Cases are used to open and track issues. You can add assignees and tags to your cases, set their severity and status, and add alerts, comments, and visualizations. You can also send cases to external incident management systems by configuring connectors.
openapi: 3.0.3
info:
contact:
name: Kibana Team
description: 'The Kibana REST APIs enable you to manage resources such as connectors, data views, and saved objects.
The API calls are stateless.
Each request that you make happens in isolation from other calls and must include all of the necessary information for Kibana to fulfill the
request.
API requests return JSON output, which is a format that is machine-readable and works well for automation.
To interact with Kibana APIs, use the following operations:
- GET: Fetches the information.
- PATCH: Applies partial modifications to the existing information.
- POST: Adds new information.
- PUT: Updates the existing information.
- DELETE: Removes the information.
You can prepend any Kibana API endpoint with `kbn:` and run the request in **Dev Tools → Console**.
For example:
```
GET kbn:/api/data_views
```
For more information about the console, refer to [Run API requests](https://www.elastic.co/docs/explore-analyze/query-filter/tools/console).
NOTE: Access to internal Kibana API endpoints will be restricted in Kibana version 9.0. Please move any integrations to publicly documented APIs.
## Documentation source and versions
This documentation is derived from the `main` branch of the [kibana](https://github.com/elastic/kibana) repository.
It is provided under license [Attribution-NonCommercial-NoDerivatives 4.0 International](https://creativecommons.org/licenses/by-nc-nd/4.0/).
This documentation contains work-in-progress information for future Elastic Stack releases.
'
title: Kibana APIs Actions cases API
version: ''
x-doc-license:
name: Attribution-NonCommercial-NoDerivatives 4.0 International
url: https://creativecommons.org/licenses/by-nc-nd/4.0/
x-feedbackLink:
label: Feedback
url: https://github.com/elastic/docs-content/issues/new?assignees=&labels=feedback%2Ccommunity&projects=&template=api-feedback.yaml&title=%5BFeedback%5D%3A+
servers:
- url: https://{kibana_url}
variables:
kibana_url:
default: localhost:5601
security:
- apiKeyAuth: []
- basicAuth: []
tags:
- description: 'Cases are used to open and track issues. You can add assignees and tags to your cases, set their severity and status, and add alerts, comments, and visualizations. You can also send cases to external incident management systems by configuring connectors.
'
name: cases
externalDocs:
description: Cases documentation
url: https://www.elastic.co/docs/explore-analyze/alerts-cases/cases
x-displayName: Cases
paths:
/api/cases:
delete:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb delete">delete</span> <span class="operation-path">/s/{space_id}/api/cases</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
You must have `read` or `all` privileges and the `delete` sub-feature privilege for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you''re deleting.
'
operationId: deleteCaseDefaultSpace
parameters:
- $ref: '#/components/parameters/Cases_kbn_xsrf'
- $ref: '#/components/parameters/Cases_ids'
responses:
'204':
description: Indicates a successful call.
'401':
content:
application/json:
examples:
response401:
$ref: '#/components/examples/Cases_response_401'
schema:
$ref: '#/components/schemas/Cases_response_4xx'
description: Authorization information is missing or invalid.
summary: Delete cases
tags:
- cases
x-codeSamples:
- label: curl
lang: curl
source: "curl \\\n --request DELETE 'https://localhost:5601/api/cases?ids=%5B%22030e6e34-6470-4001-864f-b229511ad188%22%2C%22e662ff34-0493-4538-b9d1-6706ced02ff2%22%5D' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\" \\\n --header \"kbn-xsrf: true\"\n"
- label: Console
lang: console
source: 'DELETE kbn:/api/cases?ids=["030e6e34-6470-4001-864f-b229511ad188","e662ff34-0493-4538-b9d1-6706ced02ff2"]
'
x-metaTags:
- content: Kibana
name: product_name
patch:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb patch">patch</span> <span class="operation-path">/s/{space_id}/api/cases</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you''re updating.
'
operationId: updateCaseDefaultSpace
parameters:
- $ref: '#/components/parameters/Cases_kbn_xsrf'
requestBody:
content:
application/json:
examples:
updateCaseRequest:
$ref: '#/components/examples/Cases_update_case_request'
schema:
$ref: '#/components/schemas/Cases_update_case_request'
responses:
'200':
content:
application/json:
examples:
updateCaseResponse:
$ref: '#/components/examples/Cases_update_case_response'
schema:
items:
$ref: '#/components/schemas/Cases_case_response_properties'
type: array
description: Indicates a successful call.
'401':
content:
application/json:
examples:
response401:
$ref: '#/components/examples/Cases_response_401'
schema:
$ref: '#/components/schemas/Cases_response_4xx'
description: Authorization information is missing or invalid.
summary: Update cases
tags:
- cases
x-metaTags:
- content: Kibana
name: product_name
post:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb post">post</span> <span class="operation-path">/s/{space_id}/api/cases</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you''re creating.
'
operationId: createCaseDefaultSpace
parameters:
- $ref: '#/components/parameters/Cases_kbn_xsrf'
requestBody:
content:
application/json:
examples:
createCaseRequest:
$ref: '#/components/examples/Cases_create_case_request'
schema:
$ref: '#/components/schemas/Cases_create_case_request'
required: true
responses:
'200':
content:
application/json:
examples:
createCaseResponse:
$ref: '#/components/examples/Cases_create_case_response'
schema:
$ref: '#/components/schemas/Cases_case_response_properties'
description: Indicates a successful call.
'401':
content:
application/json:
examples:
response401:
$ref: '#/components/examples/Cases_response_401'
schema:
$ref: '#/components/schemas/Cases_response_4xx'
description: Authorization information is missing or invalid.
summary: Create a case
tags:
- cases
x-metaTags:
- content: Kibana
name: product_name
/api/cases/_find:
get:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb get">get</span> <span class="operation-path">/s/{space_id}/api/cases/_find</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you''re seeking.
'
operationId: findCasesDefaultSpace
parameters:
- $ref: '#/components/parameters/Cases_assignees_filter'
- $ref: '#/components/parameters/Cases_category'
- $ref: '#/components/parameters/Cases_defaultSearchOperator'
- $ref: '#/components/parameters/Cases_from'
- $ref: '#/components/parameters/Cases_owner_filter'
- $ref: '#/components/parameters/Cases_page_index'
- $ref: '#/components/parameters/Cases_page_size'
- $ref: '#/components/parameters/Cases_reporters'
- $ref: '#/components/parameters/Cases_search'
- $ref: '#/components/parameters/Cases_searchFields'
- $ref: '#/components/parameters/Cases_severity'
- $ref: '#/components/parameters/Cases_sortField'
- $ref: '#/components/parameters/Cases_sort_order'
- $ref: '#/components/parameters/Cases_status'
- $ref: '#/components/parameters/Cases_tags'
- $ref: '#/components/parameters/Cases_to'
responses:
'200':
content:
application/json:
examples:
findCaseResponse:
$ref: '#/components/examples/Cases_find_case_response'
schema:
type: object
properties:
cases:
items:
$ref: '#/components/schemas/Cases_case_response_properties'
maxItems: 10000
type: array
count_closed_cases:
type: integer
count_in_progress_cases:
type: integer
count_open_cases:
type: integer
page:
type: integer
per_page:
type: integer
total:
type: integer
description: Indicates a successful call.
'401':
content:
application/json:
examples:
response401:
$ref: '#/components/examples/Cases_response_401'
schema:
$ref: '#/components/schemas/Cases_response_4xx'
description: Authorization information is missing or invalid.
summary: Search cases
tags:
- cases
x-metaTags:
- content: Kibana
name: product_name
/api/cases/{caseId}:
get:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb get">get</span> <span class="operation-path">/s/{space_id}/api/cases/{caseId}</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Returns case details. The response does not include a comments property; use the find case comments API to retrieve comments. The totalComment field reflects the actual number of user comments on the case. You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you''re seeking.
'
operationId: getCaseDefaultSpace
parameters:
- $ref: '#/components/parameters/Cases_case_id'
responses:
'200':
content:
application/json:
examples:
getDefaultCaseResponse:
$ref: '#/components/examples/Cases_get_case_response'
getDefaultObservabilityCaseResponse:
$ref: '#/components/examples/Cases_get_case_observability_response'
schema:
$ref: '#/components/schemas/Cases_case_response_get_case'
description: Indicates a successful call.
'401':
content:
application/json:
examples:
response401:
$ref: '#/components/examples/Cases_response_401'
schema:
$ref: '#/components/schemas/Cases_response_4xx'
description: Authorization information is missing or invalid.
summary: Get case information
tags:
- cases
x-metaTags:
- content: Kibana
name: product_name
/api/cases/{caseId}/alerts:
get:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb get">get</span> <span class="operation-path">/s/{space_id}/api/cases/{caseId}/alerts</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you''re seeking.
'
operationId: getCaseAlertsDefaultSpace
parameters:
- $ref: '#/components/parameters/Cases_case_id'
responses:
'200':
content:
application/json:
examples:
getCaseAlertsResponse:
$ref: '#/components/examples/Cases_get_case_alerts_response'
schema:
items:
$ref: '#/components/schemas/Cases_alert_response_properties'
type: array
description: Indicates a successful call.
'401':
content:
application/json:
examples:
response401:
$ref: '#/components/examples/Cases_response_401'
schema:
$ref: '#/components/schemas/Cases_response_4xx'
description: Authorization information is missing or invalid.
summary: Get all alerts for a case
tags:
- cases
x-state: Technical preview
x-metaTags:
- content: Kibana
name: product_name
/api/cases/{caseId}/comments:
delete:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb delete">delete</span> <span class="operation-path">/s/{space_id}/api/cases/{caseId}/comments</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Deletes all comments and alerts from a case. You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you''re deleting.
'
operationId: deleteCaseCommentsDefaultSpace
parameters:
- $ref: '#/components/parameters/Cases_kbn_xsrf'
- $ref: '#/components/parameters/Cases_case_id'
responses:
'204':
description: Indicates a successful call.
'401':
content:
application/json:
examples:
response401:
$ref: '#/components/examples/Cases_response_401'
schema:
$ref: '#/components/schemas/Cases_response_4xx'
description: Authorization information is missing or invalid.
summary: Delete all case comments and alerts
tags:
- cases
x-codeSamples:
- label: curl
lang: curl
source: "curl \\\n --request DELETE 'https://localhost:5601/api/cases/9c235210-6834-11ea-a78c-6ffb38a34414/comments' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"kbn-xsrf: true\"\n"
- label: Console
lang: console
source: 'DELETE kbn:/api/cases/9c235210-6834-11ea-a78c-6ffb38a34414/comments
'
x-metaTags:
- content: Kibana
name: product_name
patch:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb patch">patch</span> <span class="operation-path">/s/{space_id}/api/cases/{caseId}/comments</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you''re updating. NOTE: You cannot change the comment type or the owner of a comment.
'
operationId: updateCaseCommentDefaultSpace
parameters:
- $ref: '#/components/parameters/Cases_kbn_xsrf'
- $ref: '#/components/parameters/Cases_case_id'
requestBody:
content:
application/json:
examples:
updateCaseCommentRequest:
$ref: '#/components/examples/Cases_update_comment_request'
schema:
$ref: '#/components/schemas/Cases_update_case_comment_request'
required: true
responses:
'200':
content:
application/json:
examples:
updateCaseCommentResponse:
$ref: '#/components/examples/Cases_update_comment_response'
schema:
$ref: '#/components/schemas/Cases_case_response_properties'
description: Indicates a successful call.
'401':
content:
application/json:
examples:
response401:
$ref: '#/components/examples/Cases_response_401'
schema:
$ref: '#/components/schemas/Cases_response_4xx'
description: Authorization information is missing or invalid.
summary: Update a case comment or alert
tags:
- cases
x-metaTags:
- content: Kibana
name: product_name
post:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb post">post</span> <span class="operation-path">/s/{space_id}/api/cases/{caseId}/comments</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you''re creating. NOTE: Each case can have a maximum of 1,000 alerts.
'
operationId: addCaseCommentDefaultSpace
parameters:
- $ref: '#/components/parameters/Cases_kbn_xsrf'
- $ref: '#/components/parameters/Cases_case_id'
requestBody:
content:
application/json:
examples:
createCaseCommentRequest:
$ref: '#/components/examples/Cases_add_comment_request'
schema:
$ref: '#/components/schemas/Cases_add_case_comment_request'
required: true
responses:
'200':
content:
application/json:
examples:
createCaseCommentResponse:
$ref: '#/components/examples/Cases_add_comment_response'
schema:
$ref: '#/components/schemas/Cases_case_response_properties'
description: Indicates a successful call.
'401':
content:
application/json:
examples:
response401:
$ref: '#/components/examples/Cases_response_401'
schema:
$ref: '#/components/schemas/Cases_response_4xx'
description: Authorization information is missing or invalid.
summary: Add a case comment or alert
tags:
- cases
x-metaTags:
- content: Kibana
name: product_name
/api/cases/{caseId}/comments/_find:
get:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb get">get</span> <span class="operation-path">/s/{space_id}/api/cases/{caseId}/comments/_find</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Retrieves a paginated list of comments for a case. You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases with the comments you''re seeking.
'
operationId: findCaseCommentsDefaultSpace
parameters:
- $ref: '#/components/parameters/Cases_case_id'
- $ref: '#/components/parameters/Cases_page_index'
- $ref: '#/components/parameters/Cases_page_size'
- $ref: '#/components/parameters/Cases_sort_order'
responses:
'200':
content:
application/json:
examples:
findCaseCommentsResponse:
$ref: '#/components/examples/Cases_find_case_comments_response'
schema:
$ref: '#/components/schemas/Cases_find_comments_response'
description: Indicates a successful call.
'401':
content:
application/json:
examples:
response401:
$ref: '#/components/examples/Cases_response_401'
schema:
$ref: '#/components/schemas/Cases_response_4xx'
description: Authorization information is missing or invalid.
summary: Find case comments
tags:
- cases
x-metaTags:
- content: Kibana
name: product_name
/api/cases/{caseId}/comments/{commentId}:
delete:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb delete">delete</span> <span class="operation-path">/s/{space_id}/api/cases/{caseId}/comments/{commentId}</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you''re deleting.
'
operationId: deleteCaseCommentDefaultSpace
parameters:
- $ref: '#/components/parameters/Cases_kbn_xsrf'
- $ref: '#/components/parameters/Cases_case_id'
- $ref: '#/components/parameters/Cases_comment_id'
responses:
'204':
description: Indicates a successful call.
'401':
content:
application/json:
examples:
response401:
$ref: '#/components/examples/Cases_response_401'
schema:
$ref: '#/components/schemas/Cases_response_4xx'
description: Authorization information is missing or invalid.
summary: Delete a case comment or alert
tags:
- cases
x-codeSamples:
- label: curl
lang: curl
source: "curl \\\n --request DELETE 'https://localhost:5601/api/cases/9c235210-6834-11ea-a78c-6ffb38a34414/comments/71ec1870-725b-11ea-a0b2-c51ea50a58e2' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"kbn-xsrf: true\"\n"
- label: Console
lang: console
source: 'DELETE kbn:/api/cases/9c235210-6834-11ea-a78c-6ffb38a34414/comments/71ec1870-725b-11ea-a0b2-c51ea50a58e2
'
x-metaTags:
- content: Kibana
name: product_name
get:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb get">get</span> <span class="operation-path">/s/{space_id}/api/cases/{caseId}/comments/{commentId}</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases with the comments you''re seeking.
'
operationId: getCaseCommentDefaultSpace
parameters:
- $ref: '#/components/parameters/Cases_case_id'
- $ref: '#/components/parameters/Cases_comment_id'
responses:
'200':
content:
application/json:
examples:
getCaseCommentResponse:
$ref: '#/components/examples/Cases_get_comment_response'
schema:
oneOf:
- $ref: '#/components/schemas/Cases_alert_comment_response_properties'
- $ref: '#/components/schemas/Cases_user_comment_response_properties'
description: Indicates a successful call.
'401':
content:
application/json:
examples:
response401:
$ref: '#/components/examples/Cases_response_401'
schema:
$ref: '#/components/schemas/Cases_response_4xx'
description: Authorization information is missing or invalid.
summary: Get a case comment or alert
tags:
- cases
x-metaTags:
- content: Kibana
name: product_name
/api/cases/{caseId}/connector/{connectorId}/_push:
post:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb post">post</span> <span class="operation-path">/s/{space_id}/api/cases/{caseId}/connector/{connectorId}/_push</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
You must have `all` privileges for the **Actions and Connectors** feature in the **Management** section of the Kibana feature privileges. You must also have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you''re pushing.
'
operationId: pushCaseDefaultSpace
parameters:
- $ref: '#/components/parameters/Cases_case_id'
- $ref: '#/components/parameters/Cases_connector_id'
- $ref: '#/components/parameters/Cases_kbn_xsrf'
requestBody:
content:
application/json:
examples:
pushCaseRequest:
summary: Push a case to an external service. No request body is required.
value: null
schema:
nullable: true
type: object
responses:
'200':
content:
application/json:
examples:
pushCaseResponse:
$ref: '#/components/examples/Cases_push_case_response'
schema:
$ref: '#/components/schemas/Cases_case_response_properties'
description: Indicates a successful call.
'401':
content:
application/json:
examples:
response401:
$ref: '#/components/examples/Cases_response_401'
schema:
$ref: '#/components/schemas/Cases_response_4xx'
description: Authorization information is missing or invalid.
summary: Push a case to an external service
tags:
- cases
x-metaTags:
- content: Kibana
name: product_name
/api/cases/{caseId}/files:
post:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb post">post</span> <span class="operation-path">/s/{space_id}/api/cases/{caseId}/files</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Attach a file to a case. You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you''re updating. The request must include:
- The `Content-Type: multipart/form-data` HTTP header.
- The location of the file that is being uploaded.
'
operationId: addCaseFileDefaultSpace
parameters:
- $ref: '#/components/parameters/Cases_kbn_xsrf'
- $ref: '#/components/parameters/Cases_case_id'
requestBody:
content:
multipart/form-data:
examples:
addCaseFileRequest:
summary: Attach a plain text file named "my_attachment".
value:
filename: my_attachment
schema:
$ref: '#/components/schemas/Cases_add_case_file_request'
required: true
responses:
'200':
content:
application/json:
examples:
addCaseFileResponse:
$ref: '#/components/examples/Cases_add_comment_response'
schema:
$ref: '#/components/schemas/Cases_case_response_properties'
description: Indicates a successful call.
'401':
content:
application/json:
examples:
response401:
$ref: '#/components/examples/Cases_response_401'
schema:
$ref: '#/components/schemas/Cases_response_4xx'
description: Authorization information is missing or invalid.
summary: Attach a file to a case
tags:
- cases
x-codeSamples:
- label: curl
lang: curl
source: "curl \\\n --request POST 'https://localhost:5601/api/cases/9c235210-6834-11ea-a78c-6ffb38a34414/files' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"kbn-xsrf: true\" \\\n --form \"file=@/path/to/my_attachment.txt\" \\\n --form \"filename=my_attachment\"\n"
x-metaTags:
- content: Kibana
name: product_name
/api/cases/{caseId}/user_actions/_find:
get:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb get">get</span> <span class="operation-path">/s/{space_id}/api/cases/{caseId}/user_actions/_find</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Retrieves a paginated list of user activity for a case. You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you''re seeking.
'
operationId: findCaseActivityDefaultSpace
parameters:
- $ref: '#/components/parameters/Cases_case_id'
- $ref: '#/components/parameters/Cases_page_index'
- $ref: '#/components/parameters/Cases_page_size'
- $ref: '#/components/parameters/Cases_sort_order'
- $ref: '#/components/parameters/Cases_user_action_types'
responses:
'200':
content:
application/json:
examples:
findCaseActivityResponse:
$ref: '#/components/examples/Cases_find_case_activity_response'
schema:
type: object
properties:
page:
type: integer
perPage:
type: integer
total:
type: integer
userActions:
items:
$ref: '#/components/schemas/Cases_user_actions_find_response_properties'
maxItems: 10000
type: array
description: Indicates a successful call.
'401':
content:
application/json:
examples:
response401:
$ref: '#/components/examples/Cases_response_401'
schema:
$ref: '#/components/schemas/Cases_response_4xx'
description: Authorization information is missing or invalid.
summary: Find case activity
tags:
- cases
x-metaTags:
- content: Kibana
name: product_name
/
# --- truncated at 32 KB (177 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/kibana/refs/heads/main/openapi/kibana-cases-api-openapi.yml