Elastic Stack (ELK Stack) Connectors API

openapi: 3.2.0
info:
  contact:
    name: Kibana Team
  description: 'The Kibana REST APIs enable you to manage resources such as connectors, data views, and saved objects.

    The API calls are stateless.

    Each request that you make happens in isolation from other calls and must include all of the necessary information for Kibana to fulfill the

    request.

    API requests return JSON output, which is a format that is machine-readable and works well for automation.


    To interact with Kibana APIs, use the following operations:


    - GET: Fetches the information.

    - PATCH: Applies partial modifications to the existing information.

    - POST: Adds new information.

    - PUT: Updates the existing information.

    - DELETE: Removes the information.


    You can prepend any Kibana API endpoint with `kbn:` and run the request in **Dev Tools → Console**.

    For example:


    ```

    GET kbn:/api/data_views

    ```


    For more information about the console, refer to [Run API requests](https://www.elastic.co/docs/explore-analyze/query-filter/tools/console).


    NOTE: Access to internal Kibana API endpoints will be restricted in Kibana version 9.0. Please move any integrations to publicly documented APIs.


    ## Documentation source and versions


    This documentation is derived from the `main` branch of the [kibana](https://github.com/elastic/kibana) repository.

    It is provided under license [Attribution-NonCommercial-NoDerivatives 4.0 International](https://creativecommons.org/licenses/by-nc-nd/4.0/).


    This documentation contains work-in-progress information for future Elastic Stack releases.

    '
  title: Kibana Connectors API
  version: ''
  x-doc-license:
    name: Attribution-NonCommercial-NoDerivatives 4.0 International
    url: https://creativecommons.org/licenses/by-nc-nd/4.0/
  x-feedbackLink:
    label: Feedback
    url: https://github.com/elastic/docs-content/issues/new?assignees=&labels=feedback%2Ccommunity&projects=&template=api-feedback.yaml&title=%5BFeedback%5D%3A+
servers:
- url: https://{kibana_url}
  variables:
    kibana_url:
      default: localhost:5601
security:
- apiKeyAuth: []
- basicAuth: []
tags:
- name: connectors
  description: 'Connectors provide a central place to store connection information for services and integrations with Elastic or third party systems. Alerting rules can use connectors to run actions when rule conditions are met.

    '
  externalDocs:
    description: Connector documentation
    url: https://www.elastic.co/docs/reference/kibana/connectors-kibana
  x-displayName: Connectors
paths:
  /api/actions/connector_types:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/actions/connector_types</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        You do not need any Kibana feature privileges to run this API.'
      operationId: get-actions-connector-types
      parameters:
      - description: A filter to limit the retrieved connector types to those that support a specific feature (such as alerting or cases).
        in: query
        name: feature_id
        required: false
        schema:
          maxLength: 100
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                items:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_connector_type_response'
                type: array
              examples:
                getConnectorTypesServerlessResponse:
                  $ref: '#/components/examples/get_connector_types_generativeai_response'
          description: Indicates a successful call.
        '403':
          description: Indicates that this call is forbidden.
      summary: Get connector types
      tags:
      - connectors
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/actions/connector/_oauth_callback:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/actions/connector/_oauth_callback</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Handles the OAuth 2.0 authorization code callback from external providers. Exchanges the authorization code for access and refresh tokens.<br/><br/>[Required authorization] Route required privileges: actions:oauth.'
      operationId: get-actions-connector-oauth-callback
      parameters:
      - description: The authorization code returned by the OAuth provider.
        in: query
        name: code
        required: false
        schema:
          type: string
      - description: The state parameter for CSRF protection.
        in: query
        name: state
        required: false
        schema:
          type: string
      - description: Error code if the authorization failed.
        in: query
        name: error
        required: false
        schema:
          type: string
      - description: Human-readable error description.
        in: query
        name: error_description
        required: false
        schema:
          type: string
      - description: Session state from the OAuth provider (e.g., Microsoft).
        in: query
        name: session_state
        required: false
        schema:
          type: string
      responses:
        '200':
          description: Returns an HTML callback page.
        '302':
          description: Redirects to the return URL with authorization result query parameters.
        '401':
          description: User is not authenticated.
      summary: Handle OAuth callback
      tags:
      - connectors
      x-state: Added in 9.4.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/actions/connector/{connectorId}/oauth/start:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/actions/connector/{connectorId}/oauth/start</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        [Required authorization] Route required privileges: actions:oauth.'
      operationId: get-actions-connector-connectorid-oauth-start
      parameters:
      - description: An identifier for the connector.
        in: path
        name: connectorId
        required: true
        schema:
          maxLength: 36
          type: string
      responses:
        '302':
          description: Redirects to the identity provider to begin OAuth authorization.
        '400':
          description: Invalid request, such as a disallowed returnUrl.
        '401':
          description: User is not authenticated.
        '404':
          description: Connector not found.
      summary: Start OAuth authorization (redirects to the identity provider)
      tags:
      - connectors
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/actions/connector/{id}:
    delete:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/actions/connector/{id}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        WARNING: When you delete a connector, it cannot be recovered.'
      operationId: delete-actions-connector-id
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      - description: An identifier for the connector.
        in: path
        name: id
        required: true
        schema:
          type: string
      responses:
        '204':
          description: Indicates a successful call.
        '403':
          description: Indicates that this call is forbidden.
      summary: Delete a connector
      tags:
      - connectors
      x-metaTags:
      - content: Kibana
        name: product_name
    get:
      operationId: get-actions-connector-id
      parameters:
      - description: An identifier for the connector.
        in: path
        name: id
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_connector_response'
              examples:
                getConnectorResponse:
                  $ref: '#/components/examples/get_connector_response'
          description: Indicates a successful call.
        '403':
          description: Indicates that this call is forbidden.
      summary: Get connector information
      tags:
      - connectors
      x-metaTags:
      - content: Kibana
        name: product_name
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/actions/connector/{id}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.'
    post:
      operationId: post-actions-connector-id
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      - description: An identifier for the connector.
        in: path
        name: id
        required: true
        schema:
          maxLength: 36
          minLength: 1
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_new_connector'
            examples:
              createEmailConnectorRequest:
                $ref: '#/components/examples/create_email_connector_request'
              createIndexConnectorRequest:
                $ref: '#/components/examples/create_index_connector_request'
              createWebhookConnectorRequest:
                $ref: '#/components/examples/create_webhook_connector_request'
              createXmattersConnectorRequest:
                $ref: '#/components/examples/create_xmatters_connector_request'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_connector_response'
              examples:
                createEmailConnectorResponse:
                  $ref: '#/components/examples/create_email_connector_response'
                createIndexConnectorResponse:
                  $ref: '#/components/examples/create_index_connector_response'
                createWebhookConnectorResponse:
                  $ref: '#/components/examples/create_webhook_connector_response'
                createXmattersConnectorResponse:
                  $ref: '#/components/examples/get_connector_response'
          description: Indicates a successful call.
        '403':
          description: Indicates that this call is forbidden.
      summary: Create a connector
      tags:
      - connectors
      x-metaTags:
      - content: Kibana
        name: product_name
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/actions/connector/{id}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.'
    put:
      operationId: put-actions-connector-id
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      - description: An identifier for the connector.
        in: path
        name: id
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_update_connector'
            examples:
              updateIndexConnectorRequest:
                $ref: '#/components/examples/update_index_connector_request'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_connector_response'
          description: Indicates a successful call.
        '403':
          description: Indicates that this call is forbidden.
      summary: Update a connector
      tags:
      - connectors
      x-metaTags:
      - content: Kibana
        name: product_name
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/actions/connector/{id}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.'
  /api/actions/connector/{id}/_execute:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/actions/connector/{id}/_execute</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        You can use this API to test an action that involves interaction with Kibana services or integrations with third-party systems.'
      operationId: post-actions-connector-id-execute
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      - description: An identifier for the connector.
        in: path
        name: id
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_connector_execute_request'
            examples:
              runIndexConnectorRequest:
                $ref: '#/components/examples/run_index_connector_request'
              runJiraConnectorRequest:
                $ref: '#/components/examples/run_jira_connector_request'
              runServerLogConnectorRequest:
                $ref: '#/components/examples/run_servicenow_itom_connector_request'
              runSlackConnectorRequest:
                $ref: '#/components/examples/run_slack_api_connector_request'
              runSwimlaneConnectorRequest:
                $ref: '#/components/examples/run_swimlane_connector_request'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_connector_response'
              examples:
                runIndexConnectorResponse:
                  $ref: '#/components/examples/run_index_connector_response'
                runJiraConnectorResponse:
                  $ref: '#/components/examples/run_jira_connector_response'
                runServerLogConnectorResponse:
                  $ref: '#/components/examples/run_server_log_connector_response'
                runServiceNowITOMConnectorResponse:
                  $ref: '#/components/examples/run_servicenow_itom_connector_response'
                runSlackConnectorResponse:
                  $ref: '#/components/examples/run_slack_api_connector_response'
                runSwimlaneConnectorResponse:
                  $ref: '#/components/examples/run_swimlane_connector_response'
          description: Indicates a successful call.
        '403':
          description: Indicates that this call is forbidden.
      summary: Run a connector
      tags:
      - connectors
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/actions/connectors:
    get:
      operationId: get-actions-connectors
      parameters: []
      responses:
        '200':
          content:
            application/json:
              schema:
                items:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_connector_response_with_references_count'
                type: array
              examples:
                getConnectorsResponse:
                  $ref: '#/components/examples/get_connectors_response'
          description: Indicates a successful call.
        '403':
          description: Indicates that this call is forbidden.
      summary: Get all connectors
      tags:
      - connectors
      x-metaTags:
      - content: Kibana
        name: product_name
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/actions/connectors</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.'
components:
  schemas:
    d3security_config:
      title: Connector request properties for a D3 Security connector
      description: Defines properties for connectors when type is `.d3security`.
      type: object
      required:
      - url
      properties:
        url:
          type: string
          description: 'The D3 Security API request URL. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts.

            '
    email_config:
      title: Connector request properties for an email connector
      description: Defines properties for connectors when type is `.email`.
      required:
      - from
      type: object
      properties:
        allowHtml:
          description: 'When `true`, the connector can send emails with HTML-formatted content in the body. Defaults to `false`. This option is unavailable when `service` is `elastic_cloud`.

            '
          default: false
          type: boolean
        clientId:
          description: 'The client identifier, which is a part of OAuth 2.0 client credentials authentication, in GUID format. If `service` is `exchange_server`, this property is required.

            '
          type:
          - string
          - 'null'
        from:
          description: 'The from address for all emails sent by the connector. It must be specified in `user@host-name` format.

            '
          type: string
        hasAuth:
          description: 'Specifies whether a user and password are required inside the secrets configuration.

            '
          default: true
          type: boolean
        host:
          description: 'The host name of the service provider. If the `service` is `elastic_cloud` (for Elastic Cloud notifications) or one of Nodemailer''s well-known email service providers, this property is ignored. If `service` is `other`, this property must be defined.

            '
          type: string
        oauthTokenUrl:
          type:
          - string
          - 'null'
        port:
          description: 'The port to connect to on the service provider. If the `service` is `elastic_cloud` (for Elastic Cloud notifications) or one of Nodemailer''s well-known email service providers, this property is ignored. If `service` is `other`, this property must be defined.

            '
          type: integer
        secure:
          description: 'Specifies whether the connection to the service provider will use TLS. If the `service` is `elastic_cloud` (for Elastic Cloud notifications) or one of Nodemailer''s well-known email service providers, this property is ignored.

            '
          type: boolean
        service:
          description: 'The name of the email service.

            '
          type: string
          enum:
          - elastic_cloud
          - exchange_server
          - gmail
          - other
          - outlook365
          - ses
        tenantId:
          description: 'The tenant identifier, which is part of OAuth 2.0 client credentials authentication, in GUID format. If `service` is `exchange_server`, this property is required.

            '
          type:
          - string
          - 'null'
    run_issues:
      title: The issues subaction
      type: object
      required:
      - subAction
      - subActionParams
      description: The `issues` subaction for Jira connectors.
      properties:
        subAction:
          type: string
          description: The action to test.
          enum:
          - issues
        subActionParams:
          type: object
          required:
          - title
          properties:
            title:
              type: string
              description: The title of the Jira issue.
    thehive_config:
      title: Connector request properties for a TheHive connector
      description: Defines configuration properties for connectors when type is `.thehive`.
      type: object
      required:
      - url
      properties:
        organisation:
          type: string
          description: 'The organisation in TheHive that will contain the alerts or cases. By default, the connector uses the default organisation of the user account that created the API key.

            '
        url:
          type: string
          description: 'The instance URL in TheHive. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts.

            '
    thehive_secrets:
      title: Connector secrets properties for a TheHive connector
      description: Defines secrets for connectors when type is `.thehive`.
      required:
      - apiKey
      type: object
      properties:
        apiKey:
          type: string
          description: The API key for authentication in TheHive.
    verification_mode:
      title: Verification mode
      type: string
      enum:
      - certificate
      - full
      - none
      default: full
      description: 'Controls the verification of certificates. Use `full` to validate that the certificate has an issue date within the `not_before` and `not_after` dates, chains to a trusted certificate authority (CA), and has a hostname or IP address that matches the names within the certificate. Use `certificate` to validate the certificate and verify that it is signed by a trusted authority; this option does not check the certificate hostname. Use `none` to skip certificate validation.

        '
    run_issue:
      title: The issue subaction
      type: object
      required:
      - subAction
      description: The `issue` subaction for Jira connectors.
      properties:
        subAction:
          type: string
          description: The action to test.
          enum:
          - issue
        subActionParams:
          type: object
          required:
          - id
          properties:
            id:
              type: string
              description: The Jira issue identifier.
              example: 71778
    tines_config:
      title: Connector request properties for a Tines connector
      description: Defines properties for connectors when type is `.tines`.
      type: object
      required:
      - url
      properties:
        url:
          description: 'The Tines tenant URL. If you are using the `xpack.actions.allowedHosts` setting, make sure this hostname is added to the allowed hosts.

            '
          type: string
    sentinelone_secrets:
      title: Connector secrets properties for a SentinelOne connector
      description: Defines secrets for connectors when type is `.sentinelone`.
      type: object
      required:
      - token
      properties:
        token:
          description: The A SentinelOne API token.
          type: string
    run_message_slack:
      title: Slack connector parameters
      description: 'Test an action that sends a message to Slack. It is applicable only when the connector type is `.slack`.

        '
      type: object
      required:
      - message
      properties:
        message:
          type: string
          description: The Slack message text, which cannot contain Markdown, images, or other advanced formatting.
    torq_config:
      title: Connector request properties for a Torq connector
      description: Defines properties for connectors when type is `.torq`.
      type: object
      required:
      - webhookIntegrationUrl
      properties:
        webhookIntegrationUrl:
          description: The endpoint URL of the Elastic Security integration in Torq.
          type: string
    run_closealert:
      title: The closeAlert subaction
      type: object
      required:
      - subAction
      - subActionParams
      description: The `closeAlert` subaction for Opsgenie connectors.
      properties:
        subAction:
          type: string
          description: The action to test.
          enum:
          - closeAlert
        subActionParams:
          type: object
          required:
          - alias
          properties:
            alias:
              type: string
              description: The unique identifier used for alert deduplication in Opsgenie. The alias must match the value used when creating the alert.
            note:
              type: string
              description: Additional information for the alert.
            source:
              type: string
              description: The display name for the source of the alert.
            user:
              type: string
              description: The display name for the owner.
    d3security_secrets:
      title: Connector secrets properties for a D3 Security connector
      description: Defines secrets for connectors when type is `.d3security`.
      required:
      - token
      type: object
      properties:
        token:
          type: string
          description: The D3 Security token.
    run_acknowledge_resolve_pagerduty:
      title: PagerDuty connector parameters
      description: Test an action that acknowledges or resolves a PagerDuty alert.
      type: object
      required:
      - dedupKey
      - eventAction
      properties:
        dedupKey:
          description: The deduplication key for the PagerDuty alert.
          type: string
          maxLength: 255
        eventAction:
          description: The type of event.
          type: string
          enum:
          - acknowledge
          - resolve
    bedrock_config:
      title: Connector request properties for an Amazon Bedrock connector
      description: Defines properties for connectors when type is `.bedrock`.
      type: object
      required:
      - apiUrl
      properties:
        apiUrl:
          type: string
          description: The Amazon Bedrock request URL.
        region:
          type: string
          description: 'Optional AWS region for request signing. Required when using a custom endpoint URL that does not include the region in the hostname (for example, `us-west-1`).

            '
        defaultModel:
          type: string
          description: 'The generative artificial intelligence model for Amazon Bedrock to use. Current support is for the Anthropic Claude models.

            '
          default: us.anthropic.claude-sonnet-4-5-20250929-v1:0
    cases_webhook_config:
      title: Connector request properties for Webhook - Case Management connector
      required:
      - createIncidentJson
      - createIncidentResponseKey
      - createIncidentUrl
      - getIncidentResponseExternalTitleKey
      - getIncidentUrl
      - updateIncidentJson
      - updateIncidentUrl
      - viewIncidentUrl
      description: Defines properties for connectors when type is `.cases-webhook`.
      type: object
      properties:
        authType:
          $ref: '#/components/schemas/auth_type'
        ca:
          $ref: '#/components/schemas/ca'
        certType:
          $ref: '#/components/schemas/cert_type'
        createCommentJson:
          type: string
          description: 'A JSON payload sent to the create comment URL to create a case comment. You can use variables to add Kibana Cases data to the payload. The required variable is `case.comment`. Due to Mustache template variables (the text enclosed in triple braces, for example, `{{{case.title}}}`), the JSON is not validated when you create the connector. The JSON is validated once the Mustache variables have been placed when the REST method runs. Manually ensure that the JSON is valid, disregarding the Mustache variables, so the later validation will pass.

            '
          example: '{"body": {{{case.comment}}}}'
        createCommentMethod:
          type: string
          description: 'The REST API HTTP request method to create a case comment in the third-party system. Valid values are `patch`, `post`, and `put`.

            '
          default: put
          enum:
          - patch
          - post
          - put
        createCommentUrl:
          type: string
          description: 'The REST API URL to create a case comment by ID in the third-party system. You can use a variable to add the external system ID to the URL. If you are using the `xpack.actions.allowedHosts setting`, add the hostname to the allowed hosts.

            '
          example: https://example.com/issue/{{{external.system.id}}}/comment
        createIncidentJson:
          type: string
          description: 'A JSON payload sent to the create case URL to create a case. You can use variables to add case data to the payload. Required variables are `case.title` and `case.description`. Due to Mustache template variables (which is the text enclosed in triple braces, for example, `{{{case.title}}}`), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid to avoid future validation errors; disregard Mustache variables during your review.

            '
          example: '{"fields": {"summary": {{{case.title}}},"description": {{{case.description}}},"labels": {{{case.tags}}}}}'
        createIncidentMethod:
          type: string
          description: 'The REST API HTTP request method to create a case in the third-party system. Valid values are `patch`, `post`, and `put`.

            '
          enum:
          - patch
          - post
          - put
          default: post
        createIncidentResponseKey:
          type: string
          description: The JSON key in the create external case response that contains the case ID.
        createIncidentUrl:
          type: string
          description: 'The REST API URL to create a case in the third-party system. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts.

            '
        getIncidentResponseExternalTitleKey:
          type: string
          description: The JSON key in get external case response that contains the case title.
        getIncidentUrl:
          type: string
          description: 'The REST API URL to get the case by ID from the third-party system. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts. You can use a variable to add the external system ID to the URL. Due to Mustache template variables (the text enclosed in triple braces, for example, `{{{case.title}}}`), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid, disregarding the Mustache variables, so the later validation will pass.

            '
          example: https://example.com/issue/{{{external.system.id}}}
        hasAuth:
          $ref: '#/components/schemas/has_auth'
        headers:
          type:
          - object
          - 'null'
          additionalProperties:
            type: string
          description: 'A set of key-value pairs sent as headers with the request URLs for the create case, update case, get case, and create comment methods.

            '
        updateIncidentJson:
          type: string
          description: 'The JSON payload sent to the update case URL to update the case. You can use variables to add Kibana Cases data to the pa

# --- truncated at 32 KB (118 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/openapi/elk-stack-connectors-api-openapi.yml