set isEnabled to {isEnabled} on case template {template_id}.

Documentation

📖
Documentation
https://www.elastic.co/docs/reference/elasticsearch
📖
APIReference
https://www.elastic.co/docs/api/doc/elasticsearch/
📖
Documentation
https://www.elastic.co/docs/reference/kibana
📖
APIReference
https://www.elastic.co/docs/api/doc/kibana/

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/openapi/elk-stack-cases-api-openapi.yml

Other Resources

🔗
SourceCode
https://github.com/elastic/elasticsearch-specification
🔗
SourceCode
https://github.com/elastic/kibana
🔗
ToolCrosswalk
https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/mcp/elk-stack-tool-crosswalk.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/elk-stack:elk-stack-cases-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

elk-stack-cases-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  contact:
    name: Kibana Team
  description: The Kibana REST APIs enable you to manage resources such as connectors, data views, and saved objects.
  title: Kibana Cases API
  version: ''
  x-doc-license:
    name: Attribution-NonCommercial-NoDerivatives 4.0 International
    url: https://creativecommons.org/licenses/by-nc-nd/4.0/
  x-feedbackLink:
    label: Feedback
    url: https://github.com/elastic/docs-content/issues/new?assignees=&labels=feedback%2Ccommunity&projects=&template=api-feedback.yaml&title=%5BFeedback%5D%3A+
servers:
- url: https://{kibana_url}
  variables:
    kibana_url:
      default: localhost:5601
security:
- apiKeyAuth: []
- basicAuth: []
tags:


# --- truncated at 32 KB (207 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/openapi/elk-stack-cases-api-openapi.yml