From 0274cc732f2c2ea17a71def444c007368370a648 Mon Sep 17 00:00:00 2001 From: Lisa Cawley Date: Tue, 17 Oct 2023 09:56:03 -0700 Subject: [PATCH] [8.8] [DOCS] Remove OAS API previews (#168761) (#169142) # Backport This will backport the following commits from `main` to `8.8`: - [[DOCS] Remove OAS API previews (#168761)](https://github.com/elastic/kibana/pull/168761) ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport) --- docs/api-generated/README.md | 42 - .../cases/case-apis-passthru.asciidoc | 5020 ----------------- docs/api-generated/cases/case-apis.asciidoc | 10 - .../connector-apis-passthru.asciidoc | 2478 -------- .../connectors/connector-apis.asciidoc | 10 - .../ml-apis-passthru.asciidoc | 205 - .../machine-learning/ml-apis.asciidoc | 10 - .../rules/rule-apis-passthru.asciidoc | 3456 ------------ docs/api-generated/rules/rule-apis.asciidoc | 10 - docs/api-generated/template/index.mustache | 170 - .../actions-and-connectors/create.asciidoc | 2 +- .../actions-and-connectors/delete.asciidoc | 2 +- .../actions-and-connectors/execute.asciidoc | 2 +- docs/api/actions-and-connectors/get.asciidoc | 2 +- .../actions-and-connectors/get_all.asciidoc | 2 +- docs/api/actions-and-connectors/list.asciidoc | 2 +- .../actions-and-connectors/update.asciidoc | 2 +- docs/api/alerting/create_rule.asciidoc | 2 +- docs/api/alerting/delete_rule.asciidoc | 2 +- docs/api/alerting/disable_rule.asciidoc | 2 +- docs/api/alerting/enable_rule.asciidoc | 2 +- docs/api/alerting/find_rules.asciidoc | 2 +- docs/api/alerting/get_rules.asciidoc | 2 +- docs/api/alerting/health.asciidoc | 2 +- docs/api/alerting/list_rule_types.asciidoc | 2 +- docs/api/alerting/mute_alert.asciidoc | 2 +- docs/api/alerting/mute_all_alerts.asciidoc | 2 +- docs/api/alerting/unmute_alert.asciidoc | 2 +- docs/api/alerting/unmute_all_alerts.asciidoc | 2 +- docs/api/alerting/update_rule.asciidoc | 2 +- docs/api/cases/cases-api-add-comment.asciidoc | 2 +- docs/api/cases/cases-api-create.asciidoc | 2 +- .../api/cases/cases-api-delete-cases.asciidoc | 2 +- .../cases/cases-api-delete-comments.asciidoc | 2 +- .../cases-api-find-case-activity.asciidoc | 2 +- docs/api/cases/cases-api-find-cases.asciidoc | 2 +- .../cases/cases-api-find-connectors.asciidoc | 2 +- docs/api/cases/cases-api-get-alerts.asciidoc | 2 +- .../cases-api-get-case-activity.asciidoc | 2 +- docs/api/cases/cases-api-get-case.asciidoc | 2 +- .../cases-api-get-cases-by-alert.asciidoc | 2 +- .../api/cases/cases-api-get-comments.asciidoc | 2 +- .../cases-api-get-configuration.asciidoc | 2 +- .../cases/cases-api-get-reporters.asciidoc | 2 +- docs/api/cases/cases-api-get-status.asciidoc | 2 +- docs/api/cases/cases-api-get-tags.asciidoc | 2 +- docs/api/cases/cases-api-push.asciidoc | 2 +- .../cases-api-set-configuration.asciidoc | 2 +- .../cases/cases-api-update-comment.asciidoc | 2 +- .../cases-api-update-configuration.asciidoc | 2 +- docs/api/cases/cases-api-update.asciidoc | 2 +- docs/api/machine-learning/sync.asciidoc | 2 +- docs/apis.asciidoc | 17 - docs/index.asciidoc | 2 - docs/redirects.asciidoc | 6 + 55 files changed, 48 insertions(+), 11472 deletions(-) delete mode 100644 docs/api-generated/README.md delete mode 100644 docs/api-generated/cases/case-apis-passthru.asciidoc delete mode 100644 docs/api-generated/cases/case-apis.asciidoc delete mode 100644 docs/api-generated/connectors/connector-apis-passthru.asciidoc delete mode 100644 docs/api-generated/connectors/connector-apis.asciidoc delete mode 100644 docs/api-generated/machine-learning/ml-apis-passthru.asciidoc delete mode 100644 docs/api-generated/machine-learning/ml-apis.asciidoc delete mode 100644 docs/api-generated/rules/rule-apis-passthru.asciidoc delete mode 100644 docs/api-generated/rules/rule-apis.asciidoc delete mode 100644 docs/api-generated/template/index.mustache delete mode 100644 docs/apis.asciidoc diff --git a/docs/api-generated/README.md b/docs/api-generated/README.md deleted file mode 100644 index 97fd32119b8bc..0000000000000 --- a/docs/api-generated/README.md +++ /dev/null @@ -1,42 +0,0 @@ -# OpenAPI (Experimental) - -Open API specifications (OAS) exist in JSON or YAML format for some Kibana features, -though they are experimental and may be incomplete or change later. - -A preview of the API specifications can be added to the Kibana Guide by using -the following process: - -. Install [OpenAPI Generator](https://openapi-generator.tech/docs/installation), -or a similar tool that can generate HTML output from OAS. - -. Optionally validate the specifications by using the commands listed in the appropriate readmes. - -. Generate HTML output. For example: - - ``` - openapi-generator-cli generate -g html -i $GIT_HOME/kibana/x-pack/plugins/alerting/docs/openapi/bundled.yaml -o $GIT_HOME/kibana/docs/api-generated/rules -t $GIT_HOME/kibana/docs/api-generated/template - - openapi-generator-cli generate -g html -i $GIT_HOME/kibana/x-pack/plugins/cases/docs/openapi/bundled.yaml -o $GIT_HOME/kibana/docs/api-generated/cases -t $GIT_HOME/kibana/docs/api-generated/template - - openapi-generator-cli generate -g html -i $GIT_HOME/kibana/x-pack/plugins/actions/docs/openapi/bundled.yaml -o $GIT_HOME/kibana/docs/api-generated/connectors -t $GIT_HOME/kibana/docs/api-generated/template - - openapi-generator-cli generate -g html -i $GIT_HOME/kibana/x-pack/plugins/ml/common/openapi/ml_apis_v3.yaml -o $GIT_HOME/kibana/docs/api-generated/machine-learning -t $GIT_HOME/kibana/docs/api-generated/template - ``` - -. Rename the output files. For example: - ``` - mv $GIT_HOME/kibana/docs/api-generated/rules/index.html $GIT_HOME/kibana/docs/api-generated/rules/rule-apis-passthru.asciidoc - mv $GIT_HOME/kibana/docs/api-generated/cases/index.html $GIT_HOME/kibana/docs/api-generated/cases/case-apis-passthru.asciidoc - mv $GIT_HOME/kibana/docs/api-generated/connectors/index.html $GIT_HOME/kibana/docs/api-generated/connectors/connector-apis-passthru.asciidoc - mv $GIT_HOME/kibana/docs/api-generated/machine-learning/index.html $GIT_HOME/kibana/docs/api-generated/machine-learning/ml-apis-passthru.asciidoc - ``` - -. If you're creating a new set of API output, you will need to have a page that incorporates the output by using passthrough blocks. For more information, refer to [Asciidoctor docs](https://docs.asciidoctor.org/asciidoc/latest/pass/pass-block/) - -. Verify the output by building the Kibana documentation. At this time, the output is added as a technical preview in the appendix. - -## Known issues - -- Some OAS 3.0 features such as `anyOf`, `oneOf`, and `allOf` might not display properly in the preview. These are on the [Short-term roadmap](https://openapi-generator.tech/docs/roadmap/) at this time. - - diff --git a/docs/api-generated/cases/case-apis-passthru.asciidoc b/docs/api-generated/cases/case-apis-passthru.asciidoc deleted file mode 100644 index 366b5e7f39e58..0000000000000 --- a/docs/api-generated/cases/case-apis-passthru.asciidoc +++ /dev/null @@ -1,5020 +0,0 @@ -//// -This content is generated from the open API specification. -Any modifications made to this file will be overwritten. -//// - -++++ -
-

Access

-
    -
  1. APIKey KeyParamName:ApiKey KeyInQuery:false KeyInHeader:true
    2. -
  2. HTTP Basic Authentication
    3. -
- -

Methods

- [ Jump to Models ] - -

Table of Contents

-
-

Cases

- - -

Cases

-
-
- Up - 
post /s/{spaceId}/api/cases/{caseId}/comments
-
Adds a comment or alert to a case. (addCaseComment)
-
You must have all privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're creating. NOTE: Each case can have a maximum of 1,000 alerts.
- -

Path parameters

-
-
caseId (required)
- -
Path Parameter — The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded. default: null
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- -

Consumes

- This API call consumes the following media types via the Content-Type request header: -
    -
  • application/json
    • -
- -

Request body

-
-
add_case_comment_request add_case_comment_request (required)
- -
Body Parameter —
- -
- -

Request headers

-
-
kbn-xsrf (required)
- -
Header Parameter — Cross-site request forgery protection default: null
- -
- - - -

Return type

-
- case_response_properties - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "owner" : "cases",
-  "totalComment" : 0,
-  "settings" : {
-    "syncAlerts" : true
-  },
-  "totalAlerts" : 0,
-  "closed_at" : "2000-01-23T04:56:07.000+00:00",
-  "comments" : [ null, null ],
-  "assignees" : [ {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  } ],
-  "created_at" : "2022-05-13T09:16:17.416Z",
-  "description" : "A case description.",
-  "title" : "Case title 1",
-  "created_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "version" : "WzUzMiwxXQ==",
-  "closed_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "tags" : [ "tag-1" ],
-  "duration" : 120,
-  "updated_at" : "2000-01-23T04:56:07.000+00:00",
-  "updated_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
-  "external_service" : {
-    "external_title" : "external_title",
-    "pushed_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "external_url" : "external_url",
-    "pushed_at" : "2000-01-23T04:56:07.000+00:00",
-    "connector_id" : "connector_id",
-    "external_id" : "external_id",
-    "connector_name" : "connector_name"
-  }
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - case_response_properties -

401

- Authorization information is missing or invalid. - 4xx_response -
-
-
-
- Up - 
post /api/cases/{caseId}/comments
-
Adds a comment or alert to a case in the default space. (addCaseCommentDefaultSpace)
-
You must have all privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're creating. NOTE: Each case can have a maximum of 1,000 alerts.
- -

Path parameters

-
-
caseId (required)
- -
Path Parameter — The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded. default: null
-
- -

Consumes

- This API call consumes the following media types via the Content-Type request header: -
    -
  • application/json
    • -
- -

Request body

-
-
add_case_comment_request add_case_comment_request (required)
- -
Body Parameter —
- -
- -

Request headers

-
-
kbn-xsrf (required)
- -
Header Parameter — Cross-site request forgery protection default: null
- -
- - - -

Return type

-
- case_response_properties - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "owner" : "cases",
-  "totalComment" : 0,
-  "settings" : {
-    "syncAlerts" : true
-  },
-  "totalAlerts" : 0,
-  "closed_at" : "2000-01-23T04:56:07.000+00:00",
-  "comments" : [ null, null ],
-  "assignees" : [ {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  } ],
-  "created_at" : "2022-05-13T09:16:17.416Z",
-  "description" : "A case description.",
-  "title" : "Case title 1",
-  "created_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "version" : "WzUzMiwxXQ==",
-  "closed_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "tags" : [ "tag-1" ],
-  "duration" : 120,
-  "updated_at" : "2000-01-23T04:56:07.000+00:00",
-  "updated_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
-  "external_service" : {
-    "external_title" : "external_title",
-    "pushed_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "external_url" : "external_url",
-    "pushed_at" : "2000-01-23T04:56:07.000+00:00",
-    "connector_id" : "connector_id",
-    "external_id" : "external_id",
-    "connector_name" : "connector_name"
-  }
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - case_response_properties -

401

- Authorization information is missing or invalid. - 4xx_response -
-
-
-
- Up - 
post /s/{spaceId}/api/cases
-
Creates a case. (createCase)
-
You must have all privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're creating.
- -

Path parameters

-
-
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- -

Consumes

- This API call consumes the following media types via the Content-Type request header: -
    -
  • application/json
    • -
- -

Request body

-
-
create_case_request create_case_request (required)
- -
Body Parameter —
- -
- -

Request headers

-
-
kbn-xsrf (required)
- -
Header Parameter — Cross-site request forgery protection default: null
- -
- - - -

Return type

-
- case_response_properties - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "owner" : "cases",
-  "totalComment" : 0,
-  "settings" : {
-    "syncAlerts" : true
-  },
-  "totalAlerts" : 0,
-  "closed_at" : "2000-01-23T04:56:07.000+00:00",
-  "comments" : [ null, null ],
-  "assignees" : [ {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  } ],
-  "created_at" : "2022-05-13T09:16:17.416Z",
-  "description" : "A case description.",
-  "title" : "Case title 1",
-  "created_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "version" : "WzUzMiwxXQ==",
-  "closed_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "tags" : [ "tag-1" ],
-  "duration" : 120,
-  "updated_at" : "2000-01-23T04:56:07.000+00:00",
-  "updated_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
-  "external_service" : {
-    "external_title" : "external_title",
-    "pushed_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "external_url" : "external_url",
-    "pushed_at" : "2000-01-23T04:56:07.000+00:00",
-    "connector_id" : "connector_id",
-    "external_id" : "external_id",
-    "connector_name" : "connector_name"
-  }
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - case_response_properties -

401

- Authorization information is missing or invalid. - 4xx_response -
-
-
-
- Up - 
post /api/cases
-
Creates a case in the default space (createCaseDefaultSpace)
-
You must have all privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're creating.
- - -

Consumes

- This API call consumes the following media types via the Content-Type request header: -
    -
  • application/json
    • -
- -

Request body

-
-
create_case_request create_case_request (required)
- -
Body Parameter —
- -
- -

Request headers

-
-
kbn-xsrf (required)
- -
Header Parameter — Cross-site request forgery protection default: null
- -
- - - -

Return type

-
- case_response_properties - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "owner" : "cases",
-  "totalComment" : 0,
-  "settings" : {
-    "syncAlerts" : true
-  },
-  "totalAlerts" : 0,
-  "closed_at" : "2000-01-23T04:56:07.000+00:00",
-  "comments" : [ null, null ],
-  "assignees" : [ {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  } ],
-  "created_at" : "2022-05-13T09:16:17.416Z",
-  "description" : "A case description.",
-  "title" : "Case title 1",
-  "created_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "version" : "WzUzMiwxXQ==",
-  "closed_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "tags" : [ "tag-1" ],
-  "duration" : 120,
-  "updated_at" : "2000-01-23T04:56:07.000+00:00",
-  "updated_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
-  "external_service" : {
-    "external_title" : "external_title",
-    "pushed_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "external_url" : "external_url",
-    "pushed_at" : "2000-01-23T04:56:07.000+00:00",
-    "connector_id" : "connector_id",
-    "external_id" : "external_id",
-    "connector_name" : "connector_name"
-  }
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - case_response_properties -

401

- Authorization information is missing or invalid. - 4xx_response -
-
-
-
- Up - 
delete /s/{spaceId}/api/cases
-
Deletes one or more cases. (deleteCase)
-
You must have read or all privileges and the delete sub-feature privilege for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases you're deleting.
- -

Path parameters

-
-
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- - - -

Request headers

-
-
kbn-xsrf (required)
- -
Header Parameter — Cross-site request forgery protection default: null
- -
- -

Query parameters

-
-
ids (required)
- -
Query Parameter — The cases that you want to removed. All non-ASCII characters must be URL encoded. default: null
-
- - - - - - -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

204

- Indicates a successful call. - -

401

- Authorization information is missing or invalid. - 4xx_response -
-
-
-
- Up - 
delete /s/{spaceId}/api/cases/{caseId}/comments/{commentId}
-
Deletes a comment or alert from a case. (deleteCaseComment)
-
You must have all privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases you're deleting.
- -

Path parameters

-
-
caseId (required)
- -
Path Parameter — The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded. default: null
commentId (required)
- -
Path Parameter — The identifier for the comment. To retrieve comment IDs, use the get case or find cases APIs. default: null
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- - - -

Request headers

-
-
kbn-xsrf (required)
- -
Header Parameter — Cross-site request forgery protection default: null
- -
- - - - - - - -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

204

- Indicates a successful call. - -

401

- Authorization information is missing or invalid. - 4xx_response -
-
-
-
- Up - 
delete /api/cases/{caseId}/comments/{commentId}
-
Deletes a comment or alert from a case in the default space. (deleteCaseCommentDefaultSpace)
-
You must have all privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases you're deleting.
- -

Path parameters

-
-
caseId (required)
- -
Path Parameter — The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded. default: null
commentId (required)
- -
Path Parameter — The identifier for the comment. To retrieve comment IDs, use the get case or find cases APIs. default: null
-
- - - -

Request headers

-
-
kbn-xsrf (required)
- -
Header Parameter — Cross-site request forgery protection default: null
- -
- - - - - - - -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

204

- Indicates a successful call. - -

401

- Authorization information is missing or invalid. - 4xx_response -
-
-
-
- Up - 
delete /s/{spaceId}/api/cases/{caseId}/comments
-
Deletes all comments and alerts from a case. (deleteCaseComments)
-
You must have all privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases you're deleting.
- -

Path parameters

-
-
caseId (required)
- -
Path Parameter — The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded. default: null
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- - - -

Request headers

-
-
kbn-xsrf (required)
- -
Header Parameter — Cross-site request forgery protection default: null
- -
- - - - - - - -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

204

- Indicates a successful call. - -

401

- Authorization information is missing or invalid. - 4xx_response -
-
-
-
- Up - 
delete /api/cases/{caseId}/comments
-
Deletes all comments and alerts from a case in the default space. (deleteCaseCommentsDefaultSpace)
-
You must have all privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases you're deleting.
- -

Path parameters

-
-
caseId (required)
- -
Path Parameter — The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded. default: null
-
- - - -

Request headers

-
-
kbn-xsrf (required)
- -
Header Parameter — Cross-site request forgery protection default: null
- -
- - - - - - - -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

204

- Indicates a successful call. - -

401

- Authorization information is missing or invalid. - 4xx_response -
-
-
-
- Up - 
delete /api/cases
-
Deletes one or more cases in the default space. (deleteCaseDefaultSpace)
-
You must have read or all privileges and the delete sub-feature privilege for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases you're deleting.
- - - - -

Request headers

-
-
kbn-xsrf (required)
- -
Header Parameter — Cross-site request forgery protection default: null
- -
- -

Query parameters

-
-
ids (required)
- -
Query Parameter — The cases that you want to removed. All non-ASCII characters must be URL encoded. default: null
-
- - - - - - -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

204

- Indicates a successful call. - -

401

- Authorization information is missing or invalid. - 4xx_response -
-
-
-
- Up - 
get /s/{spaceId}/api/cases/{caseId}/user_actions/_find
-
Finds user activity for a case. (findCaseActivity)
-
You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're seeking.
- -

Path parameters

-
-
caseId (required)
- -
Path Parameter — The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded. default: null
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- - - - -

Query parameters

-
-
page (optional)
- -
Query Parameter — The page number to return. default: 1
perPage (optional)
- -
Query Parameter — The number of user actions to return per page. default: 20
sortOrder (optional)
- -
Query Parameter — Determines the sort order. default: asc
types (optional)
- -
Query Parameter — Determines the types of user actions to return. default: null
-
- - -

Return type

-
- findCaseActivityDefaultSpace_200_response - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "userActions" : [ {
-    "owner" : "cases",
-    "action" : "create",
-    "created_at" : "2022-05-13T09:16:17.416Z",
-    "id" : "22fd3e30-03b1-11ed-920c-974bfa104448",
-    "comment_id" : "578608d0-03b1-11ed-920c-974bfa104448",
-    "type" : "create_case",
-    "created_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "version" : "WzM1ODg4LDFd"
-  }, {
-    "owner" : "cases",
-    "action" : "create",
-    "created_at" : "2022-05-13T09:16:17.416Z",
-    "id" : "22fd3e30-03b1-11ed-920c-974bfa104448",
-    "comment_id" : "578608d0-03b1-11ed-920c-974bfa104448",
-    "type" : "create_case",
-    "created_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "version" : "WzM1ODg4LDFd"
-  } ],
-  "total" : 1,
-  "perPage" : 6,
-  "page" : 0
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - findCaseActivityDefaultSpace_200_response -

401

- Authorization information is missing or invalid. - 4xx_response -
-
-
-
- Up - 
get /api/cases/{caseId}/user_actions/_find
-
Finds user activity for a case in the default space. (findCaseActivityDefaultSpace)
-
You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're seeking.
- -

Path parameters

-
-
caseId (required)
- -
Path Parameter — The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded. default: null
-
- - - - -

Query parameters

-
-
page (optional)
- -
Query Parameter — The page number to return. default: 1
perPage (optional)
- -
Query Parameter — The number of user actions to return per page. default: 20
sortOrder (optional)
- -
Query Parameter — Determines the sort order. default: asc
types (optional)
- -
Query Parameter — Determines the types of user actions to return. default: null
-
- - -

Return type

-
- findCaseActivityDefaultSpace_200_response - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "userActions" : [ {
-    "owner" : "cases",
-    "action" : "create",
-    "created_at" : "2022-05-13T09:16:17.416Z",
-    "id" : "22fd3e30-03b1-11ed-920c-974bfa104448",
-    "comment_id" : "578608d0-03b1-11ed-920c-974bfa104448",
-    "type" : "create_case",
-    "created_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "version" : "WzM1ODg4LDFd"
-  }, {
-    "owner" : "cases",
-    "action" : "create",
-    "created_at" : "2022-05-13T09:16:17.416Z",
-    "id" : "22fd3e30-03b1-11ed-920c-974bfa104448",
-    "comment_id" : "578608d0-03b1-11ed-920c-974bfa104448",
-    "type" : "create_case",
-    "created_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "version" : "WzM1ODg4LDFd"
-  } ],
-  "total" : 1,
-  "perPage" : 6,
-  "page" : 0
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - findCaseActivityDefaultSpace_200_response -

401

- Authorization information is missing or invalid. - 4xx_response -
-
-
-
- Up - 
get /s/{spaceId}/api/cases/configure/connectors/_find
-
Retrieves information about connectors. (findCaseConnectors)
-
In particular, only the connectors that are supported for use in cases are returned. You must have read privileges for the Actions and Connectors feature in the Management section of the Kibana feature privileges.
- -

Path parameters

-
-
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- - - - - - -

Return type

-
- array[findCaseConnectorsDefaultSpace_200_response_inner] - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "isPreconfigured" : true,
-  "isDeprecated" : true,
-  "actionTypeId" : ".none",
-  "referencedByCount" : 0,
-  "name" : "name",
-  "id" : "id",
-  "config" : {
-    "projectKey" : "projectKey",
-    "apiUrl" : "apiUrl"
-  },
-  "isMissingSecrets" : true
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - -

401

- Authorization information is missing or invalid. - 4xx_response -
-
-
-
- Up - 
get /api/cases/configure/connectors/_find
-
Retrieves information about connectors in the default space. (findCaseConnectorsDefaultSpace)
-
In particular, only the connectors that are supported for use in cases are returned. You must have read privileges for the Actions and Connectors feature in the Management section of the Kibana feature privileges.
- - - - - - - -

Return type

-
- array[findCaseConnectorsDefaultSpace_200_response_inner] - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "isPreconfigured" : true,
-  "isDeprecated" : true,
-  "actionTypeId" : ".none",
-  "referencedByCount" : 0,
-  "name" : "name",
-  "id" : "id",
-  "config" : {
-    "projectKey" : "projectKey",
-    "apiUrl" : "apiUrl"
-  },
-  "isMissingSecrets" : true
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - -

401

- Authorization information is missing or invalid. - 4xx_response -
-
-
-
- Up - 
get /s/{spaceId}/api/cases/_find
-
Retrieves a paginated subset of cases. (findCases)
-
You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases you're seeking.
- -

Path parameters

-
-
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- - - - -

Query parameters

-
-
assignees (optional)
- -
Query Parameter — Filters the returned cases by assignees. Valid values are none or unique identifiers for the user profiles. These identifiers can be found by using the suggest user profile API. default: null
defaultSearchOperator (optional)
- -
Query Parameter — he default operator to use for the simple_query_string. default: OR
fields (optional)
- -
Query Parameter — The fields in the entity to return in the response. default: null
from (optional)
- -
Query Parameter — [preview] Returns only cases that were created after a specific date. The date must be specified as a KQL data range or date match expression. This functionality is in technical preview and may be changed or removed in a future release. Elastic will apply best effort to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. default: null
owner (optional)
- -
Query Parameter — A filter to limit the response to a specific set of applications. If this parameter is omitted, the response contains information about all the cases that the user has access to read. default: null
page (optional)
- -
Query Parameter — The page number to return. default: 1
perPage (optional)
- -
Query Parameter — The number of cases to return per page. default: 20
reporters (optional)
- -
Query Parameter — Filters the returned cases by the user name of the reporter. default: null
search (optional)
- -
Query Parameter — An Elasticsearch simple_query_string query that filters the objects in the response. default: null
searchFields (optional)
- -
Query Parameter — The fields to perform the simple_query_string parsed query against. default: null
severity (optional)
- -
Query Parameter — The severity of the case. default: null
sortField (optional)
- -
Query Parameter — Determines which field is used to sort the results. default: createdAt
sortOrder (optional)
- -
Query Parameter — Determines the sort order. default: desc
status (optional)
- -
Query Parameter — Filters the returned cases by state. default: null
tags (optional)
- -
Query Parameter — Filters the returned cases by tags. default: null
to (optional)
- -
Query Parameter — [preview] Returns only cases that were created before a specific date. The date must be specified as a KQL data range or date match expression. This functionality is in technical preview and may be changed or removed in a future release. Elastic will apply best effort to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. default: null
-
- - -

Return type

-
- findCasesDefaultSpace_200_response - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "count_in_progress_cases" : 6,
-  "per_page" : 5,
-  "total" : 2,
-  "cases" : [ {
-    "owner" : "cases",
-    "totalComment" : 0,
-    "settings" : {
-      "syncAlerts" : true
-    },
-    "totalAlerts" : 0,
-    "closed_at" : "2000-01-23T04:56:07.000+00:00",
-    "comments" : [ null, null ],
-    "assignees" : [ {
-      "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-    }, {
-      "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-    } ],
-    "created_at" : "2022-05-13T09:16:17.416Z",
-    "description" : "A case description.",
-    "title" : "Case title 1",
-    "created_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "version" : "WzUzMiwxXQ==",
-    "closed_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "tags" : [ "tag-1" ],
-    "duration" : 120,
-    "updated_at" : "2000-01-23T04:56:07.000+00:00",
-    "updated_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
-    "external_service" : {
-      "external_title" : "external_title",
-      "pushed_by" : {
-        "full_name" : "full_name",
-        "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-        "email" : "email",
-        "username" : "elastic"
-      },
-      "external_url" : "external_url",
-      "pushed_at" : "2000-01-23T04:56:07.000+00:00",
-      "connector_id" : "connector_id",
-      "external_id" : "external_id",
-      "connector_name" : "connector_name"
-    }
-  }, {
-    "owner" : "cases",
-    "totalComment" : 0,
-    "settings" : {
-      "syncAlerts" : true
-    },
-    "totalAlerts" : 0,
-    "closed_at" : "2000-01-23T04:56:07.000+00:00",
-    "comments" : [ null, null ],
-    "assignees" : [ {
-      "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-    }, {
-      "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-    } ],
-    "created_at" : "2022-05-13T09:16:17.416Z",
-    "description" : "A case description.",
-    "title" : "Case title 1",
-    "created_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "version" : "WzUzMiwxXQ==",
-    "closed_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "tags" : [ "tag-1" ],
-    "duration" : 120,
-    "updated_at" : "2000-01-23T04:56:07.000+00:00",
-    "updated_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
-    "external_service" : {
-      "external_title" : "external_title",
-      "pushed_by" : {
-        "full_name" : "full_name",
-        "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-        "email" : "email",
-        "username" : "elastic"
-      },
-      "external_url" : "external_url",
-      "pushed_at" : "2000-01-23T04:56:07.000+00:00",
-      "connector_id" : "connector_id",
-      "external_id" : "external_id",
-      "connector_name" : "connector_name"
-    }
-  } ],
-  "count_open_cases" : 1,
-  "count_closed_cases" : 0,
-  "page" : 5
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - findCasesDefaultSpace_200_response -

401

- Authorization information is missing or invalid. - 4xx_response -
-
-
-
- Up - 
get /api/cases/_find
-
Retrieves a paginated subset of cases in the default space. (findCasesDefaultSpace)
-
You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases you're seeking.
- - - - - -

Query parameters

-
-
assignees (optional)
- -
Query Parameter — Filters the returned cases by assignees. Valid values are none or unique identifiers for the user profiles. These identifiers can be found by using the suggest user profile API. default: null
defaultSearchOperator (optional)
- -
Query Parameter — he default operator to use for the simple_query_string. default: OR
fields (optional)
- -
Query Parameter — The fields in the entity to return in the response. default: null
from (optional)
- -
Query Parameter — [preview] Returns only cases that were created after a specific date. The date must be specified as a KQL data range or date match expression. This functionality is in technical preview and may be changed or removed in a future release. Elastic will apply best effort to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. default: null
owner (optional)
- -
Query Parameter — A filter to limit the response to a specific set of applications. If this parameter is omitted, the response contains information about all the cases that the user has access to read. default: null
page (optional)
- -
Query Parameter — The page number to return. default: 1
perPage (optional)
- -
Query Parameter — The number of cases to return per page. default: 20
reporters (optional)
- -
Query Parameter — Filters the returned cases by the user name of the reporter. default: null
search (optional)
- -
Query Parameter — An Elasticsearch simple_query_string query that filters the objects in the response. default: null
searchFields (optional)
- -
Query Parameter — The fields to perform the simple_query_string parsed query against. default: null
severity (optional)
- -
Query Parameter — The severity of the case. default: null
sortField (optional)
- -
Query Parameter — Determines which field is used to sort the results. default: createdAt
sortOrder (optional)
- -
Query Parameter — Determines the sort order. default: desc
status (optional)
- -
Query Parameter — Filters the returned cases by state. default: null
tags (optional)
- -
Query Parameter — Filters the returned cases by tags. default: null
to (optional)
- -
Query Parameter — [preview] Returns only cases that were created before a specific date. The date must be specified as a KQL data range or date match expression. This functionality is in technical preview and may be changed or removed in a future release. Elastic will apply best effort to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. default: null
-
- - -

Return type

-
- findCasesDefaultSpace_200_response - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "count_in_progress_cases" : 6,
-  "per_page" : 5,
-  "total" : 2,
-  "cases" : [ {
-    "owner" : "cases",
-    "totalComment" : 0,
-    "settings" : {
-      "syncAlerts" : true
-    },
-    "totalAlerts" : 0,
-    "closed_at" : "2000-01-23T04:56:07.000+00:00",
-    "comments" : [ null, null ],
-    "assignees" : [ {
-      "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-    }, {
-      "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-    } ],
-    "created_at" : "2022-05-13T09:16:17.416Z",
-    "description" : "A case description.",
-    "title" : "Case title 1",
-    "created_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "version" : "WzUzMiwxXQ==",
-    "closed_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "tags" : [ "tag-1" ],
-    "duration" : 120,
-    "updated_at" : "2000-01-23T04:56:07.000+00:00",
-    "updated_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
-    "external_service" : {
-      "external_title" : "external_title",
-      "pushed_by" : {
-        "full_name" : "full_name",
-        "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-        "email" : "email",
-        "username" : "elastic"
-      },
-      "external_url" : "external_url",
-      "pushed_at" : "2000-01-23T04:56:07.000+00:00",
-      "connector_id" : "connector_id",
-      "external_id" : "external_id",
-      "connector_name" : "connector_name"
-    }
-  }, {
-    "owner" : "cases",
-    "totalComment" : 0,
-    "settings" : {
-      "syncAlerts" : true
-    },
-    "totalAlerts" : 0,
-    "closed_at" : "2000-01-23T04:56:07.000+00:00",
-    "comments" : [ null, null ],
-    "assignees" : [ {
-      "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-    }, {
-      "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-    } ],
-    "created_at" : "2022-05-13T09:16:17.416Z",
-    "description" : "A case description.",
-    "title" : "Case title 1",
-    "created_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "version" : "WzUzMiwxXQ==",
-    "closed_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "tags" : [ "tag-1" ],
-    "duration" : 120,
-    "updated_at" : "2000-01-23T04:56:07.000+00:00",
-    "updated_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
-    "external_service" : {
-      "external_title" : "external_title",
-      "pushed_by" : {
-        "full_name" : "full_name",
-        "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-        "email" : "email",
-        "username" : "elastic"
-      },
-      "external_url" : "external_url",
-      "pushed_at" : "2000-01-23T04:56:07.000+00:00",
-      "connector_id" : "connector_id",
-      "external_id" : "external_id",
-      "connector_name" : "connector_name"
-    }
-  } ],
-  "count_open_cases" : 1,
-  "count_closed_cases" : 0,
-  "page" : 5
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - findCasesDefaultSpace_200_response -

401

- Authorization information is missing or invalid. - 4xx_response -
-
-
-
- Up - 
get /s/{spaceId}/api/cases/{caseId}/comments
-
Retrieves all the comments from a case. (getAllCaseComments)
-
Deprecated in 8.1.0. This API is deprecated and will be removed in a future release; instead, use the get case comment API, which requires a comment identifier in the path. You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases with the comments you're seeking.
- -

Path parameters

-
-
caseId (required)
- -
Path Parameter — The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded. default: null
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- - - - - - -

Return type

-
- case_response_properties - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "owner" : "cases",
-  "totalComment" : 0,
-  "settings" : {
-    "syncAlerts" : true
-  },
-  "totalAlerts" : 0,
-  "closed_at" : "2000-01-23T04:56:07.000+00:00",
-  "comments" : [ null, null ],
-  "assignees" : [ {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  } ],
-  "created_at" : "2022-05-13T09:16:17.416Z",
-  "description" : "A case description.",
-  "title" : "Case title 1",
-  "created_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "version" : "WzUzMiwxXQ==",
-  "closed_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "tags" : [ "tag-1" ],
-  "duration" : 120,
-  "updated_at" : "2000-01-23T04:56:07.000+00:00",
-  "updated_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
-  "external_service" : {
-    "external_title" : "external_title",
-    "pushed_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "external_url" : "external_url",
-    "pushed_at" : "2000-01-23T04:56:07.000+00:00",
-    "connector_id" : "connector_id",
-    "external_id" : "external_id",
-    "connector_name" : "connector_name"
-  }
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - case_response_properties -

401

- Authorization information is missing or invalid. - 4xx_response -
-
-
-
- Up - 
get /api/cases/{caseId}/comments
-
Retrieves all the comments from a case in the default space. (getAllCaseCommentsDefaultSpace)
-
Deprecated in 8.1.0. This API is deprecated and will be removed in a future release; instead, use the get case comment API, which requires a comment identifier in the path. You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases with the comments you're seeking.
- -

Path parameters

-
-
caseId (required)
- -
Path Parameter — The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded. default: null
-
- - - - - - -

Return type

-
- case_response_properties - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "owner" : "cases",
-  "totalComment" : 0,
-  "settings" : {
-    "syncAlerts" : true
-  },
-  "totalAlerts" : 0,
-  "closed_at" : "2000-01-23T04:56:07.000+00:00",
-  "comments" : [ null, null ],
-  "assignees" : [ {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  } ],
-  "created_at" : "2022-05-13T09:16:17.416Z",
-  "description" : "A case description.",
-  "title" : "Case title 1",
-  "created_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "version" : "WzUzMiwxXQ==",
-  "closed_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "tags" : [ "tag-1" ],
-  "duration" : 120,
-  "updated_at" : "2000-01-23T04:56:07.000+00:00",
-  "updated_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
-  "external_service" : {
-    "external_title" : "external_title",
-    "pushed_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "external_url" : "external_url",
-    "pushed_at" : "2000-01-23T04:56:07.000+00:00",
-    "connector_id" : "connector_id",
-    "external_id" : "external_id",
-    "connector_name" : "connector_name"
-  }
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - case_response_properties -

401

- Authorization information is missing or invalid. - 4xx_response -
-
-
-
- Up - 
get /s/{spaceId}/api/cases/{caseId}
-
Retrieves information about a case. (getCase)
-
You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're seeking.
- -

Path parameters

-
-
caseId (required)
- -
Path Parameter — The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded. default: null
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- - - - -

Query parameters

-
-
includeComments (optional)
- -
Query Parameter — Deprecated in 8.1.0. This parameter is deprecated and will be removed in a future release. It determines whether case comments are returned. default: true
-
- - -

Return type

-
- case_response_properties - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "owner" : "cases",
-  "totalComment" : 0,
-  "settings" : {
-    "syncAlerts" : true
-  },
-  "totalAlerts" : 0,
-  "closed_at" : "2000-01-23T04:56:07.000+00:00",
-  "comments" : [ null, null ],
-  "assignees" : [ {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  } ],
-  "created_at" : "2022-05-13T09:16:17.416Z",
-  "description" : "A case description.",
-  "title" : "Case title 1",
-  "created_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "version" : "WzUzMiwxXQ==",
-  "closed_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "tags" : [ "tag-1" ],
-  "duration" : 120,
-  "updated_at" : "2000-01-23T04:56:07.000+00:00",
-  "updated_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
-  "external_service" : {
-    "external_title" : "external_title",
-    "pushed_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "external_url" : "external_url",
-    "pushed_at" : "2000-01-23T04:56:07.000+00:00",
-    "connector_id" : "connector_id",
-    "external_id" : "external_id",
-    "connector_name" : "connector_name"
-  }
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - case_response_properties -

401

- Authorization information is missing or invalid. - 4xx_response -
-
-
-
- Up - 
get /s/{spaceId}/api/cases/{caseId}/user_actions
-
Returns all user activity for a case. (getCaseActivity)
-
Deprecated in 8.1.0. This API is deprecated and will be removed in a future release; use the find user actions API instead. You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're seeking.
- -

Path parameters

-
-
caseId (required)
- -
Path Parameter — The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded. default: null
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- - - - - - -

Return type

-
- array[user_actions_response_properties] - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "owner" : "cases",
-  "action_id" : "22fd3e30-03b1-11ed-920c-974bfa104448",
-  "case_id" : "22df07d0-03b1-11ed-920c-974bfa104448",
-  "action" : "create",
-  "created_at" : "2022-05-13T09:16:17.416Z",
-  "comment_id" : "578608d0-03b1-11ed-920c-974bfa104448",
-  "type" : "create_case",
-  "created_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  }
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - -

401

- Authorization information is missing or invalid. - 4xx_response -
-
-
-
- Up - 
get /api/cases/{caseId}/user_actions
-
Returns all user activity for a case in the default space. (getCaseActivityDefaultSpace)
-
Deprecated in 8.1.0. This API is deprecated and will be removed in a future release; use the find user actions API instead. You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're seeking.
- -

Path parameters

-
-
caseId (required)
- -
Path Parameter — The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded. default: null
-
- - - - - - -

Return type

-
- array[user_actions_response_properties] - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "owner" : "cases",
-  "action_id" : "22fd3e30-03b1-11ed-920c-974bfa104448",
-  "case_id" : "22df07d0-03b1-11ed-920c-974bfa104448",
-  "action" : "create",
-  "created_at" : "2022-05-13T09:16:17.416Z",
-  "comment_id" : "578608d0-03b1-11ed-920c-974bfa104448",
-  "type" : "create_case",
-  "created_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  }
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - -

401

- Authorization information is missing or invalid. - 4xx_response -
-
-
-
- Up - 
get /s/{spaceId}/api/cases/{caseId}/alerts
-
Gets all alerts attached to a case. (getCaseAlerts)
-
You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases you're seeking.
- -

Path parameters

-
-
caseId (required)
- -
Path Parameter — The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded. default: null
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- - - - - - -

Return type

-
- array[alert_response_properties] - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "index" : "index",
-  "id" : "id",
-  "attached_at" : "2000-01-23T04:56:07.000+00:00"
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - -

401

- Authorization information is missing or invalid. - 4xx_response -
-
-
-
- Up - 
get /api/cases/{caseId}/alerts
-
Gets all alerts attached to a case in the default space. (getCaseAlertsDefaultSpace)
-
You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases you're seeking.
- -

Path parameters

-
-
caseId (required)
- -
Path Parameter — The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded. default: null
-
- - - - - - -

Return type

-
- array[alert_response_properties] - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "index" : "index",
-  "id" : "id",
-  "attached_at" : "2000-01-23T04:56:07.000+00:00"
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - -

401

- Authorization information is missing or invalid. - 4xx_response -
-
-
-
- Up - 
get /s/{spaceId}/api/cases/{caseId}/comments/{commentId}
-
Retrieves a comment from a case. (getCaseComment)
-
You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases with the comments you're seeking.
- -

Path parameters

-
-
caseId (required)
- -
Path Parameter — The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded. default: null
commentId (required)
- -
Path Parameter — The identifier for the comment. To retrieve comment IDs, use the get case or find cases APIs. default: null
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- - - - - - -

Return type

-
- getCaseCommentDefaultSpace_200_response - -
- - - -

Example data

-
Content-Type: application/json
- 
null
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - getCaseCommentDefaultSpace_200_response -

401

- Authorization information is missing or invalid. - 4xx_response -
-
-
-
- Up - 
get /api/cases/{caseId}/comments/{commentId}
-
Retrieves a comment from a case in the default space. (getCaseCommentDefaultSpace)
-
You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases with the comments you're seeking.
- -

Path parameters

-
-
caseId (required)
- -
Path Parameter — The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded. default: null
commentId (required)
- -
Path Parameter — The identifier for the comment. To retrieve comment IDs, use the get case or find cases APIs. default: null
-
- - - - - - -

Return type

-
- getCaseCommentDefaultSpace_200_response - -
- - - -

Example data

-
Content-Type: application/json
- 
null
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - getCaseCommentDefaultSpace_200_response -

401

- Authorization information is missing or invalid. - 4xx_response -
-
-
-
- Up - 
get /s/{spaceId}/api/cases/configure
-
Retrieves external connection details, such as the closure type and default connector for cases. (getCaseConfiguration)
-
You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case configuration.
- -

Path parameters

-
-
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- - - - -

Query parameters

-
-
owner (optional)
- -
Query Parameter — A filter to limit the response to a specific set of applications. If this parameter is omitted, the response contains information about all the cases that the user has access to read. default: null
-
- - -

Return type

-
- array[getCaseConfigurationDefaultSpace_200_response_inner] - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "closure_type" : "close-by-user",
-  "owner" : "cases",
-  "mappings" : [ {
-    "action_type" : "overwrite",
-    "source" : "title",
-    "target" : "summary"
-  }, {
-    "action_type" : "overwrite",
-    "source" : "title",
-    "target" : "summary"
-  } ],
-  "connector" : {
-    "name" : "none",
-    "id" : "none",
-    "fields" : "{}",
-    "type" : ".none"
-  },
-  "updated_at" : "2022-06-01T19:58:48.169Z",
-  "updated_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "created_at" : "2022-06-01T17:07:17.767Z",
-  "id" : "4a97a440-e1cd-11ec-be9b-9b1838238ee6",
-  "error" : "error",
-  "created_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "version" : "WzIwNzMsMV0="
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - -

401

- Authorization information is missing or invalid. - 4xx_response -
-
-
-
- Up - 
get /api/cases/configure
-
Retrieves external connection details, such as the closure type and default connector for cases in the default space. (getCaseConfigurationDefaultSpace)
-
You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case configuration.
- - - - - -

Query parameters

-
-
owner (optional)
- -
Query Parameter — A filter to limit the response to a specific set of applications. If this parameter is omitted, the response contains information about all the cases that the user has access to read. default: null
-
- - -

Return type

-
- array[getCaseConfigurationDefaultSpace_200_response_inner] - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "closure_type" : "close-by-user",
-  "owner" : "cases",
-  "mappings" : [ {
-    "action_type" : "overwrite",
-    "source" : "title",
-    "target" : "summary"
-  }, {
-    "action_type" : "overwrite",
-    "source" : "title",
-    "target" : "summary"
-  } ],
-  "connector" : {
-    "name" : "none",
-    "id" : "none",
-    "fields" : "{}",
-    "type" : ".none"
-  },
-  "updated_at" : "2022-06-01T19:58:48.169Z",
-  "updated_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "created_at" : "2022-06-01T17:07:17.767Z",
-  "id" : "4a97a440-e1cd-11ec-be9b-9b1838238ee6",
-  "error" : "error",
-  "created_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "version" : "WzIwNzMsMV0="
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - -

401

- Authorization information is missing or invalid. - 4xx_response -
-
-
-
- Up - 
get /api/cases/{caseId}
-
Retrieves information about a case in the default space. (getCaseDefaultSpace)
-
You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're seeking.
- -

Path parameters

-
-
caseId (required)
- -
Path Parameter — The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded. default: null
-
- - - - -

Query parameters

-
-
includeComments (optional)
- -
Query Parameter — Deprecated in 8.1.0. This parameter is deprecated and will be removed in a future release. It determines whether case comments are returned. default: true
-
- - -

Return type

-
- case_response_properties - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "owner" : "cases",
-  "totalComment" : 0,
-  "settings" : {
-    "syncAlerts" : true
-  },
-  "totalAlerts" : 0,
-  "closed_at" : "2000-01-23T04:56:07.000+00:00",
-  "comments" : [ null, null ],
-  "assignees" : [ {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  } ],
-  "created_at" : "2022-05-13T09:16:17.416Z",
-  "description" : "A case description.",
-  "title" : "Case title 1",
-  "created_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "version" : "WzUzMiwxXQ==",
-  "closed_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "tags" : [ "tag-1" ],
-  "duration" : 120,
-  "updated_at" : "2000-01-23T04:56:07.000+00:00",
-  "updated_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
-  "external_service" : {
-    "external_title" : "external_title",
-    "pushed_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "external_url" : "external_url",
-    "pushed_at" : "2000-01-23T04:56:07.000+00:00",
-    "connector_id" : "connector_id",
-    "external_id" : "external_id",
-    "connector_name" : "connector_name"
-  }
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - case_response_properties -

401

- Authorization information is missing or invalid. - 4xx_response -
-
-
-
- Up - 
get /s/{spaceId}/api/cases/reporters
-
Returns information about the users who opened cases. (getCaseReporters)
-
You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases. The API returns information about the users as they existed at the time of the case creation, including their name, full name, and email address. If any of those details change thereafter or if a user is deleted, the information returned by this API is unchanged.
- -

Path parameters

-
-
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- - - - -

Query parameters

-
-
owner (optional)
- -
Query Parameter — A filter to limit the response to a specific set of applications. If this parameter is omitted, the response contains information about all the cases that the user has access to read. default: null
-
- - -

Return type

-
- array[getCaseConfigurationDefaultSpace_200_response_inner_created_by] - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "full_name" : "full_name",
-  "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-  "email" : "email",
-  "username" : "elastic"
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - -

401

- Authorization information is missing or invalid. - 4xx_response -
-
-
-
- Up - 
get /api/cases/reporters
-
Returns information about the users who opened cases in the default space. (getCaseReportersDefaultSpace)
-
You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases. The API returns information about the users as they existed at the time of the case creation, including their name, full name, and email address. If any of those details change thereafter or if a user is deleted, the information returned by this API is unchanged.
- - - - - -

Query parameters

-
-
owner (optional)
- -
Query Parameter — A filter to limit the response to a specific set of applications. If this parameter is omitted, the response contains information about all the cases that the user has access to read. default: null
-
- - -

Return type

-
- array[getCaseConfigurationDefaultSpace_200_response_inner_created_by] - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "full_name" : "full_name",
-  "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-  "email" : "email",
-  "username" : "elastic"
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - -

401

- Authorization information is missing or invalid. - 4xx_response -
-
-
-
- Up - 
get /s/{spaceId}/api/cases/status
-
Returns the number of cases that are open, closed, and in progress. (getCaseStatus)
-
Deprecated in 8.1.0. This API is deprecated and will be removed in a future release; use the find cases API instead. You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases you're seeking.
- -

Path parameters

-
-
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- - - - -

Query parameters

-
-
owner (optional)
- -
Query Parameter — A filter to limit the response to a specific set of applications. If this parameter is omitted, the response contains information about all the cases that the user has access to read. default: null
-
- - -

Return type

-
- getCaseStatusDefaultSpace_200_response - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "count_in_progress_cases" : 6,
-  "count_open_cases" : 1,
-  "count_closed_cases" : 0
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - getCaseStatusDefaultSpace_200_response -

401

- Authorization information is missing or invalid. - 4xx_response -
-
-
-
- Up - 
get /api/cases/status
-
Returns the number of cases in the default space that are open, closed, and in progress. (getCaseStatusDefaultSpace)
-
Deprecated in 8.1.0. This API is deprecated and will be removed in a future release; use the find cases API instead. You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases you're seeking.
- - - - - -

Query parameters

-
-
owner (optional)
- -
Query Parameter — A filter to limit the response to a specific set of applications. If this parameter is omitted, the response contains information about all the cases that the user has access to read. default: null
-
- - -

Return type

-
- getCaseStatusDefaultSpace_200_response - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "count_in_progress_cases" : 6,
-  "count_open_cases" : 1,
-  "count_closed_cases" : 0
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - getCaseStatusDefaultSpace_200_response -

401

- Authorization information is missing or invalid. - 4xx_response -
-
-
-
- Up - 
get /s/{spaceId}/api/cases/tags
-
Aggregates and returns a list of case tags. (getCaseTags)
-
You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases you're seeking.
- -

Path parameters

-
-
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- - - - -

Query parameters

-
-
owner (optional)
- -
Query Parameter — A filter to limit the retrieved case statistics to a specific set of applications. If this parameter is omitted, the response contains tags from all cases that the user has access to read. default: null
-
- - -

Return type

-
- - array[String] -
- - - -

Example data

-
Content-Type: application/json
- 
""
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - -

401

- Authorization information is missing or invalid. - 4xx_response -
-
-
-
- Up - 
get /api/cases/tags
-
Aggregates and returns a list of case tags in the default space. (getCaseTagsDefaultSpace)
-
You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases you're seeking.
- - - - - -

Query parameters

-
-
owner (optional)
- -
Query Parameter — A filter to limit the retrieved case statistics to a specific set of applications. If this parameter is omitted, the response contains tags from all cases that the user has access to read. default: null
-
- - -

Return type

-
- - array[String] -
- - - -

Example data

-
Content-Type: application/json
- 
""
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - -

401

- Authorization information is missing or invalid. - 4xx_response -
-
-
-
- Up - 
get /s/{spaceId}/api/cases/alerts/{alertId}
-
Returns the cases associated with a specific alert. (getCasesByAlert)
-
You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases you're seeking.
- -

Path parameters

-
-
alertId (required)
- -
Path Parameter — An identifier for the alert. default: null
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- - - - -

Query parameters

-
-
owner (optional)
- -
Query Parameter — A filter to limit the response to a specific set of applications. If this parameter is omitted, the response contains information about all the cases that the user has access to read. default: null
-
- - -

Return type

-
- array[getCasesByAlertDefaultSpace_200_response_inner] - -
- - - -

Example data

-
Content-Type: application/json
- 
[ {
-  "id" : "06116b80-e1c3-11ec-be9b-9b1838238ee6",
-  "title" : "security_case"
-} ]
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - -

401

- Authorization information is missing or invalid. - 4xx_response -
-
-
-
- Up - 
get /api/cases/alerts/{alertId}
-
Returns cases in the default space associated with a specific alert. (getCasesByAlertDefaultSpace)
-
You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases you're seeking.
- -

Path parameters

-
-
alertId (required)
- -
Path Parameter — An identifier for the alert. default: null
-
- - - - -

Query parameters

-
-
owner (optional)
- -
Query Parameter — A filter to limit the response to a specific set of applications. If this parameter is omitted, the response contains information about all the cases that the user has access to read. default: null
-
- - -

Return type

-
- array[getCasesByAlertDefaultSpace_200_response_inner] - -
- - - -

Example data

-
Content-Type: application/json
- 
[ {
-  "id" : "06116b80-e1c3-11ec-be9b-9b1838238ee6",
-  "title" : "security_case"
-} ]
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - -

401

- Authorization information is missing or invalid. - 4xx_response -
-
-
-
- Up - 
post /s/{spaceId}/api/cases/{caseId}/connector/{connectorId}/_push
-
Pushes a case to an external service. (pushCase)
-
You must have all privileges for the Actions and Connectors feature in the Management section of the Kibana feature privileges. You must also have all privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're pushing.
- -

Path parameters

-
-
caseId (required)
- -
Path Parameter — The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded. default: null
connectorId (required)
- -
Path Parameter — An identifier for the connector. To retrieve connector IDs, use the find connectors API. default: null
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- -

Consumes

- This API call consumes the following media types via the Content-Type request header: -
    -
  • application/json
    • -
- -

Request body

-
-
body object (optional)
- -
Body Parameter —
- -
- -

Request headers

-
-
kbn-xsrf (required)
- -
Header Parameter — Cross-site request forgery protection default: null
- -
- - - -

Return type

-
- case_response_properties - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "owner" : "cases",
-  "totalComment" : 0,
-  "settings" : {
-    "syncAlerts" : true
-  },
-  "totalAlerts" : 0,
-  "closed_at" : "2000-01-23T04:56:07.000+00:00",
-  "comments" : [ null, null ],
-  "assignees" : [ {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  } ],
-  "created_at" : "2022-05-13T09:16:17.416Z",
-  "description" : "A case description.",
-  "title" : "Case title 1",
-  "created_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "version" : "WzUzMiwxXQ==",
-  "closed_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "tags" : [ "tag-1" ],
-  "duration" : 120,
-  "updated_at" : "2000-01-23T04:56:07.000+00:00",
-  "updated_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
-  "external_service" : {
-    "external_title" : "external_title",
-    "pushed_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "external_url" : "external_url",
-    "pushed_at" : "2000-01-23T04:56:07.000+00:00",
-    "connector_id" : "connector_id",
-    "external_id" : "external_id",
-    "connector_name" : "connector_name"
-  }
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - case_response_properties -

401

- Authorization information is missing or invalid. - 4xx_response -
-
-
-
- Up - 
post /api/cases/{caseId}/connector/{connectorId}/_push
-
Pushes a case in the default space to an external service. (pushCaseDefaultSpace)
-
You must have all privileges for the Actions and Connectors feature in the Management section of the Kibana feature privileges. You must also have all privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're pushing.
- -

Path parameters

-
-
caseId (required)
- -
Path Parameter — The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded. default: null
connectorId (required)
- -
Path Parameter — An identifier for the connector. To retrieve connector IDs, use the find connectors API. default: null
-
- -

Consumes

- This API call consumes the following media types via the Content-Type request header: -
    -
  • application/json
    • -
- -

Request body

-
-
body object (optional)
- -
Body Parameter —
- -
- -

Request headers

-
-
kbn-xsrf (required)
- -
Header Parameter — Cross-site request forgery protection default: null
- -
- - - -

Return type

-
- case_response_properties - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "owner" : "cases",
-  "totalComment" : 0,
-  "settings" : {
-    "syncAlerts" : true
-  },
-  "totalAlerts" : 0,
-  "closed_at" : "2000-01-23T04:56:07.000+00:00",
-  "comments" : [ null, null ],
-  "assignees" : [ {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  } ],
-  "created_at" : "2022-05-13T09:16:17.416Z",
-  "description" : "A case description.",
-  "title" : "Case title 1",
-  "created_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "version" : "WzUzMiwxXQ==",
-  "closed_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "tags" : [ "tag-1" ],
-  "duration" : 120,
-  "updated_at" : "2000-01-23T04:56:07.000+00:00",
-  "updated_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
-  "external_service" : {
-    "external_title" : "external_title",
-    "pushed_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "external_url" : "external_url",
-    "pushed_at" : "2000-01-23T04:56:07.000+00:00",
-    "connector_id" : "connector_id",
-    "external_id" : "external_id",
-    "connector_name" : "connector_name"
-  }
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - case_response_properties -

401

- Authorization information is missing or invalid. - 4xx_response -
-
-
-
- Up - 
post /s/{spaceId}/api/cases/configure
-
Sets external connection details, such as the closure type and default connector for cases. (setCaseConfiguration)
-
You must have all privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case configuration. Connectors are used to interface with external systems. You must create a connector before you can use it in your cases. Refer to the add connectors API. If you set a default connector, it is automatically selected when you create cases in Kibana. If you use the create case API, however, you must still specify all of the connector details.
- -

Path parameters

-
-
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- -

Consumes

- This API call consumes the following media types via the Content-Type request header: -
    -
  • application/json
    • -
- -

Request body

-
-
set_case_configuration_request set_case_configuration_request (optional)
- -
Body Parameter —
- -
- -

Request headers

-
-
kbn-xsrf (required)
- -
Header Parameter — Cross-site request forgery protection default: null
- -
- - - -

Return type

-
- getCaseConfigurationDefaultSpace_200_response_inner - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "closure_type" : "close-by-user",
-  "owner" : "cases",
-  "mappings" : [ {
-    "action_type" : "overwrite",
-    "source" : "title",
-    "target" : "summary"
-  }, {
-    "action_type" : "overwrite",
-    "source" : "title",
-    "target" : "summary"
-  } ],
-  "connector" : {
-    "name" : "none",
-    "id" : "none",
-    "fields" : "{}",
-    "type" : ".none"
-  },
-  "updated_at" : "2022-06-01T19:58:48.169Z",
-  "updated_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "created_at" : "2022-06-01T17:07:17.767Z",
-  "id" : "4a97a440-e1cd-11ec-be9b-9b1838238ee6",
-  "error" : "error",
-  "created_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "version" : "WzIwNzMsMV0="
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - getCaseConfigurationDefaultSpace_200_response_inner -

401

- Authorization information is missing or invalid. - 4xx_response -
-
-
-
- Up - 
post /api/cases/configure
-
Sets external connection details, such as the closure type and default connector for cases in the default space. (setCaseConfigurationDefaultSpace)
-
You must have all privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case configuration. Connectors are used to interface with external systems. You must create a connector before you can use it in your cases. Refer to the add connectors API. If you set a default connector, it is automatically selected when you create cases in Kibana. If you use the create case API, however, you must still specify all of the connector details.
- - -

Consumes

- This API call consumes the following media types via the Content-Type request header: -
    -
  • application/json
    • -
- -

Request body

-
-
set_case_configuration_request set_case_configuration_request (optional)
- -
Body Parameter —
- -
- -

Request headers

-
-
kbn-xsrf (required)
- -
Header Parameter — Cross-site request forgery protection default: null
- -
- - - -

Return type

-
- getCaseConfigurationDefaultSpace_200_response_inner - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "closure_type" : "close-by-user",
-  "owner" : "cases",
-  "mappings" : [ {
-    "action_type" : "overwrite",
-    "source" : "title",
-    "target" : "summary"
-  }, {
-    "action_type" : "overwrite",
-    "source" : "title",
-    "target" : "summary"
-  } ],
-  "connector" : {
-    "name" : "none",
-    "id" : "none",
-    "fields" : "{}",
-    "type" : ".none"
-  },
-  "updated_at" : "2022-06-01T19:58:48.169Z",
-  "updated_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "created_at" : "2022-06-01T17:07:17.767Z",
-  "id" : "4a97a440-e1cd-11ec-be9b-9b1838238ee6",
-  "error" : "error",
-  "created_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "version" : "WzIwNzMsMV0="
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - getCaseConfigurationDefaultSpace_200_response_inner -

401

- Authorization information is missing or invalid. - 4xx_response -
-
-
-
- Up - 
patch /s/{spaceId}/api/cases
-
Updates one or more cases. (updateCase)
-
You must have all privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're updating.
- -

Path parameters

-
-
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- -

Consumes

- This API call consumes the following media types via the Content-Type request header: -
    -
  • application/json
    • -
- -

Request body

-
-
update_case_request update_case_request (optional)
- -
Body Parameter —
- -
- -

Request headers

-
-
kbn-xsrf (required)
- -
Header Parameter — Cross-site request forgery protection default: null
- -
- - - -

Return type

-
- array[case_response_properties] - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "owner" : "cases",
-  "totalComment" : 0,
-  "settings" : {
-    "syncAlerts" : true
-  },
-  "totalAlerts" : 0,
-  "closed_at" : "2000-01-23T04:56:07.000+00:00",
-  "comments" : [ null, null ],
-  "assignees" : [ {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  } ],
-  "created_at" : "2022-05-13T09:16:17.416Z",
-  "description" : "A case description.",
-  "title" : "Case title 1",
-  "created_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "version" : "WzUzMiwxXQ==",
-  "closed_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "tags" : [ "tag-1" ],
-  "duration" : 120,
-  "updated_at" : "2000-01-23T04:56:07.000+00:00",
-  "updated_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
-  "external_service" : {
-    "external_title" : "external_title",
-    "pushed_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "external_url" : "external_url",
-    "pushed_at" : "2000-01-23T04:56:07.000+00:00",
-    "connector_id" : "connector_id",
-    "external_id" : "external_id",
-    "connector_name" : "connector_name"
-  }
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - -

401

- Authorization information is missing or invalid. - 4xx_response -
-
-
-
- Up - 
patch /s/{spaceId}/api/cases/{caseId}/comments
-
Updates a comment or alert in a case. (updateCaseComment)
-
You must have all privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're updating. NOTE: You cannot change the comment type or the owner of a comment.
- -

Path parameters

-
-
caseId (required)
- -
Path Parameter — The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded. default: null
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- -

Consumes

- This API call consumes the following media types via the Content-Type request header: -
    -
  • application/json
    • -
- -

Request body

-
-
update_case_comment_request update_case_comment_request (required)
- -
Body Parameter —
- -
- -

Request headers

-
-
kbn-xsrf (required)
- -
Header Parameter — Cross-site request forgery protection default: null
- -
- - - -

Return type

-
- case_response_properties - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "owner" : "cases",
-  "totalComment" : 0,
-  "settings" : {
-    "syncAlerts" : true
-  },
-  "totalAlerts" : 0,
-  "closed_at" : "2000-01-23T04:56:07.000+00:00",
-  "comments" : [ null, null ],
-  "assignees" : [ {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  } ],
-  "created_at" : "2022-05-13T09:16:17.416Z",
-  "description" : "A case description.",
-  "title" : "Case title 1",
-  "created_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "version" : "WzUzMiwxXQ==",
-  "closed_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "tags" : [ "tag-1" ],
-  "duration" : 120,
-  "updated_at" : "2000-01-23T04:56:07.000+00:00",
-  "updated_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
-  "external_service" : {
-    "external_title" : "external_title",
-    "pushed_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "external_url" : "external_url",
-    "pushed_at" : "2000-01-23T04:56:07.000+00:00",
-    "connector_id" : "connector_id",
-    "external_id" : "external_id",
-    "connector_name" : "connector_name"
-  }
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - case_response_properties -

401

- Authorization information is missing or invalid. - 4xx_response -
-
-
-
- Up - 
patch /api/cases/{caseId}/comments
-
Updates a comment or alert in a case in the default space. (updateCaseCommentDefaultSpace)
-
You must have all privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're updating. NOTE: You cannot change the comment type or the owner of a comment.
- -

Path parameters

-
-
caseId (required)
- -
Path Parameter — The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded. default: null
-
- -

Consumes

- This API call consumes the following media types via the Content-Type request header: -
    -
  • application/json
    • -
- -

Request body

-
-
update_case_comment_request update_case_comment_request (required)
- -
Body Parameter —
- -
- -

Request headers

-
-
kbn-xsrf (required)
- -
Header Parameter — Cross-site request forgery protection default: null
- -
- - - -

Return type

-
- case_response_properties - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "owner" : "cases",
-  "totalComment" : 0,
-  "settings" : {
-    "syncAlerts" : true
-  },
-  "totalAlerts" : 0,
-  "closed_at" : "2000-01-23T04:56:07.000+00:00",
-  "comments" : [ null, null ],
-  "assignees" : [ {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  } ],
-  "created_at" : "2022-05-13T09:16:17.416Z",
-  "description" : "A case description.",
-  "title" : "Case title 1",
-  "created_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "version" : "WzUzMiwxXQ==",
-  "closed_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "tags" : [ "tag-1" ],
-  "duration" : 120,
-  "updated_at" : "2000-01-23T04:56:07.000+00:00",
-  "updated_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
-  "external_service" : {
-    "external_title" : "external_title",
-    "pushed_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "external_url" : "external_url",
-    "pushed_at" : "2000-01-23T04:56:07.000+00:00",
-    "connector_id" : "connector_id",
-    "external_id" : "external_id",
-    "connector_name" : "connector_name"
-  }
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - case_response_properties -

401

- Authorization information is missing or invalid. - 4xx_response -
-
-
-
- Up - 
patch /s/{spaceId}/api/cases/configure/{configurationId}
-
Updates external connection details, such as the closure type and default connector for cases. (updateCaseConfiguration)
-
You must have all privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case configuration. Connectors are used to interface with external systems. You must create a connector before you can use it in your cases. Refer to the add connectors API.
- -

Path parameters

-
-
configurationId (required)
- -
Path Parameter — An identifier for the configuration. default: null
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- -

Consumes

- This API call consumes the following media types via the Content-Type request header: -
    -
  • application/json
    • -
- -

Request body

-
-
update_case_configuration_request update_case_configuration_request (optional)
- -
Body Parameter —
- -
- -

Request headers

-
-
kbn-xsrf (required)
- -
Header Parameter — Cross-site request forgery protection default: null
- -
- - - -

Return type

-
- array[getCaseConfigurationDefaultSpace_200_response_inner] - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "closure_type" : "close-by-user",
-  "owner" : "cases",
-  "mappings" : [ {
-    "action_type" : "overwrite",
-    "source" : "title",
-    "target" : "summary"
-  }, {
-    "action_type" : "overwrite",
-    "source" : "title",
-    "target" : "summary"
-  } ],
-  "connector" : {
-    "name" : "none",
-    "id" : "none",
-    "fields" : "{}",
-    "type" : ".none"
-  },
-  "updated_at" : "2022-06-01T19:58:48.169Z",
-  "updated_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "created_at" : "2022-06-01T17:07:17.767Z",
-  "id" : "4a97a440-e1cd-11ec-be9b-9b1838238ee6",
-  "error" : "error",
-  "created_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "version" : "WzIwNzMsMV0="
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - -

401

- Authorization information is missing or invalid. - 4xx_response -
-
-
-
- Up - 
patch /api/cases/configure/{configurationId}
-
Updates external connection details, such as the closure type and default connector for cases in the default space. (updateCaseConfigurationDefaultSpace)
-
You must have all privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case configuration. Connectors are used to interface with external systems. You must create a connector before you can use it in your cases. Refer to the add connectors API.
- -

Path parameters

-
-
configurationId (required)
- -
Path Parameter — An identifier for the configuration. default: null
-
- -

Consumes

- This API call consumes the following media types via the Content-Type request header: -
    -
  • application/json
    • -
- -

Request body

-
-
update_case_configuration_request update_case_configuration_request (optional)
- -
Body Parameter —
- -
- -

Request headers

-
-
kbn-xsrf (required)
- -
Header Parameter — Cross-site request forgery protection default: null
- -
- - - -

Return type

-
- array[getCaseConfigurationDefaultSpace_200_response_inner] - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "closure_type" : "close-by-user",
-  "owner" : "cases",
-  "mappings" : [ {
-    "action_type" : "overwrite",
-    "source" : "title",
-    "target" : "summary"
-  }, {
-    "action_type" : "overwrite",
-    "source" : "title",
-    "target" : "summary"
-  } ],
-  "connector" : {
-    "name" : "none",
-    "id" : "none",
-    "fields" : "{}",
-    "type" : ".none"
-  },
-  "updated_at" : "2022-06-01T19:58:48.169Z",
-  "updated_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "created_at" : "2022-06-01T17:07:17.767Z",
-  "id" : "4a97a440-e1cd-11ec-be9b-9b1838238ee6",
-  "error" : "error",
-  "created_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "version" : "WzIwNzMsMV0="
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - -

401

- Authorization information is missing or invalid. - 4xx_response -
-
-
-
- Up - 
patch /api/cases
-
Updates one or more cases in the default space. (updateCaseDefaultSpace)
-
You must have all privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're updating.
- - -

Consumes

- This API call consumes the following media types via the Content-Type request header: -
    -
  • application/json
    • -
- -

Request body

-
-
update_case_request update_case_request (optional)
- -
Body Parameter —
- -
- -

Request headers

-
-
kbn-xsrf (required)
- -
Header Parameter — Cross-site request forgery protection default: null
- -
- - - -

Return type

-
- array[case_response_properties] - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "owner" : "cases",
-  "totalComment" : 0,
-  "settings" : {
-    "syncAlerts" : true
-  },
-  "totalAlerts" : 0,
-  "closed_at" : "2000-01-23T04:56:07.000+00:00",
-  "comments" : [ null, null ],
-  "assignees" : [ {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  } ],
-  "created_at" : "2022-05-13T09:16:17.416Z",
-  "description" : "A case description.",
-  "title" : "Case title 1",
-  "created_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "version" : "WzUzMiwxXQ==",
-  "closed_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "tags" : [ "tag-1" ],
-  "duration" : 120,
-  "updated_at" : "2000-01-23T04:56:07.000+00:00",
-  "updated_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
-  "external_service" : {
-    "external_title" : "external_title",
-    "pushed_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "external_url" : "external_url",
-    "pushed_at" : "2000-01-23T04:56:07.000+00:00",
-    "connector_id" : "connector_id",
-    "external_id" : "external_id",
-    "connector_name" : "connector_name"
-  }
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - -

401

- Authorization information is missing or invalid. - 4xx_response -
-
- -

Models

- [ Jump to Methods ] - -

Table of Contents

-
    -
  1. 4xx_response - Unsuccessful cases API response
    2. -
  2. Case_response_properties_for_comments_inner -
    3. -
  3. Case_response_properties_for_connectors - Case response properties for connectors
    4. -
  4. action_types -
    5. -
  5. actions -
    6. -
  6. add_alert_comment_request_properties - Add case comment request properties for alerts
    7. -
  7. add_case_comment_request - Add case comment request
    8. -
  8. add_user_comment_request_properties - Add case comment request properties for user comments
    9. -
  9. alert_comment_response_properties - Add case comment response properties for alerts
    10. -
  10. alert_comment_response_properties_rule -
    11. -
  11. alert_identifiers - Alert identifiers
    12. -
  12. alert_indices - Alert indices
    13. -
  13. alert_response_properties -
    14. -
  14. assignees_inner -
    15. -
  15. case_response_closed_by_properties - Case response properties for closed_by
    16. -
  16. case_response_created_by_properties - Case response properties for created_by
    17. -
  17. case_response_properties - Case response properties
    18. -
  18. case_response_pushed_by_properties - Case response properties for pushed_by
    19. -
  19. case_response_updated_by_properties - Case response properties for updated_by
    20. -
  20. closure_types -
    21. -
  21. connector_properties_cases_webhook - Create or upate case request properties for Cases Webhook connector
    22. -
  22. connector_properties_jira - Create or update case request properties for a Jira connector
    23. -
  23. connector_properties_jira_fields -
    24. -
  24. connector_properties_none - Create or update case request properties for no connector
    25. -
  25. connector_properties_resilient - Create case request properties for a IBM Resilient connector
    26. -
  26. connector_properties_resilient_fields -
    27. -
  27. connector_properties_servicenow - Create case request properties for a ServiceNow ITSM connector
    28. -
  28. connector_properties_servicenow_fields -
    29. -
  29. connector_properties_servicenow_sir - Create case request properties for a ServiceNow SecOps connector
    30. -
  30. connector_properties_servicenow_sir_fields -
    31. -
  31. connector_properties_swimlane - Create case request properties for a Swimlane connector
    32. -
  32. connector_properties_swimlane_fields -
    33. -
  33. connector_types -
    34. -
  34. create_case_request - Create case request
    35. -
  35. create_case_request_connector -
    36. -
  36. external_service -
    37. -
  37. findCaseActivityDefaultSpace_200_response -
    38. -
  38. findCaseConnectorsDefaultSpace_200_response_inner -
    39. -
  39. findCaseConnectorsDefaultSpace_200_response_inner_config -
    40. -
  40. findCasesDefaultSpace_200_response -
    41. -
  41. findCasesDefaultSpace_assignees_parameter -
    42. -
  42. findCasesDefaultSpace_owner_parameter -
    43. -
  43. getCaseCommentDefaultSpace_200_response -
    44. -
  44. getCaseConfigurationDefaultSpace_200_response_inner -
    45. -
  45. getCaseConfigurationDefaultSpace_200_response_inner_connector -
    46. -
  46. getCaseConfigurationDefaultSpace_200_response_inner_created_by -
    47. -
  47. getCaseConfigurationDefaultSpace_200_response_inner_mappings_inner -
    48. -
  48. getCaseConfigurationDefaultSpace_200_response_inner_updated_by -
    49. -
  49. getCaseStatusDefaultSpace_200_response -
    50. -
  50. getCasesByAlertDefaultSpace_200_response_inner -
    51. -
  51. owners -
    52. -
  52. payload_alert_comment -
    53. -
  53. payload_alert_comment_comment -
    54. -
  54. payload_alert_comment_comment_alertId -
    55. -
  55. payload_alert_comment_comment_index -
    56. -
  56. payload_assignees -
    57. -
  57. payload_connector -
    58. -
  58. payload_connector_connector -
    59. -
  59. payload_connector_connector_fields -
    60. -
  60. payload_create_case -
    61. -
  61. payload_description -
    62. -
  62. payload_pushed -
    63. -
  63. payload_settings -
    64. -
  64. payload_severity -
    65. -
  65. payload_status -
    66. -
  66. payload_tags -
    67. -
  67. payload_title -
    68. -
  68. payload_user_comment -
    69. -
  69. payload_user_comment_comment -
    70. -
  70. rule - Alerting rule
    71. -
  71. set_case_configuration_request - Set case configuration request
    72. -
  72. set_case_configuration_request_connector -
    73. -
  73. set_case_configuration_request_settings -
    74. -
  74. settings -
    75. -
  75. severity_property -
    76. -
  76. status -
    77. -
  77. update_alert_comment_request_properties - Update case comment request properties for alerts
    78. -
  78. update_case_comment_request - Update case comment request
    79. -
  79. update_case_configuration_request - Update case configuration request
    80. -
  80. update_case_request - Update case request
    81. -
  81. update_case_request_cases_inner -
    82. -
  82. update_user_comment_request_properties - Update case comment request properties for user comments
    83. -
  83. user_actions_find_response_properties -
    84. -
  84. user_actions_response_properties -
    85. -
  85. user_actions_response_properties_created_by -
    86. -
  86. user_actions_response_properties_payload -
    87. -
  87. user_comment_response_properties - Case response properties for user comments
    88. -
- -
-

4xx_response - Unsuccessful cases API response Up

-
-
-
error (optional)
String
-
message (optional)
String
-
statusCode (optional)
Integer
-
-
-
-

Case_response_properties_for_comments_inner - Up

-
-
-
alertId (optional)
String
-
created_at (optional)
Date format: date-time
-
created_by (optional)
case_response_created_by_properties
-
id (optional)
String
-
index (optional)
String
-
owner (optional)
owners
-
pushed_at (optional)
Date format: date-time
-
pushed_by (optional)
case_response_pushed_by_properties
-
rule (optional)
alert_comment_response_properties_rule
-
type
String
-
Enum:
-
user
-
updated_at (optional)
Date format: date-time
-
updated_by (optional)
case_response_updated_by_properties
-
version (optional)
String
-
comment (optional)
String
-
-
-
-

Case_response_properties_for_connectors - Case response properties for connectors Up

-
-
-
fields
connector_properties_swimlane_fields
-
id
String The identifier for the connector. To retrieve connector IDs, use the find connectors API.
-
name
String The name of the connector.
-
type
String The type of connector.
-
Enum:
-
.swimlane
-
-
-
-

action_types - Up

-
The type of action.
-
-
-
-
-

actions - Up

-
-
-
-
-
-

add_alert_comment_request_properties - Add case comment request properties for alerts Up

-
Defines properties for case comment requests when type is alert.
-
-
alertId
alert_identifiers
-
index
alert_indices
-
owner
owners
-
rule
rule
-
type
String The type of comment.
-
Enum:
-
alert
-
-
-
-

add_case_comment_request - Add case comment request Up

-
The add comment to case API request body varies depending on whether you are adding an alert or a comment.
-
-
alertId
alert_identifiers
-
index
alert_indices
-
owner
owners
-
rule
rule
-
type
String The type of comment.
-
Enum:
-
user
-
comment
String The new comment. It is required only when type is user.
-
-
-
-

add_user_comment_request_properties - Add case comment request properties for user comments Up

-
Defines properties for case comment requests when type is user.
-
-
comment
String The new comment. It is required only when type is user.
-
owner
owners
-
type
String The type of comment.
-
Enum:
-
user
-
-
-
-

alert_comment_response_properties - Add case comment response properties for alerts Up

-
-
-
alertId (optional)
String
-
created_at (optional)
Date format: date-time
-
created_by (optional)
getCaseConfigurationDefaultSpace_200_response_inner_created_by
-
id (optional)
String
-
index (optional)
String
-
owner (optional)
owners
-
pushed_at (optional)
Date format: date-time
-
pushed_by (optional)
getCaseConfigurationDefaultSpace_200_response_inner_updated_by
-
rule (optional)
alert_comment_response_properties_rule
-
type
String
-
Enum:
-
alert
-
updated_at (optional)
Date format: date-time
-
updated_by (optional)
getCaseConfigurationDefaultSpace_200_response_inner_created_by
-
version (optional)
String
-
-
-
-

alert_comment_response_properties_rule - Up

-
-
-
id (optional)
String The rule identifier.
-
name (optional)
String The rule name.
-
-
-
-

alert_identifiers - Alert identifiers Up

-
The alert identifiers. It is required only when type is alert. You can use an array of strings to add multiple alerts to a case, provided that they all relate to the same rule; index must also be an array with the same length or number of elements. Adding multiple alerts in this manner is recommended rather than calling the API multiple times. This functionality is in technical preview and may be changed or removed in a future release. Elastic will apply best effort to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.
-
-
-
-
-

alert_indices - Alert indices Up

-
The alert indices. It is required only when type is alert. If you are adding multiple alerts to a case, use an array of strings; the position of each index name in the array must match the position of the corresponding alert identifier in the alertId array. This functionality is in technical preview and may be changed or removed in a future release. Elastic will apply best effort to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.
-
-
-
-
-

alert_response_properties - Up

-
-
-
attached_at (optional)
Date format: date-time
-
id (optional)
String The alert identifier.
-
index (optional)
String The alert index.
-
-
-
-

assignees_inner - Up

-
-
-
uid
String A unique identifier for the user profile. These identifiers can be found by using the suggest user profile API.
-
-
-
-

case_response_closed_by_properties - Case response properties for closed_by Up

-
-
-
email
String
-
full_name
String
-
username
String
-
profile_uid (optional)
String
-
-
-
-

case_response_created_by_properties - Case response properties for created_by Up

-
-
-
email
String
-
full_name
String
-
username
String
-
profile_uid (optional)
String
-
-
-
-

case_response_properties - Case response properties Up

-
-
-
assignees (optional)
array[assignees_inner] An array containing users that are assigned to the case.
-
closed_at
Date format: date-time
-
closed_by
case_response_closed_by_properties
-
comments
array[Case_response_properties_for_comments_inner] An array of comment objects for the case.
-
connector
Case_response_properties_for_connectors
-
created_at
Date format: date-time
-
created_by
case_response_created_by_properties
-
description
String
-
duration
Integer The elapsed time from the creation of the case to its closure (in seconds). If the case has not been closed, the duration is set to null. If the case was closed after less than half a second, the duration is rounded down to zero.
-
external_service
external_service
-
id
String
-
owner
owners
-
settings
settings
-
severity
severity_property
-
status
status
-
tags
array[String]
-
title
String
-
totalAlerts
Integer
-
totalComment
Integer
-
updated_at
Date format: date-time
-
updated_by
case_response_updated_by_properties
-
version
String
-
-
-
-

case_response_pushed_by_properties - Case response properties for pushed_by Up

-
-
-
email
String
-
full_name
String
-
username
String
-
profile_uid (optional)
String
-
-
-
-

case_response_updated_by_properties - Case response properties for updated_by Up

-
-
-
email
String
-
full_name
String
-
username
String
-
profile_uid (optional)
String
-
-
-
-

closure_types - Up

-
Indicates whether a case is automatically closed when it is pushed to external systems (close-by-pushing) or not automatically closed (close-by-user).
-
-
-
-
-

connector_properties_cases_webhook - Create or upate case request properties for Cases Webhook connector Up

-
Defines properties for connectors when type is .cases-webhook.
-
-
fields
String
-
id
String The identifier for the connector. To retrieve connector IDs, use the find connectors API.
-
name
String The name of the connector.
-
type
String The type of connector.
-
Enum:
-
.cases-webhook
-
-
-
-

connector_properties_jira - Create or update case request properties for a Jira connector Up

-
Defines properties for connectors when type is .jira.
-
-
fields
connector_properties_jira_fields
-
id
String The identifier for the connector. To retrieve connector IDs, use the find connectors API.
-
name
String The name of the connector.
-
type
String The type of connector.
-
Enum:
-
.jira
-
-
-
-

connector_properties_jira_fields - Up

-
An object containing the connector fields. If you want to omit any individual field, specify null as its value.
-
-
issueType
String The type of issue.
-
parent
String The key of the parent issue, when the issue type is sub-task.
-
priority
String The priority of the issue.
-
-
-
-

connector_properties_none - Create or update case request properties for no connector Up

-
Defines properties for connectors when type is .none.
-
-
fields
String An object containing the connector fields. To create a case without a connector, specify null. To update a case to remove the connector, specify null.
-
id
String The identifier for the connector. To create a case without a connector, use none. To update a case to remove the connector, specify none.
-
name
String The name of the connector. To create a case without a connector, use none. To update a case to remove the connector, specify none.
-
type
String The type of connector. To create a case without a connector, use .none. To update a case to remove the connector, specify .none.
-
Enum:
-
.none
-
-
-
-

connector_properties_resilient - Create case request properties for a IBM Resilient connector Up

-
Defines properties for connectors when type is .resilient.
-
-
fields
connector_properties_resilient_fields
-
id
String The identifier for the connector.
-
name
String The name of the connector.
-
type
String The type of connector.
-
Enum:
-
.resilient
-
-
-
-

connector_properties_resilient_fields - Up

-
An object containing the connector fields. If you want to omit any individual field, specify null as its value.
-
-
issueTypes
array[String] The type of incident.
-
severityCode
String The severity code of the incident.
-
-
-
-

connector_properties_servicenow - Create case request properties for a ServiceNow ITSM connector Up

-
Defines properties for connectors when type is .servicenow.
-
-
fields
connector_properties_servicenow_fields
-
id
String The identifier for the connector. To retrieve connector IDs, use the find connectors API.
-
name
String The name of the connector.
-
type
String The type of connector.
-
Enum:
-
.servicenow
-
-
-
-

connector_properties_servicenow_fields - Up

-
An object containing the connector fields. If you want to omit any individual field, specify null as its value.
-
-
category
String The category of the incident.
-
impact
String The effect an incident had on business.
-
severity
String The severity of the incident.
-
subcategory
String The subcategory of the incident.
-
urgency
String The extent to which the incident resolution can be delayed.
-
-
-
-

connector_properties_servicenow_sir - Create case request properties for a ServiceNow SecOps connector Up

-
Defines properties for connectors when type is .servicenow-sir.
-
-
fields
connector_properties_servicenow_sir_fields
-
id
String The identifier for the connector. To retrieve connector IDs, use the find connectors API.
-
name
String The name of the connector.
-
type
String The type of connector.
-
Enum:
-
.servicenow-sir
-
-
-
-

connector_properties_servicenow_sir_fields - Up

-
An object containing the connector fields. If you want to omit any individual field, specify null as its value.
-
-
category
String The category of the incident.
-
destIp
Boolean Indicates whether cases will send a comma-separated list of destination IPs.
-
malwareHash
Boolean Indicates whether cases will send a comma-separated list of malware hashes.
-
malwareUrl
Boolean Indicates whether cases will send a comma-separated list of malware URLs.
-
priority
String The priority of the issue.
-
sourceIp
Boolean Indicates whether cases will send a comma-separated list of source IPs.
-
subcategory
String The subcategory of the incident.
-
-
-
-

connector_properties_swimlane - Create case request properties for a Swimlane connector Up

-
Defines properties for connectors when type is .swimlane.
-
-
fields
connector_properties_swimlane_fields
-
id
String The identifier for the connector. To retrieve connector IDs, use the find connectors API.
-
name
String The name of the connector.
-
type
String The type of connector.
-
Enum:
-
.swimlane
-
-
-
-

connector_properties_swimlane_fields - Up

-
An object containing the connector fields. If you want to omit any individual field, specify null as its value.
-
-
caseId
String The case identifier for Swimlane connectors.
-
-
-
-

connector_types - Up

-
The type of connector.
-
-
-
-
-

create_case_request - Create case request Up

-
The create case API request body varies depending on the type of connector.
-
-
assignees (optional)
array[assignees_inner] An array containing users that are assigned to the case.
-
connector
create_case_request_connector
-
description
String The description for the case.
-
owner
owners
-
settings
settings
-
severity (optional)
severity_property
-
tags
array[String] The words and phrases that help categorize cases. It can be an empty array.
-
title
String A title for the case.
-
-
-
-

create_case_request_connector - Up

-
-
-
fields
connector_properties_swimlane_fields
-
id
String The identifier for the connector. To retrieve connector IDs, use the find connectors API.
-
name
String The name of the connector.
-
type
String The type of connector.
-
Enum:
-
.swimlane
-
-
-
-

external_service - Up

-
-
-
connector_id (optional)
String
-
connector_name (optional)
String
-
external_id (optional)
String
-
external_title (optional)
String
-
external_url (optional)
String
-
pushed_at (optional)
Date format: date-time
-
pushed_by (optional)
getCaseConfigurationDefaultSpace_200_response_inner_updated_by
-
-
-
-

findCaseActivityDefaultSpace_200_response - Up

-
-
-
page (optional)
Integer
-
perPage (optional)
Integer
-
total (optional)
Integer
-
userActions (optional)
array[user_actions_find_response_properties]
-
-
-
-

findCaseConnectorsDefaultSpace_200_response_inner - Up

-
-
-
actionTypeId (optional)
connector_types
-
config (optional)
findCaseConnectorsDefaultSpace_200_response_inner_config
-
id (optional)
String
-
isDeprecated (optional)
Boolean
-
isMissingSecrets (optional)
Boolean
-
isPreconfigured (optional)
Boolean
-
name (optional)
String
-
referencedByCount (optional)
Integer
-
-
-
-

findCaseConnectorsDefaultSpace_200_response_inner_config - Up

-
-
-
apiUrl (optional)
String
-
projectKey (optional)
String
-
-
-
-

findCasesDefaultSpace_200_response - Up

-
-
-
cases (optional)
array[case_response_properties]
-
count_closed_cases (optional)
Integer
-
count_in_progress_cases (optional)
Integer
-
count_open_cases (optional)
Integer
-
page (optional)
Integer
-
per_page (optional)
Integer
-
total (optional)
Integer
-
-
-
-

findCasesDefaultSpace_assignees_parameter - Up

-
-
-
-
-
-

findCasesDefaultSpace_owner_parameter - Up

-
-
-
-
-
-

getCaseCommentDefaultSpace_200_response - Up

-
-
-
alertId (optional)
String
-
created_at (optional)
Date format: date-time
-
created_by (optional)
case_response_created_by_properties
-
id (optional)
String
-
index (optional)
String
-
owner (optional)
owners
-
pushed_at (optional)
Date format: date-time
-
pushed_by (optional)
case_response_pushed_by_properties
-
rule (optional)
alert_comment_response_properties_rule
-
type
String
-
Enum:
-
user
-
updated_at (optional)
Date format: date-time
-
updated_by (optional)
case_response_updated_by_properties
-
version (optional)
String
-
comment (optional)
String
-
-
-
-

getCaseConfigurationDefaultSpace_200_response_inner - Up

-
-
-
closure_type (optional)
closure_types
-
connector (optional)
getCaseConfigurationDefaultSpace_200_response_inner_connector
-
created_at (optional)
Date format: date-time
-
created_by (optional)
getCaseConfigurationDefaultSpace_200_response_inner_created_by
-
error (optional)
String
-
id (optional)
String
-
mappings (optional)
array[getCaseConfigurationDefaultSpace_200_response_inner_mappings_inner]
-
owner (optional)
owners
-
updated_at (optional)
Date format: date-time
-
updated_by (optional)
getCaseConfigurationDefaultSpace_200_response_inner_updated_by
-
version (optional)
String
-
-
-
-

getCaseConfigurationDefaultSpace_200_response_inner_connector - Up

-
-
-
fields (optional)
Object The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to null.
-
id (optional)
String The identifier for the connector. If you do not want a default connector, use none. To retrieve connector IDs, use the find connectors API.
-
name (optional)
String The name of the connector. If you do not want a default connector, use none. To retrieve connector names, use the find connectors API.
-
type (optional)
connector_types
-
-
-
-

getCaseConfigurationDefaultSpace_200_response_inner_created_by - Up

-
-
-
email (optional)
String
-
full_name (optional)
String
-
username (optional)
String
-
profile_uid (optional)
String
-
-
-
-

getCaseConfigurationDefaultSpace_200_response_inner_mappings_inner - Up

-
-
-
action_type (optional)
String
-
source (optional)
String
-
target (optional)
String
-
-
-
-

getCaseConfigurationDefaultSpace_200_response_inner_updated_by - Up

-
-
-
email (optional)
String
-
full_name (optional)
String
-
username (optional)
String
-
profile_uid (optional)
String
-
-
-
-

getCaseStatusDefaultSpace_200_response - Up

-
-
-
count_closed_cases (optional)
Integer
-
count_in_progress_cases (optional)
Integer
-
count_open_cases (optional)
Integer
-
-
-
-

getCasesByAlertDefaultSpace_200_response_inner - Up

-
-
-
id (optional)
String The case identifier.
-
title (optional)
String The case title.
-
-
-
-

owners - Up

-
The application that owns the cases: Stack Management, Observability, or Elastic Security.
-
-
-
-
-

payload_alert_comment - Up

-
-
-
comment (optional)
payload_alert_comment_comment
-
-
-
-

payload_alert_comment_comment - Up

-
-
-
alertId (optional)
payload_alert_comment_comment_alertId
-
index (optional)
payload_alert_comment_comment_index
-
owner (optional)
owners
-
rule (optional)
alert_comment_response_properties_rule
-
type (optional)
String
-
Enum:
-
alert
-
-
-
-

payload_alert_comment_comment_alertId - Up

-
-
-
-
-
-

payload_alert_comment_comment_index - Up

-
-
-
-
-
-

payload_assignees - Up

-
-
-
assignees (optional)
array[assignees_inner] An array containing users that are assigned to the case.
-
-
-
-

payload_connector - Up

-
-
-
connector (optional)
payload_connector_connector
-
-
-
-

payload_connector_connector - Up

-
-
-
fields (optional)
payload_connector_connector_fields
-
id (optional)
String The identifier for the connector. To create a case without a connector, use none.
-
name (optional)
String The name of the connector. To create a case without a connector, use none.
-
type (optional)
connector_types
-
-
-
-

payload_connector_connector_fields - Up

-
An object containing the connector fields. To create a case without a connector, specify null. If you want to omit any individual field, specify null as its value.
-
-
caseId (optional)
String The case identifier for Swimlane connectors.
-
category (optional)
String The category of the incident for ServiceNow ITSM and ServiceNow SecOps connectors.
-
destIp (optional)
Boolean Indicates whether cases will send a comma-separated list of destination IPs for ServiceNow SecOps connectors.
-
impact (optional)
String The effect an incident had on business for ServiceNow ITSM connectors.
-
issueType (optional)
String The type of issue for Jira connectors.
-
issueTypes (optional)
array[String] The type of incident for IBM Resilient connectors.
-
malwareHash (optional)
Boolean Indicates whether cases will send a comma-separated list of malware hashes for ServiceNow SecOps connectors.
-
malwareUrl (optional)
Boolean Indicates whether cases will send a comma-separated list of malware URLs for ServiceNow SecOps connectors.
-
parent (optional)
String The key of the parent issue, when the issue type is sub-task for Jira connectors.
-
priority (optional)
String The priority of the issue for Jira and ServiceNow SecOps connectors.
-
severity (optional)
String The severity of the incident for ServiceNow ITSM connectors.
-
severityCode (optional)
String The severity code of the incident for IBM Resilient connectors.
-
sourceIp (optional)
Boolean Indicates whether cases will send a comma-separated list of source IPs for ServiceNow SecOps connectors.
-
subcategory (optional)
String The subcategory of the incident for ServiceNow ITSM connectors.
-
urgency (optional)
String The extent to which the incident resolution can be delayed for ServiceNow ITSM connectors.
-
-
-
-

payload_create_case - Up

-
-
-
assignees (optional)
array[assignees_inner] An array containing users that are assigned to the case.
-
connector (optional)
payload_connector_connector
-
description (optional)
String
-
owner (optional)
owners
-
settings (optional)
settings
-
severity (optional)
severity_property
-
status (optional)
status
-
tags (optional)
array[String]
-
title (optional)
String
-
-
-
-

payload_description - Up

-
-
-
description (optional)
String
-
-
-
-

payload_pushed - Up

-
-
-
externalService (optional)
external_service
-
-
-
-

payload_settings - Up

-
-
-
settings (optional)
settings
-
-
-
-

payload_severity - Up

-
-
-
severity (optional)
severity_property
-
-
-
-

payload_status - Up

-
-
-
status (optional)
status
-
-
-
-

payload_tags - Up

-
-
-
tags (optional)
array[String]
-
-
-
-

payload_title - Up

-
-
-
title (optional)
String
-
-
-
-

payload_user_comment - Up

-
-
-
comment (optional)
payload_user_comment_comment
-
-
-
-

payload_user_comment_comment - Up

-
-
-
comment (optional)
String
-
owner (optional)
owners
-
type (optional)
String
-
Enum:
-
user
-
-
-
-

rule - Alerting rule Up

-
The rule that is associated with the alerts. It is required only when type is alert. This functionality is in technical preview and may be changed or removed in a future release. Elastic will apply best effort to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.
-
-
id (optional)
String The rule identifier.
-
name (optional)
String The rule name.
-
-
-
-

set_case_configuration_request - Set case configuration request Up

-
External connection details, such as the closure type and default connector for cases.
-
-
closure_type
closure_types
-
connector
set_case_configuration_request_connector
-
owner
owners
-
settings (optional)
set_case_configuration_request_settings
-
-
-
-

set_case_configuration_request_connector - Up

-
An object that contains the connector configuration.
-
-
fields
Object The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to null.
-
id
String The identifier for the connector. If you do not want a default connector, use none. To retrieve connector IDs, use the find connectors API.
-
name
String The name of the connector. If you do not want a default connector, use none. To retrieve connector names, use the find connectors API.
-
type
connector_types
-
-
-
-

set_case_configuration_request_settings - Up

-
An object that contains the case settings.
-
-
syncAlerts
Boolean Turns alert syncing on or off.
-
-
-
-

settings - Up

-
An object that contains the case settings.
-
-
syncAlerts
Boolean Turns alert syncing on or off.
-
-
-
-

severity_property - Up

-
The severity of the case.
-
-
-
-
-

status - Up

-
The status of the case.
-
-
-
-
-

update_alert_comment_request_properties - Update case comment request properties for alerts Up

-
Defines properties for case comment requests when type is alert.
-
-
alertId
alert_identifiers
-
id
String The identifier for the comment. To retrieve comment IDs, use the get comments API.
-
index
alert_indices
-
owner
owners
-
rule
rule
-
type
String The type of comment.
-
Enum:
-
alert
-
version
String The current comment version. To retrieve version values, use the get comments API.
-
-
-
-

update_case_comment_request - Update case comment request Up

-
The update case comment API request body varies depending on whether you are updating an alert or a comment.
-
-
alertId
alert_identifiers
-
id
String The identifier for the comment. To retrieve comment IDs, use the get comments API.
-
index
alert_indices
-
owner
owners
-
rule
rule
-
type
String The type of comment.
-
Enum:
-
user
-
version
String The current comment version. To retrieve version values, use the get comments API.
-
comment
String The new comment. It is required only when type is user.
-
-
-
-

update_case_configuration_request - Update case configuration request Up

-
External connection details, such as the closure type and default connector for cases.
-
-
closure_type (optional)
closure_types
-
connector (optional)
set_case_configuration_request_connector
-
version
String The version of the connector. To retrieve the version value, use the get configuration API.
-
-
-
-

update_case_request - Update case request Up

-
The update case API request body varies depending on the type of connector.
-
-
cases
array[update_case_request_cases_inner] An array containing one or more case objects.
-
-
-
-

update_case_request_cases_inner - Up

-
-
-
assignees (optional)
array[assignees_inner] An array containing users that are assigned to the case.
-
connector (optional)
create_case_request_connector
-
description (optional)
String An updated description for the case.
-
id
String The identifier for the case.
-
settings (optional)
settings
-
severity (optional)
severity_property
-
status (optional)
status
-
tags (optional)
array[String] The words and phrases that help categorize cases.
-
title (optional)
String A title for the case.
-
version
String The current version of the case. To determine this value, use the get case or find cases APIs.
-
-
-
-

update_user_comment_request_properties - Update case comment request properties for user comments Up

-
Defines properties for case comment requests when type is user.
-
-
comment
String The new comment. It is required only when type is user.
-
id
String The identifier for the comment. To retrieve comment IDs, use the get comments API.
-
owner
owners
-
type
String The type of comment.
-
Enum:
-
user
-
version
String The current comment version. To retrieve version values, use the get comments API.
-
-
-
-

user_actions_find_response_properties - Up

-
-
-
action
actions
-
comment_id
String
-
created_at
Date format: date-time
-
created_by
user_actions_response_properties_created_by
-
id
String
-
owner
owners
-
payload
user_actions_response_properties_payload
-
version
String
-
type
String The type of action.
-
Enum:
-
assignees
create_case
comment
connector
description
pushed
tags
title
status
settings
severity
-
-
-
-

user_actions_response_properties - Up

-
-
-
action
actions
-
action_id
String
-
case_id
String
-
comment_id
String
-
created_at
Date format: date-time
-
created_by
user_actions_response_properties_created_by
-
owner
owners
-
payload
user_actions_response_properties_payload
-
type
action_types
-
-
-
-

user_actions_response_properties_created_by - Up

-
-
-
email
String
-
full_name
String
-
username
String
-
profile_uid (optional)
String
-
-
-
-

user_actions_response_properties_payload - Up

-
-
-
comment (optional)
payload_user_comment_comment
-
assignees (optional)
array[assignees_inner] An array containing users that are assigned to the case.
-
connector (optional)
payload_connector_connector
-
description (optional)
String
-
owner (optional)
owners
-
settings (optional)
settings
-
severity (optional)
severity_property
-
status (optional)
status
-
tags (optional)
array[String]
-
title (optional)
String
-
externalService (optional)
external_service
-
-
-
-

user_comment_response_properties - Case response properties for user comments Up

-
-
-
comment (optional)
String
-
created_at (optional)
Date format: date-time
-
created_by (optional)
case_response_created_by_properties
-
id (optional)
String
-
owner (optional)
owners
-
pushed_at (optional)
Date format: date-time
-
pushed_by (optional)
case_response_pushed_by_properties
-
type
String
-
Enum:
-
user
-
updated_at (optional)
Date format: date-time
-
updated_by (optional)
case_response_updated_by_properties
-
version (optional)
String
-
-
-
-++++ diff --git a/docs/api-generated/cases/case-apis.asciidoc b/docs/api-generated/cases/case-apis.asciidoc deleted file mode 100644 index fdd9a941a58e6..0000000000000 --- a/docs/api-generated/cases/case-apis.asciidoc +++ /dev/null @@ -1,10 +0,0 @@ -[[case-apis]] -== Case APIs - -preview::[] - -//// -This file includes content that has been generated from https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/docs/openapi. Any modifications required must be done in that open API specification. -//// - -include::case-apis-passthru.asciidoc[] \ No newline at end of file diff --git a/docs/api-generated/connectors/connector-apis-passthru.asciidoc b/docs/api-generated/connectors/connector-apis-passthru.asciidoc deleted file mode 100644 index 0be4bbd800634..0000000000000 --- a/docs/api-generated/connectors/connector-apis-passthru.asciidoc +++ /dev/null @@ -1,2478 +0,0 @@ -//// -This content is generated from the open API specification. -Any modifications made to this file will be overwritten. -//// - -++++ -
-

Access

-
    -
  1. APIKey KeyParamName:ApiKey KeyInQuery:false KeyInHeader:true
    2. -
  2. HTTP Basic Authentication
    3. -
- -

Methods

- [ Jump to Models ] - -

Table of Contents

-
-

Connectors

- - -

Connectors

-
-
- Up - 
post /s/{spaceId}/api/actions/connector
-
Creates a connector. (createConnector)
-
You must have all privileges for the Actions and Connectors feature in the Management section of the Kibana feature privileges.
- -

Path parameters

-
-
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- -

Consumes

- This API call consumes the following media types via the Content-Type request header: -
    -
  • application/json
    • -
- -

Request body

-
-
Create_connector_request_body_properties Create_connector_request_body_properties (required)
- -
Body Parameter —
- -
- -

Request headers

-
-
kbn-xsrf (required)
- -
Header Parameter — Cross-site request forgery protection default: null
- -
- - - -

Return type

-
- connector_response_properties - -
- - - -

Example data

-
Content-Type: application/json
- 
null
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - connector_response_properties -

401

- Authorization information is missing or invalid. - Unauthorized_response -
-
-
-
- Up - 
post /s/{spaceId}/api/actions/connector/{connectorId}
-
Creates a connector. (createConnectorId)
-
You must have all privileges for the Actions and Connectors feature in the Management section of the Kibana feature privileges.
- -

Path parameters

-
-
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
connectorId (required)
- -
Path Parameter — A UUID v1 or v4 identifier for the connector. If you omit this parameter, an identifier is randomly generated. default: null
-
- -

Consumes

- This API call consumes the following media types via the Content-Type request header: -
    -
  • application/json
    • -
- -

Request body

-
-
Create_connector_request_body_properties Create_connector_request_body_properties (required)
- -
Body Parameter —
- -
- -

Request headers

-
-
kbn-xsrf (required)
- -
Header Parameter — Cross-site request forgery protection default: null
- -
- - - -

Return type

-
- connector_response_properties - -
- - - -

Example data

-
Content-Type: application/json
- 
null
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - connector_response_properties -

401

- Authorization information is missing or invalid. - Unauthorized_response -
-
-
-
- Up - 
delete /s/{spaceId}/api/actions/connector/{connectorId}
-
Deletes a connector. (deleteConnector)
-
You must have all privileges for the Actions and Connectors feature in the Management section of the Kibana feature privileges. WARNING: When you delete a connector, it cannot be recovered.
- -

Path parameters

-
-
connectorId (required)
- -
Path Parameter — An identifier for the connector. default: null
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- - - -

Request headers

-
-
kbn-xsrf (required)
- -
Header Parameter — Cross-site request forgery protection default: null
- -
- - - - - - - -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

204

- Indicates a successful call. - -

401

- Authorization information is missing or invalid. - Unauthorized_response -

404

- Object is not found. - getConnector_404_response -
-
-
-
- Up - 
get /s/{spaceId}/api/actions/connector/{connectorId}
-
Retrieves a connector by ID. (getConnector)
-
You must have read privileges for the Actions and Connectors feature in the Management section of the Kibana feature privileges.
- -

Path parameters

-
-
connectorId (required)
- -
Path Parameter — An identifier for the connector. default: null
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- - - - - - -

Return type

-
- connector_response_properties - -
- - - -

Example data

-
Content-Type: application/json
- 
null
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - connector_response_properties -

401

- Authorization information is missing or invalid. - Unauthorized_response -

404

- Object is not found. - getConnector_404_response -
-
-
-
- Up - 
get /s/{spaceId}/api/actions/connector_types
-
Retrieves a list of all connector types. (getConnectorTypes)
-
You do not need any Kibana feature privileges to run this API.
- -

Path parameters

-
-
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- - - - -

Query parameters

-
-
feature_id (optional)
- -
Query Parameter — A filter to limit the retrieved connector types to those that support a specific feature (such as alerting or cases). default: null
-
- - -

Return type

-
- array[Get_connector_types_response_body_properties_inner] - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "supported_feature_ids" : [ "alerting", "uptime", "siem" ],
-  "name" : "Index",
-  "enabled_in_license" : true,
-  "id" : ".server-log",
-  "enabled_in_config" : true,
-  "minimum_license_required" : "basic",
-  "enabled" : true
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - -

401

- Authorization information is missing or invalid. - Unauthorized_response -
-
-
-
- Up - 
get /s/{spaceId}/api/actions/connectors
-
Retrieves all connectors. (getConnectors)
-
You must have read privileges for the Actions and Connectors feature in the Management section of the Kibana feature privileges.
- -

Path parameters

-
-
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- - - - - - -

Return type

-
- array[Get_connectors_response_body_properties] - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "is_missing_secrets" : false,
-  "is_deprecated" : false,
-  "is_preconfigured" : false,
-  "name" : "my-connector",
-  "referenced_by_count" : 2,
-  "id" : "b0766e10-d190-11ec-b04c-776c77d14fca",
-  "config" : {
-    "key" : ""
-  },
-  "connector_type_id" : ".server-log"
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - -

401

- Authorization information is missing or invalid. - Unauthorized_response -
-
-
-
- Up - 
post /s/{spaceId}/api/actions
-
Creates a connector. (legacyCreateConnector)
-
Deprecated in 7.13.0. Use the create connector API instead.
- -

Path parameters

-
-
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- -

Consumes

- This API call consumes the following media types via the Content-Type request header: -
    -
  • application/json
    • -
- -

Request body

-
-
Legacy_create_connector_request_properties Legacy_create_connector_request_properties (required)
- -
Body Parameter —
- -
- -

Request headers

-
-
kbn-xsrf (required)
- -
Header Parameter — Cross-site request forgery protection default: null
- -
- - - -

Return type

-
- action_response_properties - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "isPreconfigured" : true,
-  "isDeprecated" : true,
-  "actionTypeId" : "actionTypeId",
-  "name" : "name",
-  "id" : "id",
-  "config" : "{}",
-  "isMissingSecrets" : true
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - action_response_properties -

401

- Authorization information is missing or invalid. - Unauthorized_response -
-
-
-
- Up - 
delete /s/{spaceId}/api/actions/action/{actionId}
-
Deletes a connector. (legacyDeleteConnector)
-
Deprecated in 7.13.0. Use the delete connector API instead. WARNING: When you delete a connector, it cannot be recovered.
- -

Path parameters

-
-
actionId (required)
- -
Path Parameter — An identifier for the action. default: null
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- - - -

Request headers

-
-
kbn-xsrf (required)
- -
Header Parameter — Cross-site request forgery protection default: null
- -
- - - - - - - -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

204

- Indicates a successful call. - -

401

- Authorization information is missing or invalid. - Unauthorized_response -
-
-
-
- Up - 
get /s/{spaceId}/api/actions/action/{actionId}
-
Retrieves a connector by ID. (legacyGetConnector)
-
Deprecated in 7.13.0. Use the get connector API instead.
- -

Path parameters

-
-
actionId (required)
- -
Path Parameter — An identifier for the action. default: null
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- - - - - - -

Return type

-
- action_response_properties - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "isPreconfigured" : true,
-  "isDeprecated" : true,
-  "actionTypeId" : "actionTypeId",
-  "name" : "name",
-  "id" : "id",
-  "config" : "{}",
-  "isMissingSecrets" : true
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - action_response_properties -

401

- Authorization information is missing or invalid. - Unauthorized_response -
-
-
-
- Up - 
get /s/{spaceId}/api/actions/list_action_types
-
Retrieves a list of all connector types. (legacyGetConnectorTypes)
-
Deprecated in 7.13.0. Use the get all connector types API instead.
- -

Path parameters

-
-
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- - - - - - -

Return type

-
- array[Legacy_get_connector_types_response_body_properties_inner] - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "enabledInConfig" : true,
-  "name" : "name",
-  "enabledInLicense" : true,
-  "id" : "id",
-  "minimumLicenseRequired" : "minimumLicenseRequired",
-  "enabled" : true
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - -

401

- Authorization information is missing or invalid. - Unauthorized_response -
-
-
-
- Up - 
get /s/{spaceId}/api/actions
-
Retrieves all connectors. (legacyGetConnectors)
-
Deprecated in 7.13.0. Use the get all connectors API instead.
- -

Path parameters

-
-
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- - - - - - -

Return type

-
- array[action_response_properties] - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "isPreconfigured" : true,
-  "isDeprecated" : true,
-  "actionTypeId" : "actionTypeId",
-  "name" : "name",
-  "id" : "id",
-  "config" : "{}",
-  "isMissingSecrets" : true
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - -

401

- Authorization information is missing or invalid. - Unauthorized_response -
-
-
-
- Up - 
post /s/{spaceId}/api/actions/action/{actionId}/_execute
-
Runs a connector. (legacyRunConnector)
-
Deprecated in 7.13.0. Use the run connector API instead.
- -

Path parameters

-
-
actionId (required)
- -
Path Parameter — An identifier for the action. default: null
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- -

Consumes

- This API call consumes the following media types via the Content-Type request header: -
    -
  • application/json
    • -
- -

Request body

-
-
Legacy_run_connector_request_body_properties Legacy_run_connector_request_body_properties (required)
- -
Body Parameter —
- -
- -

Request headers

-
-
kbn-xsrf (required)
- -
Header Parameter — Cross-site request forgery protection default: null
- -
- - - -

Return type

-
- legacyRunConnector_200_response - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "actionId" : "actionId",
-  "status" : "status"
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - legacyRunConnector_200_response -

401

- Authorization information is missing or invalid. - Unauthorized_response -
-
-
-
- Up - 
put /s/{spaceId}/api/actions/action/{actionId}
-
Updates the attributes for a connector. (legacyUpdateConnector)
-
Deprecated in 7.13.0. Use the update connector API instead.
- -

Path parameters

-
-
actionId (required)
- -
Path Parameter — An identifier for the action. default: null
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- -

Consumes

- This API call consumes the following media types via the Content-Type request header: -
    -
  • application/json
    • -
- -

Request body

-
-
Legacy_update_connector_request_body_properties Legacy_update_connector_request_body_properties (required)
- -
Body Parameter —
- -
- -

Request headers

-
-
kbn-xsrf (required)
- -
Header Parameter — Cross-site request forgery protection default: null
- -
- - - -

Return type

-
- action_response_properties - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "isPreconfigured" : true,
-  "isDeprecated" : true,
-  "actionTypeId" : "actionTypeId",
-  "name" : "name",
-  "id" : "id",
-  "config" : "{}",
-  "isMissingSecrets" : true
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - action_response_properties -

404

- Object is not found. - Not_found_response -
-
-
-
- Up - 
post /s/{spaceId}/api/actions/connector/{connectorId}/_execute
-
Runs a connector. (runConnector)
-
You can use this API to test an action that involves interaction with Kibana services or integrations with third-party systems. You must have read privileges for the Actions and Connectors feature in the Management section of the Kibana feature privileges. If you use an index connector, you must also have all, create, index, or write indices privileges.
- -

Path parameters

-
-
connectorId (required)
- -
Path Parameter — An identifier for the connector. default: null
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- -

Consumes

- This API call consumes the following media types via the Content-Type request header: -
    -
  • application/json
    • -
- -

Request body

-
-
Run_connector_request_body_properties Run_connector_request_body_properties (required)
- -
Body Parameter —
- -
- -

Request headers

-
-
kbn-xsrf (required)
- -
Header Parameter — Cross-site request forgery protection default: null
- -
- - - -

Return type

-
- runConnector_200_response - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "connector_id" : "connector_id",
-  "status" : "error"
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - runConnector_200_response -

401

- Authorization information is missing or invalid. - Unauthorized_response -
-
-
-
- Up - 
put /s/{spaceId}/api/actions/connector/{connectorId}
-
Updates the attributes for a connector. (updateConnector)
-
You must have all privileges for the Actions and Connectors feature in the Management section of the Kibana feature privileges.
- -

Path parameters

-
-
connectorId (required)
- -
Path Parameter — An identifier for the connector. default: null
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- -

Consumes

- This API call consumes the following media types via the Content-Type request header: -
    -
  • application/json
    • -
- -

Request body

-
-
Update_connector_request_body_properties Update_connector_request_body_properties (required)
- -
Body Parameter —
- -
- -

Request headers

-
-
kbn-xsrf (required)
- -
Header Parameter — Cross-site request forgery protection default: null
- -
- - - -

Return type

-
- connector_response_properties - -
- - - -

Example data

-
Content-Type: application/json
- 
null
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - connector_response_properties -

400

- Indicates a bad request. - updateConnector_400_response -

401

- Authorization information is missing or invalid. - Unauthorized_response -

404

- Object is not found. - Not_found_response -
-
- -

Models

- [ Jump to Methods ] - -

Table of Contents

-
    -
  1. Alert_identifier_mapping - Alert identifier mapping
    2. -
  2. Case_comment_mapping - Case comment mapping
    3. -
  3. Case_description_mapping - Case description mapping
    4. -
  4. Case_identifier_mapping - Case identifier mapping
    5. -
  5. Case_name_mapping - Case name mapping
    6. -
  6. Connector_mappings_properties_for_a_Swimlane_connector - Connector mappings properties for a Swimlane connector
    7. -
  7. Create_connector_request_body_properties - Create connector request body properties
    8. -
  8. Get_connector_types_response_body_properties_inner -
    9. -
  9. Get_connectors_response_body_properties - Get connectors response body properties
    10. -
  10. Legacy_create_connector_request_properties - Legacy create connector request properties
    11. -
  11. Legacy_get_connector_types_response_body_properties_inner -
    12. -
  12. Legacy_run_connector_request_body_properties - Legacy run connector request body properties
    13. -
  13. Legacy_update_connector_request_body_properties - Legacy update connector request body properties
    14. -
  14. Not_found_response - Not found response
    15. -
  15. Rule_name_mapping - Rule name mapping
    16. -
  16. Run_connector_request_body_properties - Run connector request body properties
    17. -
  17. Run_connector_request_body_properties_params -
    18. -
  18. Severity_mapping - Severity mapping
    19. -
  19. Subaction_parameters - Subaction parameters
    20. -
  20. Unauthorized_response - Unauthorized response
    21. -
  21. Update_connector_request_body_properties - Update connector request body properties
    22. -
  22. action_response_properties - Action response properties
    23. -
  23. config_properties_cases_webhook - Connector request properties for Webhook - Case Management connector
    24. -
  24. config_properties_genai - Connector request properties for a generative AI connector
    25. -
  25. config_properties_index - Connector request properties for an index connector
    26. -
  26. config_properties_jira - Connector request properties for a Jira connector
    27. -
  27. config_properties_opsgenie - Connector request properties for an Opsgenie connector
    28. -
  28. config_properties_resilient - Connector request properties for a IBM Resilient connector
    29. -
  29. config_properties_servicenow - Connector request properties for a ServiceNow ITSM connector
    30. -
  30. config_properties_servicenow_itom - Connector request properties for a ServiceNow ITSM connector
    31. -
  31. config_properties_swimlane - Connector request properties for a Swimlane connector
    32. -
  32. connector_response_properties - Connector response properties
    33. -
  33. connector_response_properties_cases_webhook - Connector request properties for a Webhook - Case Management connector
    34. -
  34. connector_response_properties_email - Connector response properties for an email connector
    35. -
  35. connector_response_properties_index - Connector response properties for an index connector
    36. -
  36. connector_response_properties_jira - Connector response properties for a Jira connector
    37. -
  37. connector_response_properties_opsgenie - Connector response properties for an Opsgenie connector
    38. -
  38. connector_response_properties_pagerduty - Connector response properties for a PagerDuty connector
    39. -
  39. connector_response_properties_resilient - Connector response properties for a IBM Resilient connector
    40. -
  40. connector_response_properties_serverlog - Connector response properties for a server log connector
    41. -
  41. connector_response_properties_servicenow - Connector response properties for a ServiceNow ITSM connector
    42. -
  42. connector_response_properties_servicenow_itom - Connector response properties for a ServiceNow ITOM connector
    43. -
  43. connector_response_properties_servicenow_sir - Connector response properties for a ServiceNow SecOps connector
    44. -
  44. connector_response_properties_slack_api - Connector response properties for a Slack connector
    45. -
  45. connector_response_properties_slack_webhook - Connector response properties for a Slack connector
    46. -
  46. connector_response_properties_swimlane - Connector response properties for a Swimlane connector
    47. -
  47. connector_response_properties_teams - Connector response properties for a Microsoft Teams connector
    48. -
  48. connector_response_properties_tines - Connector response properties for a Tines connector
    49. -
  49. connector_response_properties_webhook - Connector response properties for a Webhook connector
    50. -
  50. connector_response_properties_xmatters - Connector response properties for an xMatters connector
    51. -
  51. connector_types - Connector types
    52. -
  52. create_connector_request_cases_webhook - Create Webhook - Case Managment connector request
    53. -
  53. create_connector_request_email - Create email connector request
    54. -
  54. create_connector_request_genai - Create generative AI connector request
    55. -
  55. create_connector_request_index - Create index connector request
    56. -
  56. create_connector_request_jira - Create Jira connector request
    57. -
  57. create_connector_request_opsgenie - Create Opsgenie connector request
    58. -
  58. create_connector_request_pagerduty - Create PagerDuty connector request
    59. -
  59. create_connector_request_resilient - Create IBM Resilient connector request
    60. -
  60. create_connector_request_serverlog - Create server log connector request
    61. -
  61. create_connector_request_servicenow - Create ServiceNow ITSM connector request
    62. -
  62. create_connector_request_servicenow_itom - Create ServiceNow ITOM connector request
    63. -
  63. create_connector_request_servicenow_sir - Create ServiceNow SecOps connector request
    64. -
  64. create_connector_request_slack_api - Create Slack connector request
    65. -
  65. create_connector_request_slack_webhook - Create Slack connector request
    66. -
  66. create_connector_request_swimlane - Create Swimlane connector request
    67. -
  67. create_connector_request_teams - Create Microsoft Teams connector request
    68. -
  68. create_connector_request_tines - Create Tines connector request
    69. -
  69. create_connector_request_webhook - Create Webhook connector request
    70. -
  70. create_connector_request_xmatters - Create xMatters connector request
    71. -
  71. features -
    72. -
  72. getConnector_404_response -
    73. -
  73. legacyRunConnector_200_response -
    74. -
  74. runConnector_200_response -
    75. -
  75. runConnector_200_response_data -
    76. -
  76. run_connector_params_documents - Index connector parameters
    77. -
  77. run_connector_params_level_message - Server log connector parameters
    78. -
  78. run_connector_subaction_addevent - The addEvent subaction
    79. -
  79. run_connector_subaction_addevent_subActionParams -
    80. -
  80. run_connector_subaction_closealert - The closeAlert subaction
    81. -
  81. run_connector_subaction_closealert_subActionParams -
    82. -
  82. run_connector_subaction_createalert - The createAlert subaction
    83. -
  83. run_connector_subaction_createalert_subActionParams -
    84. -
  84. run_connector_subaction_createalert_subActionParams_responders_inner -
    85. -
  85. run_connector_subaction_createalert_subActionParams_visibleTo_inner -
    86. -
  86. run_connector_subaction_fieldsbyissuetype - The fieldsByIssueType subaction
    87. -
  87. run_connector_subaction_fieldsbyissuetype_subActionParams -
    88. -
  88. run_connector_subaction_getchoices - The getChoices subaction
    89. -
  89. run_connector_subaction_getchoices_subActionParams -
    90. -
  90. run_connector_subaction_getfields - The getFields subaction
    91. -
  91. run_connector_subaction_getincident - The getIncident subaction
    92. -
  92. run_connector_subaction_getincident_subActionParams -
    93. -
  93. run_connector_subaction_issue - The issue subaction
    94. -
  94. run_connector_subaction_issue_subActionParams -
    95. -
  95. run_connector_subaction_issues - The issues subaction
    96. -
  96. run_connector_subaction_issues_subActionParams -
    97. -
  97. run_connector_subaction_issuetypes - The issueTypes subaction
    98. -
  98. run_connector_subaction_pushtoservice - The pushToService subaction
    99. -
  99. run_connector_subaction_pushtoservice_subActionParams -
    100. -
  100. run_connector_subaction_pushtoservice_subActionParams_comments_inner -
    101. -
  101. run_connector_subaction_pushtoservice_subActionParams_incident -
    102. -
  102. run_connector_subaction_pushtoservice_subActionParams_incident_dest_ip -
    103. -
  103. run_connector_subaction_pushtoservice_subActionParams_incident_malware_hash -
    104. -
  104. run_connector_subaction_pushtoservice_subActionParams_incident_malware_url -
    105. -
  105. run_connector_subaction_pushtoservice_subActionParams_incident_source_ip -
    106. -
  106. secrets_properties_cases_webhook - Connector secrets properties for Webhook - Case Management connector
    107. -
  107. secrets_properties_genai - Connector secrets properties for a generative AI connector
    108. -
  108. secrets_properties_jira - Connector secrets properties for a Jira connector
    109. -
  109. secrets_properties_opsgenie - Connector secrets properties for an Opsgenie connector
    110. -
  110. secrets_properties_resilient - Connector secrets properties for IBM Resilient connector
    111. -
  111. secrets_properties_servicenow - Connector secrets properties for ServiceNow ITOM, ServiceNow ITSM, and ServiceNow SecOps connectors
    112. -
  112. secrets_properties_slack_api - Connector secrets properties for a Web API Slack connector
    113. -
  113. secrets_properties_slack_webhook - Connector secrets properties for a Webhook Slack connector
    114. -
  114. secrets_properties_swimlane - Connector secrets properties for a Swimlane connector
    115. -
  115. updateConnector_400_response -
    116. -
  116. update_connector_request_cases_webhook - Update Webhook - Case Managment connector request
    117. -
  117. update_connector_request_index - Update index connector request
    118. -
  118. update_connector_request_jira - Update Jira connector request
    119. -
  119. update_connector_request_opsgenie - Update Opsgenie connector request
    120. -
  120. update_connector_request_resilient - Update IBM Resilient connector request
    121. -
  121. update_connector_request_serverlog - Update server log connector request
    122. -
  122. update_connector_request_servicenow - Update ServiceNow ITSM connector or ServiceNow SecOps request
    123. -
  123. update_connector_request_servicenow_itom - Create ServiceNow ITOM connector request
    124. -
  124. update_connector_request_slack_api - Update Slack connector request
    125. -
  125. update_connector_request_slack_webhook - Update Slack connector request
    126. -
  126. update_connector_request_swimlane - Update Swimlane connector request
    127. -
- -
-

Alert_identifier_mapping - Alert identifier mapping Up

-
Mapping for the alert ID.
-
-
fieldType
String The type of field in Swimlane.
-
id
String The identifier for the field in Swimlane.
-
key
String The key for the field in Swimlane.
-
name
String The name of the field in Swimlane.
-
-
-
-

Case_comment_mapping - Case comment mapping Up

-
Mapping for the case comments.
-
-
fieldType
String The type of field in Swimlane.
-
id
String The identifier for the field in Swimlane.
-
key
String The key for the field in Swimlane.
-
name
String The name of the field in Swimlane.
-
-
-
-

Case_description_mapping - Case description mapping Up

-
Mapping for the case description.
-
-
fieldType
String The type of field in Swimlane.
-
id
String The identifier for the field in Swimlane.
-
key
String The key for the field in Swimlane.
-
name
String The name of the field in Swimlane.
-
-
-
-

Case_identifier_mapping - Case identifier mapping Up

-
Mapping for the case ID.
-
-
fieldType
String The type of field in Swimlane.
-
id
String The identifier for the field in Swimlane.
-
key
String The key for the field in Swimlane.
-
name
String The name of the field in Swimlane.
-
-
-
-

Case_name_mapping - Case name mapping Up

-
Mapping for the case name.
-
-
fieldType
String The type of field in Swimlane.
-
id
String The identifier for the field in Swimlane.
-
key
String The key for the field in Swimlane.
-
name
String The name of the field in Swimlane.
-
-
-
-

Connector_mappings_properties_for_a_Swimlane_connector - Connector mappings properties for a Swimlane connector Up

-
The field mapping.
-
-
alertIdConfig (optional)
Alert_identifier_mapping
-
caseIdConfig (optional)
Case_identifier_mapping
-
caseNameConfig (optional)
Case_name_mapping
-
commentsConfig (optional)
Case_comment_mapping
-
descriptionConfig (optional)
Case_description_mapping
-
ruleNameConfig (optional)
Rule_name_mapping
-
severityConfig (optional)
Severity_mapping
-
-
-
-

Create_connector_request_body_properties - Create connector request body properties Up

-
The properties vary depending on the connector type.
-
-
config
map[String, oas_any_type_not_mapped] Defines properties for connectors when type is .xmatters.
-
connector_type_id
String The type of connector.
-
Enum:
-
.xmatters
-
name
String The display name for the connector.
-
secrets
map[String, oas_any_type_not_mapped] Defines secrets for connectors when type is .xmatters.
-
-
-
-

Get_connector_types_response_body_properties_inner - Up

-
-
-
enabled (optional)
Boolean Indicates whether the connector type is enabled in Kibana.
-
enabled_in_config (optional)
Boolean Indicates whether the connector type is enabled in the Kibana .yml file.
-
enabled_in_license (optional)
Boolean Indicates whether the connector is enabled in the license.
-
id (optional)
connector_types
-
minimum_license_required (optional)
String The license that is required to use the connector type.
-
name (optional)
String The name of the connector type.
-
supported_feature_ids (optional)
array[features] The Kibana features that are supported by the connector type.
-
-
-
-

Get_connectors_response_body_properties - Get connectors response body properties Up

-
The properties vary for each connector type.
-
-
connector_type_id
connector_types
-
config (optional)
map[String, oas_any_type_not_mapped] The configuration for the connector. Configuration properties vary depending on the connector type.
-
id
String The identifier for the connector.
-
is_deprecated
Boolean Indicates whether the connector type is deprecated.
-
is_missing_secrets (optional)
Boolean Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type.
-
is_preconfigured
Boolean Indicates whether it is a preconfigured connector. If true, the config and is_missing_secrets properties are omitted from the response.
-
name
String The display name for the connector.
-
referenced_by_count
Integer Indicates the number of saved objects that reference the connector. If is_preconfigured is true, this value is not calculated.
-
-
-
-

Legacy_create_connector_request_properties - Legacy create connector request properties Up

-
-
-
actionTypeId (optional)
String The connector type identifier.
-
config (optional)
Object The configuration for the connector. Configuration properties vary depending on the connector type.
-
name (optional)
String The display name for the connector.
-
secrets (optional)
Object The secrets configuration for the connector. Secrets configuration properties vary depending on the connector type. NOTE: Remember these values. You must provide them each time you update the connector.
-
-
-
-

Legacy_get_connector_types_response_body_properties_inner - Up

-
-
-
enabled (optional)
Boolean Indicates whether the connector type is enabled in Kibana.
-
enabledInConfig (optional)
Boolean Indicates whether the connector type is enabled in the Kibana .yml file.
-
enabledInLicense (optional)
Boolean Indicates whether the connector is enabled in the license.
-
id (optional)
String The unique identifier for the connector type.
-
minimumLicenseRequired (optional)
String The license that is required to use the connector type.
-
name (optional)
String The name of the connector type.
-
-
-
-

Legacy_run_connector_request_body_properties - Legacy run connector request body properties Up

-
The properties vary depending on the connector type.
-
-
params
Object The parameters of the connector. Parameter properties vary depending on the connector type.
-
-
-
-

Legacy_update_connector_request_body_properties - Legacy update connector request body properties Up

-
The properties vary depending on the connector type.
-
-
config (optional)
Object The new connector configuration. Configuration properties vary depending on the connector type.
-
name (optional)
String The new name for the connector.
-
secrets (optional)
Object The updated secrets configuration for the connector. Secrets properties vary depending on the connector type.
-
-
-
-

Not_found_response - Not found response Up

-
-
-
error (optional)
String
-
Enum:
-
Not Found
-
message (optional)
String
-
statusCode (optional)
Integer
-
Enum:
-
404
-
-
-
-

Rule_name_mapping - Rule name mapping Up

-
Mapping for the name of the alert's rule.
-
-
fieldType
String The type of field in Swimlane.
-
id
String The identifier for the field in Swimlane.
-
key
String The key for the field in Swimlane.
-
name
String The name of the field in Swimlane.
-
-
-
-

Run_connector_request_body_properties - Run connector request body properties Up

-
The properties vary depending on the connector type.
-
-
params
Run_connector_request_body_properties_params
-
-
-
-

Run_connector_request_body_properties_params - Up

-
-
-
documents
array[map[String, oas_any_type_not_mapped]] The documents in JSON format for index connectors.
-
level (optional)
String The log level of the message for server log connectors.
-
Enum:
-
debug
error
fatal
info
trace
warn
-
message
String The message for server log connectors.
-
subAction
String The action to test.
-
Enum:
-
pushToService
-
subActionParams
run_connector_subaction_pushtoservice_subActionParams
-
-
-
-

Severity_mapping - Severity mapping Up

-
Mapping for the severity.
-
-
fieldType
String The type of field in Swimlane.
-
id
String The identifier for the field in Swimlane.
-
key
String The key for the field in Swimlane.
-
name
String The name of the field in Swimlane.
-
-
-
-

Subaction_parameters - Subaction parameters Up

-
Test an action that involves a subaction.
-
-
subAction
String The action to test.
-
Enum:
-
pushToService
-
subActionParams
run_connector_subaction_pushtoservice_subActionParams
-
-
-
-

Unauthorized_response - Unauthorized response Up

-
-
-
error (optional)
String
-
Enum:
-
Unauthorized
-
message (optional)
String
-
statusCode (optional)
Integer
-
Enum:
-
401
-
-
-
-

Update_connector_request_body_properties - Update connector request body properties Up

-
The properties vary depending on the connector type.
-
-
config
config_properties_swimlane
-
name
String The display name for the connector.
-
secrets
secrets_properties_swimlane
-
-
-
-

action_response_properties - Action response properties Up

-
The properties vary depending on the action type.
-
-
actionTypeId (optional)
String
-
config (optional)
Object
-
id (optional)
String
-
isDeprecated (optional)
Boolean Indicates whether the action type is deprecated.
-
isMissingSecrets (optional)
Boolean Indicates whether secrets are missing for the action.
-
isPreconfigured (optional)
Boolean Indicates whether it is a preconfigured action.
-
name (optional)
String
-
-
-
-

config_properties_cases_webhook - Connector request properties for Webhook - Case Management connector Up

-
Defines properties for connectors when type is .cases-webhook.
-
-
createCommentJson (optional)
String A JSON payload sent to the create comment URL to create a case comment. You can use variables to add Kibana Cases data to the payload. The required variable is case.comment. Due to Mustache template variables (the text enclosed in triple braces, for example, {{{case.title}}}), the JSON is not validated when you create the connector. The JSON is validated once the Mustache variables have been placed when the REST method runs. Manually ensure that the JSON is valid, disregarding the Mustache variables, so the later validation will pass.
-
createCommentMethod (optional)
String The REST API HTTP request method to create a case comment in the third-party system. Valid values are patch, post, and put.
-
Enum:
-
patch
post
put
-
createCommentUrl (optional)
String The REST API URL to create a case comment by ID in the third-party system. You can use a variable to add the external system ID to the URL. If you are using the xpack.actions.allowedHosts setting, add the hostname to the allowed hosts.
-
createIncidentJson
String A JSON payload sent to the create case URL to create a case. You can use variables to add case data to the payload. Required variables are case.title and case.description. Due to Mustache template variables (which is the text enclosed in triple braces, for example, {{{case.title}}}), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid to avoid future validation errors; disregard Mustache variables during your review.
-
createIncidentMethod (optional)
String The REST API HTTP request method to create a case in the third-party system. Valid values are patch, post, and put.
-
Enum:
-
patch
post
put
-
createIncidentResponseKey
String The JSON key in the create case response that contains the external case ID.
-
createIncidentUrl
String The REST API URL to create a case in the third-party system. If you are using the xpack.actions.allowedHosts setting, add the hostname to the allowed hosts.
-
getIncidentResponseExternalTitleKey
String The JSON key in get case response that contains the external case title.
-
getIncidentUrl
String The REST API URL to get the case by ID from the third-party system. If you are using the xpack.actions.allowedHosts setting, add the hostname to the allowed hosts. You can use a variable to add the external system ID to the URL. Due to Mustache template variables (the text enclosed in triple braces, for example, {{{case.title}}}), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid, disregarding the Mustache variables, so the later validation will pass.
-
hasAuth (optional)
Boolean If true, a username and password for login type authentication must be provided.
-
headers (optional)
String A set of key-value pairs sent as headers with the request URLs for the create case, update case, get case, and create comment methods.
-
updateIncidentJson
String The JSON payload sent to the update case URL to update the case. You can use variables to add Kibana Cases data to the payload. Required variables are case.title and case.description. Due to Mustache template variables (which is the text enclosed in triple braces, for example, {{{case.title}}}), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid to avoid future validation errors; disregard Mustache variables during your review.
-
updateIncidentMethod (optional)
String The REST API HTTP request method to update the case in the third-party system. Valid values are patch, post, and put.
-
Enum:
-
patch
post
put
-
updateIncidentUrl
String The REST API URL to update the case by ID in the third-party system. You can use a variable to add the external system ID to the URL. If you are using the xpack.actions.allowedHosts setting, add the hostname to the allowed hosts.
-
viewIncidentUrl
String The URL to view the case in the external system. You can use variables to add the external system ID or external system title to the URL.
-
-
-
-

config_properties_genai - Connector request properties for a generative AI connector Up

-
Defines properties for connectors when type is .gen-ai.
-
-
apiProvider (optional)
String The OpenAI API provider.
-
apiUrl (optional)
String The OpenAI API endpoint.
-
-
-
-

config_properties_index - Connector request properties for an index connector Up

-
Defines properties for connectors when type is .index.
-
-
executionTimeField (optional)
String Specifies a field that will contain the time the alert condition was detected.
-
index
String The Elasticsearch index to be written to.
-
refresh (optional)
Boolean The refresh policy for the write request, which affects when changes are made visible to search. Refer to the refresh setting for Elasticsearch document APIs.
-
-
-
-

config_properties_jira - Connector request properties for a Jira connector Up

-
Defines properties for connectors when type is .jira.
-
-
apiUrl
String The Jira instance URL.
-
projectKey
String The Jira project key.
-
-
-
-

config_properties_opsgenie - Connector request properties for an Opsgenie connector Up

-
Defines properties for connectors when type is .opsgenie.
-
-
apiUrl
String The Opsgenie URL. For example, https://api.opsgenie.com or https://api.eu.opsgenie.com. If you are using the xpack.actions.allowedHosts setting, add the hostname to the allowed hosts.
-
-
-
-

config_properties_resilient - Connector request properties for a IBM Resilient connector Up

-
Defines properties for connectors when type is .resilient.
-
-
apiUrl
String The IBM Resilient instance URL.
-
orgId
String The IBM Resilient organization ID.
-
-
-
-

config_properties_servicenow - Connector request properties for a ServiceNow ITSM connector Up

-
Defines properties for connectors when type is .servicenow.
-
-
apiUrl
String The ServiceNow instance URL.
-
clientId (optional)
String The client ID assigned to your OAuth application. This property is required when isOAuth is true.
-
isOAuth (optional)
Boolean The type of authentication to use. The default value is false, which means basic authentication is used instead of open authorization (OAuth).
-
jwtKeyId (optional)
String The key identifier assigned to the JWT verifier map of your OAuth application. This property is required when isOAuth is true.
-
userIdentifierValue (optional)
String The identifier to use for OAuth authentication. This identifier should be the user field you selected when you created an OAuth JWT API endpoint for external clients in your ServiceNow instance. For example, if the selected user field is Email, the user identifier should be the user's email address. This property is required when isOAuth is true.
-
usesTableApi (optional)
Boolean Determines whether the connector uses the Table API or the Import Set API. This property is supported only for ServiceNow ITSM and ServiceNow SecOps connectors. NOTE: If this property is set to false, the Elastic application should be installed in ServiceNow.
-
-
-
-

config_properties_servicenow_itom - Connector request properties for a ServiceNow ITSM connector Up

-
Defines properties for connectors when type is .servicenow.
-
-
apiUrl
String The ServiceNow instance URL.
-
clientId (optional)
String The client ID assigned to your OAuth application. This property is required when isOAuth is true.
-
isOAuth (optional)
Boolean The type of authentication to use. The default value is false, which means basic authentication is used instead of open authorization (OAuth).
-
jwtKeyId (optional)
String The key identifier assigned to the JWT verifier map of your OAuth application. This property is required when isOAuth is true.
-
userIdentifierValue (optional)
String The identifier to use for OAuth authentication. This identifier should be the user field you selected when you created an OAuth JWT API endpoint for external clients in your ServiceNow instance. For example, if the selected user field is Email, the user identifier should be the user's email address. This property is required when isOAuth is true.
-
-
-
-

config_properties_swimlane - Connector request properties for a Swimlane connector Up

-
Defines properties for connectors when type is .swimlane.
-
-
apiUrl
String The Swimlane instance URL.
-
appId
String The Swimlane application ID.
-
connectorType
String The type of connector. Valid values are all, alerts, and cases.
-
Enum:
-
all
alerts
cases
-
mappings (optional)
Connector_mappings_properties_for_a_Swimlane_connector
-
-
-
-

connector_response_properties - Connector response properties Up

-
The properties vary depending on the connector type.
-
-
config
map[String, oas_any_type_not_mapped] Defines properties for connectors when type is .xmatters.
-
connector_type_id
String The type of connector.
-
Enum:
-
.xmatters
-
id
String The identifier for the connector.
-
is_deprecated
Boolean Indicates whether the connector type is deprecated.
-
is_missing_secrets (optional)
Boolean Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type.
-
is_preconfigured
Boolean Indicates whether it is a preconfigured connector. If true, the config and is_missing_secrets properties are omitted from the response.
-
name
String The display name for the connector.
-
-
-
-

connector_response_properties_cases_webhook - Connector request properties for a Webhook - Case Management connector Up

-
-
-
config
config_properties_cases_webhook
-
connector_type_id
String The type of connector.
-
Enum:
-
.cases-webhook
-
id
String The identifier for the connector.
-
is_deprecated
Boolean Indicates whether the connector type is deprecated.
-
is_missing_secrets (optional)
Boolean Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type.
-
is_preconfigured
Boolean Indicates whether it is a preconfigured connector. If true, the config and is_missing_secrets properties are omitted from the response.
-
name
String The display name for the connector.
-
-
-
-

connector_response_properties_email - Connector response properties for an email connector Up

-
-
-
config
map[String, oas_any_type_not_mapped] Defines properties for connectors when type is .email.
-
connector_type_id
String The type of connector.
-
Enum:
-
.email
-
id
String The identifier for the connector.
-
is_deprecated
Boolean Indicates whether the connector type is deprecated.
-
is_missing_secrets (optional)
Boolean Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type.
-
is_preconfigured
Boolean Indicates whether it is a preconfigured connector. If true, the config and is_missing_secrets properties are omitted from the response.
-
name
String The display name for the connector.
-
-
-
-

connector_response_properties_index - Connector response properties for an index connector Up

-
-
-
config
config_properties_index
-
connector_type_id
String The type of connector.
-
Enum:
-
.index
-
id
String The identifier for the connector.
-
is_deprecated
Boolean Indicates whether the connector type is deprecated.
-
is_missing_secrets (optional)
Boolean Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type.
-
is_preconfigured
Boolean Indicates whether it is a preconfigured connector. If true, the config and is_missing_secrets properties are omitted from the response.
-
name
String The display name for the connector.
-
-
-
-

connector_response_properties_jira - Connector response properties for a Jira connector Up

-
-
-
config
config_properties_jira
-
connector_type_id
String The type of connector.
-
Enum:
-
.jira
-
id
String The identifier for the connector.
-
is_deprecated
Boolean Indicates whether the connector type is deprecated.
-
is_missing_secrets (optional)
Boolean Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type.
-
is_preconfigured
Boolean Indicates whether it is a preconfigured connector. If true, the config and is_missing_secrets properties are omitted from the response.
-
name
String The display name for the connector.
-
-
-
-

connector_response_properties_opsgenie - Connector response properties for an Opsgenie connector Up

-
-
-
config
config_properties_opsgenie
-
connector_type_id
String The type of connector.
-
Enum:
-
.opsgenie
-
id
String The identifier for the connector.
-
is_deprecated
Boolean Indicates whether the connector type is deprecated.
-
is_missing_secrets (optional)
Boolean Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type.
-
is_preconfigured
Boolean Indicates whether it is a preconfigured connector. If true, the config and is_missing_secrets properties are omitted from the response.
-
name
String The display name for the connector.
-
-
-
-

connector_response_properties_pagerduty - Connector response properties for a PagerDuty connector Up

-
-
-
config
map[String, oas_any_type_not_mapped] Defines properties for connectors when type is .pagerduty.
-
connector_type_id
String The type of connector.
-
Enum:
-
.pagerduty
-
id
String The identifier for the connector.
-
is_deprecated
Boolean Indicates whether the connector type is deprecated.
-
is_missing_secrets (optional)
Boolean Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type.
-
is_preconfigured
Boolean Indicates whether it is a preconfigured connector. If true, the config and is_missing_secrets properties are omitted from the response.
-
name
String The display name for the connector.
-
-
-
-

connector_response_properties_resilient - Connector response properties for a IBM Resilient connector Up

-
-
-
config
config_properties_resilient
-
connector_type_id
String The type of connector.
-
Enum:
-
.resilient
-
id
String The identifier for the connector.
-
is_deprecated
Boolean Indicates whether the connector type is deprecated.
-
is_missing_secrets (optional)
Boolean Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type.
-
is_preconfigured
Boolean Indicates whether it is a preconfigured connector. If true, the config and is_missing_secrets properties are omitted from the response.
-
name
String The display name for the connector.
-
-
-
-

connector_response_properties_serverlog - Connector response properties for a server log connector Up

-
-
-
config
Object
-
connector_type_id
String The type of connector.
-
Enum:
-
.server-log
-
id
String The identifier for the connector.
-
is_deprecated
Boolean Indicates whether the connector type is deprecated.
-
is_missing_secrets (optional)
Boolean Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type.
-
is_preconfigured
Boolean Indicates whether it is a preconfigured connector. If true, the config and is_missing_secrets properties are omitted from the response.
-
name
String The display name for the connector.
-
-
-
-

connector_response_properties_servicenow - Connector response properties for a ServiceNow ITSM connector Up

-
-
-
config
config_properties_servicenow
-
connector_type_id
String The type of connector.
-
Enum:
-
.servicenow
-
id
String The identifier for the connector.
-
is_deprecated
Boolean Indicates whether the connector type is deprecated.
-
is_missing_secrets (optional)
Boolean Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type.
-
is_preconfigured
Boolean Indicates whether it is a preconfigured connector. If true, the config and is_missing_secrets properties are omitted from the response.
-
name
String The display name for the connector.
-
-
-
-

connector_response_properties_servicenow_itom - Connector response properties for a ServiceNow ITOM connector Up

-
-
-
config
config_properties_servicenow_itom
-
connector_type_id
String The type of connector.
-
Enum:
-
.servicenow-itom
-
id
String The identifier for the connector.
-
is_deprecated
Boolean Indicates whether the connector type is deprecated.
-
is_missing_secrets (optional)
Boolean Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type.
-
is_preconfigured
Boolean Indicates whether it is a preconfigured connector. If true, the config and is_missing_secrets properties are omitted from the response.
-
name
String The display name for the connector.
-
-
-
-

connector_response_properties_servicenow_sir - Connector response properties for a ServiceNow SecOps connector Up

-
-
-
config
config_properties_servicenow
-
connector_type_id
String The type of connector.
-
Enum:
-
.servicenow-sir
-
id
String The identifier for the connector.
-
is_deprecated
Boolean Indicates whether the connector type is deprecated.
-
is_missing_secrets (optional)
Boolean Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type.
-
is_preconfigured
Boolean Indicates whether it is a preconfigured connector. If true, the config and is_missing_secrets properties are omitted from the response.
-
name
String The display name for the connector.
-
-
-
-

connector_response_properties_slack_api - Connector response properties for a Slack connector Up

-
-
-
connector_type_id
String The type of connector.
-
Enum:
-
.slack_api
-
id
String The identifier for the connector.
-
is_deprecated
Boolean Indicates whether the connector type is deprecated.
-
is_missing_secrets (optional)
Boolean Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type.
-
is_preconfigured
Boolean Indicates whether it is a preconfigured connector. If true, the config and is_missing_secrets properties are omitted from the response.
-
name
String The display name for the connector.
-
-
-
-

connector_response_properties_slack_webhook - Connector response properties for a Slack connector Up

-
-
-
connector_type_id
String The type of connector.
-
Enum:
-
.slack
-
id
String The identifier for the connector.
-
is_deprecated
Boolean Indicates whether the connector type is deprecated.
-
is_missing_secrets (optional)
Boolean Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type.
-
is_preconfigured
Boolean Indicates whether it is a preconfigured connector. If true, the config and is_missing_secrets properties are omitted from the response.
-
name
String The display name for the connector.
-
-
-
-

connector_response_properties_swimlane - Connector response properties for a Swimlane connector Up

-
-
-
config
config_properties_swimlane
-
connector_type_id
String The type of connector.
-
Enum:
-
.swimlane
-
id
String The identifier for the connector.
-
is_deprecated
Boolean Indicates whether the connector type is deprecated.
-
is_missing_secrets (optional)
Boolean Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type.
-
is_preconfigured
Boolean Indicates whether it is a preconfigured connector. If true, the config and is_missing_secrets properties are omitted from the response.
-
name
String The display name for the connector.
-
-
-
-

connector_response_properties_teams - Connector response properties for a Microsoft Teams connector Up

-
-
-
connector_type_id
String The type of connector.
-
Enum:
-
.teams
-
id
String The identifier for the connector.
-
is_deprecated
Boolean Indicates whether the connector type is deprecated.
-
is_missing_secrets (optional)
Boolean Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type.
-
is_preconfigured
Boolean Indicates whether it is a preconfigured connector. If true, the config and is_missing_secrets properties are omitted from the response.
-
name
String The display name for the connector.
-
-
-
-

connector_response_properties_tines - Connector response properties for a Tines connector Up

-
-
-
config
map[String, oas_any_type_not_mapped] Defines properties for connectors when type is .tines.
-
connector_type_id
String The type of connector.
-
Enum:
-
.tines
-
id
String The identifier for the connector.
-
is_deprecated
Boolean Indicates whether the connector type is deprecated.
-
is_missing_secrets (optional)
Boolean Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type.
-
is_preconfigured
Boolean Indicates whether it is a preconfigured connector. If true, the config and is_missing_secrets properties are omitted from the response.
-
name
String The display name for the connector.
-
-
-
-

connector_response_properties_webhook - Connector response properties for a Webhook connector Up

-
-
-
config
map[String, oas_any_type_not_mapped] Defines properties for connectors when type is .webhook.
-
connector_type_id
String The type of connector.
-
Enum:
-
.webhook
-
id
String The identifier for the connector.
-
is_deprecated
Boolean Indicates whether the connector type is deprecated.
-
is_missing_secrets (optional)
Boolean Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type.
-
is_preconfigured
Boolean Indicates whether it is a preconfigured connector. If true, the config and is_missing_secrets properties are omitted from the response.
-
name
String The display name for the connector.
-
-
-
-

connector_response_properties_xmatters - Connector response properties for an xMatters connector Up

-
-
-
config
map[String, oas_any_type_not_mapped] Defines properties for connectors when type is .xmatters.
-
connector_type_id
String The type of connector.
-
Enum:
-
.xmatters
-
id
String The identifier for the connector.
-
is_deprecated
Boolean Indicates whether the connector type is deprecated.
-
is_missing_secrets (optional)
Boolean Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type.
-
is_preconfigured
Boolean Indicates whether it is a preconfigured connector. If true, the config and is_missing_secrets properties are omitted from the response.
-
name
String The display name for the connector.
-
-
-
-

connector_types - Connector types Up

-
The type of connector. For example, .email, .index, .jira, .opsgenie, or .server-log.
-
-
-
-
-

create_connector_request_cases_webhook - Create Webhook - Case Managment connector request Up

-
The Webhook - Case Management connector uses axios to send POST, PUT, and GET requests to a case management RESTful API web service.
-
-
config
config_properties_cases_webhook
-
connector_type_id
String The type of connector.
-
Enum:
-
.cases-webhook
-
name
String The display name for the connector.
-
secrets (optional)
secrets_properties_cases_webhook
-
-
-
-

create_connector_request_email - Create email connector request Up

-
The email connector uses the SMTP protocol to send mail messages, using an integration of Nodemailer. An exception is Microsoft Exchange, which uses HTTP protocol for sending emails, Send mail. Email message text is sent as both plain text and html text.
-
-
config
map[String, oas_any_type_not_mapped] Defines properties for connectors when type is .email.
-
connector_type_id
String The type of connector.
-
Enum:
-
.email
-
name
String The display name for the connector.
-
secrets
map[String, oas_any_type_not_mapped] Defines secrets for connectors when type is .email.
-
-
-
-

create_connector_request_genai - Create generative AI connector request Up

-
The generative AI connector uses axios to send a POST request to either OpenAI or Azure OpenAPI.
-
-
config
config_properties_genai
-
connector_type_id
String The type of connector.
-
Enum:
-
.gen-ai
-
name
String The display name for the connector.
-
secrets
secrets_properties_genai
-
-
-
-

create_connector_request_index - Create index connector request Up

-
The index connector indexes a document into Elasticsearch.
-
-
config
config_properties_index
-
connector_type_id
String The type of connector.
-
Enum:
-
.index
-
name
String The display name for the connector.
-
-
-
-

create_connector_request_jira - Create Jira connector request Up

-
The Jira connector uses the REST API v2 to create Jira issues.
-
-
config
config_properties_jira
-
connector_type_id
String The type of connector.
-
Enum:
-
.jira
-
name
String The display name for the connector.
-
secrets
secrets_properties_jira
-
-
-
-

create_connector_request_opsgenie - Create Opsgenie connector request Up

-
The Opsgenie connector uses the Opsgenie alert API.
-
-
config
config_properties_opsgenie
-
connector_type_id
String The type of connector.
-
Enum:
-
.opsgenie
-
name
String The display name for the connector.
-
secrets
secrets_properties_opsgenie
-
-
-
-

create_connector_request_pagerduty - Create PagerDuty connector request Up

-
The PagerDuty connector uses the v2 Events API to trigger, acknowledge, and resolve PagerDuty alerts.
-
-
config
map[String, oas_any_type_not_mapped] Defines properties for connectors when type is .pagerduty.
-
connector_type_id
String The type of connector.
-
Enum:
-
.pagerduty
-
name
String The display name for the connector.
-
secrets
map[String, oas_any_type_not_mapped] Defines secrets for connectors when type is .pagerduty.
-
-
-
-

create_connector_request_resilient - Create IBM Resilient connector request Up

-
The IBM Resilient connector uses the RESILIENT REST v2 to create IBM Resilient incidents.
-
-
config
config_properties_resilient
-
connector_type_id
String The type of connector.
-
Enum:
-
.resilient
-
name
String The display name for the connector.
-
secrets
secrets_properties_resilient
-
-
-
-

create_connector_request_serverlog - Create server log connector request Up

-
This connector writes an entry to the Kibana server log.
-
-
connector_type_id
String The type of connector.
-
Enum:
-
.server-log
-
name
String The display name for the connector.
-
-
-
-

create_connector_request_servicenow - Create ServiceNow ITSM connector request Up

-
The ServiceNow ITSM connector uses the import set API to create ServiceNow incidents. You can use the connector for rule actions and cases.
-
-
config
config_properties_servicenow
-
connector_type_id
String The type of connector.
-
Enum:
-
.servicenow
-
name
String The display name for the connector.
-
secrets
secrets_properties_servicenow
-
-
-
-

create_connector_request_servicenow_itom - Create ServiceNow ITOM connector request Up

-
The ServiceNow ITOM connector uses the event API to create ServiceNow events. You can use the connector for rule actions.
-
-
config
config_properties_servicenow_itom
-
connector_type_id
String The type of connector.
-
Enum:
-
.servicenow-itom
-
name
String The display name for the connector.
-
secrets
secrets_properties_servicenow
-
-
-
-

create_connector_request_servicenow_sir - Create ServiceNow SecOps connector request Up

-
The ServiceNow SecOps connector uses the import set API to create ServiceNow security incidents. You can use the connector for rule actions and cases.
-
-
config
config_properties_servicenow
-
connector_type_id
String The type of connector.
-
Enum:
-
.servicenow-sir
-
name
String The display name for the connector.
-
secrets
secrets_properties_servicenow
-
-
-
-

create_connector_request_slack_api - Create Slack connector request Up

-
The Slack connector uses Slack Incoming Webhooks.
-
-
connector_type_id
String The type of connector.
-
Enum:
-
.slack_api
-
name
String The display name for the connector.
-
secrets
secrets_properties_slack_api
-
-
-
-

create_connector_request_slack_webhook - Create Slack connector request Up

-
The Slack connector uses Slack Incoming Webhooks.
-
-
connector_type_id
String The type of connector.
-
Enum:
-
.slack
-
name
String The display name for the connector.
-
secrets
secrets_properties_slack_webhook
-
-
-
-

create_connector_request_swimlane - Create Swimlane connector request Up

-
The Swimlane connector uses the Swimlane REST API to create Swimlane records.
-
-
config
config_properties_swimlane
-
connector_type_id
String The type of connector.
-
Enum:
-
.swimlane
-
name
String The display name for the connector.
-
secrets
secrets_properties_swimlane
-
-
-
-

create_connector_request_teams - Create Microsoft Teams connector request Up

-
The Microsoft Teams connector uses Incoming Webhooks.
-
-
connector_type_id
String The type of connector.
-
Enum:
-
.teams
-
name
String The display name for the connector.
-
secrets
map[String, oas_any_type_not_mapped] Defines secrets for connectors when type is .teams.
-
-
-
-

create_connector_request_tines - Create Tines connector request Up

-
The Tines connector uses Tines Webhook actions to send events via POST request.
-
-
config
map[String, oas_any_type_not_mapped] Defines properties for connectors when type is .tines.
-
connector_type_id
String The type of connector.
-
Enum:
-
.tines
-
name
String The display name for the connector.
-
secrets
map[String, oas_any_type_not_mapped] Defines secrets for connectors when type is .tines.
-
-
-
-

create_connector_request_webhook - Create Webhook connector request Up

-
The Webhook connector uses axios to send a POST or PUT request to a web service.
-
-
config
map[String, oas_any_type_not_mapped] Defines properties for connectors when type is .webhook.
-
connector_type_id
String The type of connector.
-
Enum:
-
.webhook
-
name
String The display name for the connector.
-
secrets
map[String, oas_any_type_not_mapped] Defines secrets for connectors when type is .webhook.
-
-
-
-

create_connector_request_xmatters - Create xMatters connector request Up

-
The xMatters connector uses the xMatters Workflow for Elastic to send actionable alerts to on-call xMatters resources.
-
-
config
map[String, oas_any_type_not_mapped] Defines properties for connectors when type is .xmatters.
-
connector_type_id
String The type of connector.
-
Enum:
-
.xmatters
-
name
String The display name for the connector.
-
secrets
map[String, oas_any_type_not_mapped] Defines secrets for connectors when type is .xmatters.
-
-
-
-

features - Up

-
The feature that uses the connector. Valid values are alerting, cases, uptime, and siem.
-
-
-
-
-

getConnector_404_response - Up

-
-
-
error (optional)
String
-
message (optional)
String
-
statusCode (optional)
Integer
-
-
-
-

legacyRunConnector_200_response - Up

-
-
-
actionId (optional)
String
-
data (optional)
runConnector_200_response_data
-
status (optional)
String The status of the action.
-
-
-
-

runConnector_200_response - Up

-
-
-
connector_id
String The identifier for the connector.
-
data (optional)
runConnector_200_response_data
-
status
String The status of the action.
-
Enum:
-
error
ok
-
-
-
-

runConnector_200_response_data - Up

-
-
-
-
-
-

run_connector_params_documents - Index connector parameters Up

-
Test an action that indexes a document into Elasticsearch.
-
-
documents
array[map[String, oas_any_type_not_mapped]] The documents in JSON format for index connectors.
-
-
-
-

run_connector_params_level_message - Server log connector parameters Up

-
Test an action that writes an entry to the Kibana server log.
-
-
level (optional)
String The log level of the message for server log connectors.
-
Enum:
-
debug
error
fatal
info
trace
warn
-
message
String The message for server log connectors.
-
-
-
-

run_connector_subaction_addevent - The addEvent subaction Up

-
The addEvent subaction for ServiceNow ITOM connectors.
-
-
subAction
String The action to test.
-
Enum:
-
addEvent
-
subActionParams (optional)
run_connector_subaction_addevent_subActionParams
-
-
-
-

run_connector_subaction_addevent_subActionParams - Up

-
The set of configuration properties for the action.
-
-
additional_info (optional)
String Additional information about the event.
-
description (optional)
String The details about the event.
-
event_class (optional)
String A specific instance of the source.
-
message_key (optional)
String All actions sharing this key are associated with the same ServiceNow alert. The default value is <rule ID>:<alert instance ID>.
-
metric_name (optional)
String The name of the metric.
-
node (optional)
String The host that the event was triggered for.
-
resource (optional)
String The name of the resource.
-
severity (optional)
String The severity of the event.
-
source (optional)
String The name of the event source type.
-
time_of_event (optional)
String The time of the event.
-
type (optional)
String The type of event.
-
-
-
-

run_connector_subaction_closealert - The closeAlert subaction Up

-
The closeAlert subaction for Opsgenie connectors.
-
-
subAction
String The action to test.
-
Enum:
-
closeAlert
-
subActionParams
run_connector_subaction_closealert_subActionParams
-
-
-
-

run_connector_subaction_closealert_subActionParams - Up

-
-
-
alias
String The unique identifier used for alert deduplication in Opsgenie. The alias must match the value used when creating the alert.
-
note (optional)
String Additional information for the alert.
-
source (optional)
String The display name for the source of the alert.
-
user (optional)
String The display name for the owner.
-
-
-
-

run_connector_subaction_createalert - The createAlert subaction Up

-
The createAlert subaction for Opsgenie connectors.
-
-
subAction
String The action to test.
-
Enum:
-
createAlert
-
subActionParams
run_connector_subaction_createalert_subActionParams
-
-
-
-

run_connector_subaction_createalert_subActionParams - Up

-
-
-
actions (optional)
array[String] The custom actions available to the alert.
-
alias (optional)
String The unique identifier used for alert deduplication in Opsgenie.
-
description (optional)
String A description that provides detailed information about the alert.
-
details (optional)
map[String, oas_any_type_not_mapped] The custom properties of the alert.
-
entity (optional)
String The domain of the alert. For example, the application or server name.
-
message
String The alert message.
-
note (optional)
String Additional information for the alert.
-
priority (optional)
String The priority level for the alert.
-
Enum:
-
P1
P2
P3
P4
P5
-
responders (optional)
array[run_connector_subaction_createalert_subActionParams_responders_inner] The entities to receive notifications about the alert. If type is user, either id or username is required. If type is team, either id or name is required.
-
source (optional)
String The display name for the source of the alert.
-
tags (optional)
array[String] The tags for the alert.
-
user (optional)
String The display name for the owner.
-
visibleTo (optional)
array[run_connector_subaction_createalert_subActionParams_visibleTo_inner] The teams and users that the alert will be visible to without sending a notification. Only one of id, name, or username is required.
-
-
-
-

run_connector_subaction_createalert_subActionParams_responders_inner - Up

-
-
-
id (optional)
String The identifier for the entity.
-
name (optional)
String The name of the entity.
-
type (optional)
String The type of responders, in this case escalation.
-
Enum:
-
escalation
schedule
team
user
-
username (optional)
String A valid email address for the user.
-
-
-
-

run_connector_subaction_createalert_subActionParams_visibleTo_inner - Up

-
-
-
id (optional)
String The identifier for the entity.
-
name (optional)
String The name of the entity.
-
type
String Valid values are team and user.
-
Enum:
-
team
user
-
username (optional)
String The user name. This property is required only when the type is user.
-
-
-
-

run_connector_subaction_fieldsbyissuetype - The fieldsByIssueType subaction Up

-
The fieldsByIssueType subaction for Jira connectors.
-
-
subAction
String The action to test.
-
Enum:
-
fieldsByIssueType
-
subActionParams
run_connector_subaction_fieldsbyissuetype_subActionParams
-
-
-
-

run_connector_subaction_fieldsbyissuetype_subActionParams - Up

-
-
-
id
String The Jira issue type identifier.
-
-
-
-

run_connector_subaction_getchoices - The getChoices subaction Up

-
The getChoices subaction for ServiceNow ITOM, ServiceNow ITSM, and ServiceNow SecOps connectors.
-
-
subAction
String The action to test.
-
Enum:
-
getChoices
-
subActionParams
run_connector_subaction_getchoices_subActionParams
-
-
-
-

run_connector_subaction_getchoices_subActionParams - Up

-
The set of configuration properties for the action.
-
-
fields
array[String] An array of fields.
-
-
-
-

run_connector_subaction_getfields - The getFields subaction Up

-
The getFields subaction for Jira, ServiceNow ITSM, and ServiceNow SecOps connectors.
-
-
subAction
String The action to test.
-
Enum:
-
getFields
-
-
-
-

run_connector_subaction_getincident - The getIncident subaction Up

-
The getIncident subaction for Jira, ServiceNow ITSM, and ServiceNow SecOps connectors.
-
-
subAction
String The action to test.
-
Enum:
-
getIncident
-
subActionParams
run_connector_subaction_getincident_subActionParams
-
-
-
-

run_connector_subaction_getincident_subActionParams - Up

-
-
-
externalId
String The Jira, ServiceNow ITSM, or ServiceNow SecOps issue identifier.
-
-
-
-

run_connector_subaction_issue - The issue subaction Up

-
The issue subaction for Jira connectors.
-
-
subAction
String The action to test.
-
Enum:
-
issue
-
subActionParams (optional)
run_connector_subaction_issue_subActionParams
-
-
-
-

run_connector_subaction_issue_subActionParams - Up

-
-
-
id
String The Jira issue identifier.
-
-
-
-

run_connector_subaction_issues - The issues subaction Up

-
The issues subaction for Jira connectors.
-
-
subAction
String The action to test.
-
Enum:
-
issues
-
subActionParams
run_connector_subaction_issues_subActionParams
-
-
-
-

run_connector_subaction_issues_subActionParams - Up

-
-
-
title
String The title of the Jira issue.
-
-
-
-

run_connector_subaction_issuetypes - The issueTypes subaction Up

-
The issueTypes subaction for Jira connectors.
-
-
subAction
String The action to test.
-
Enum:
-
issueTypes
-
-
-
-

run_connector_subaction_pushtoservice - The pushToService subaction Up

-
The pushToService subaction for Jira, ServiceNow ITSM, ServiceNow SecOps, and Swimlane connectors.
-
-
subAction
String The action to test.
-
Enum:
-
pushToService
-
subActionParams
run_connector_subaction_pushtoservice_subActionParams
-
-
-
-

run_connector_subaction_pushtoservice_subActionParams - Up

-
The set of configuration properties for the action.
-
-
comments (optional)
array[run_connector_subaction_pushtoservice_subActionParams_comments_inner] Additional information that is sent to Jira, ServiceNow ITSM, ServiceNow SecOps, or Swimlane.
-
incident (optional)
run_connector_subaction_pushtoservice_subActionParams_incident
-
-
-
-

run_connector_subaction_pushtoservice_subActionParams_comments_inner - Up

-
-
-
comment (optional)
String A comment related to the incident. For example, describe how to troubleshoot the issue.
-
commentId (optional)
Integer A unique identifier for the comment.
-
-
-
-

run_connector_subaction_pushtoservice_subActionParams_incident - Up

-
Information necessary to create or update a Jira, ServiceNow ITSM, ServiveNow SecOps, or Swimlane incident.
-
-
alertId (optional)
String The alert identifier for Swimlane connectors.
-
caseId (optional)
String The case identifier for the incident for Swimlane connectors.
-
caseName (optional)
String The case name for the incident for Swimlane connectors.
-
category (optional)
String The category of the incident for ServiceNow ITSM and ServiceNow SecOps connectors.
-
correlation_display (optional)
String A descriptive label of the alert for correlation purposes for ServiceNow ITSM and ServiceNow SecOps connectors.
-
correlation_id (optional)
String The correlation identifier for the security incident for ServiceNow ITSM and ServiveNow SecOps connectors. Connectors using the same correlation ID are associated with the same ServiceNow incident. This value determines whether a new ServiceNow incident is created or an existing one is updated. Modifying this value is optional; if not modified, the rule ID and alert ID are combined as {{ruleID}}:{{alert ID}} to form the correlation ID value in ServiceNow. The maximum character length for this value is 100 characters. NOTE: Using the default configuration of {{ruleID}}:{{alert ID}} ensures that ServiceNow creates a separate incident record for every generated alert that uses a unique alert ID. If the rule generates multiple alerts that use the same alert IDs, ServiceNow creates and continually updates a single incident record for the alert.
-
description (optional)
String The description of the incident for Jira, ServiceNow ITSM, ServiceNow SecOps, and Swimlane connectors.
-
dest_ip (optional)
run_connector_subaction_pushtoservice_subActionParams_incident_dest_ip
-
externalId (optional)
String The Jira, ServiceNow ITSM, or ServiceNow SecOps issue identifier. If present, the incident is updated. Otherwise, a new incident is created.
-
impact (optional)
String The impact of the incident for ServiceNow ITSM connectors.
-
issueType (optional)
Integer The type of incident for Jira connectors. For example, 10006. To obtain the list of valid values, set subAction to issueTypes.
-
labels (optional)
array[String] The labels for the incident for Jira connectors. NOTE: Labels cannot contain spaces.
-
malware_hash (optional)
run_connector_subaction_pushtoservice_subActionParams_incident_malware_hash
-
malware_url (optional)
run_connector_subaction_pushtoservice_subActionParams_incident_malware_url
-
parent (optional)
String The ID or key of the parent issue for Jira connectors. Applies only to Sub-task types of issues.
-
priority (optional)
String The priority of the incident in Jira and ServiceNow SecOps connectors.
-
ruleName (optional)
String The rule name for Swimlane connectors.
-
severity (optional)
String The severity of the incident for ServiceNow ITSM and Swimlane connectors.
-
short_description (optional)
String A short description of the incident for ServiceNow ITSM and ServiceNow SecOps connectors. It is used for searching the contents of the knowledge base.
-
source_ip (optional)
run_connector_subaction_pushtoservice_subActionParams_incident_source_ip
-
subcategory (optional)
String The subcategory of the incident for ServiceNow ITSM and ServiceNow SecOps connectors.
-
summary (optional)
String A summary of the incident for Jira connectors.
-
title (optional)
String A title for the incident for Jira connectors. It is used for searching the contents of the knowledge base.
-
urgency (optional)
String The urgency of the incident for ServiceNow ITSM connectors.
-
-
-
-

run_connector_subaction_pushtoservice_subActionParams_incident_dest_ip - Up

-
A list of destination IP addresses related to the security incident for ServiceNow SecOps connectors. The IPs are added as observables to the security incident.
-
-
-
-
-

run_connector_subaction_pushtoservice_subActionParams_incident_malware_hash - Up

-
A list of malware hashes related to the security incident for ServiceNow SecOps connectors. The hashes are added as observables to the security incident.
-
-
-
-
-

run_connector_subaction_pushtoservice_subActionParams_incident_malware_url - Up

-
A list of malware URLs related to the security incident for ServiceNow SecOps connectors. The URLs are added as observables to the security incident.
-
-
-
-
-

run_connector_subaction_pushtoservice_subActionParams_incident_source_ip - Up

-
A list of source IP addresses related to the security incident for ServiceNow SecOps connectors. The IPs are added as observables to the security incident.
-
-
-
-
-

secrets_properties_cases_webhook - Connector secrets properties for Webhook - Case Management connector Up

-
-
-
password (optional)
String The password for HTTP basic authentication. If hasAuth is set to true, this property is required.
-
user (optional)
String The username for HTTP basic authentication. If hasAuth is set to true, this property is required.
-
-
-
-

secrets_properties_genai - Connector secrets properties for a generative AI connector Up

-
Defines secrets for connectors when type is .gen-ai.
-
-
apiKey (optional)
String The OpenAI API key.
-
-
-
-

secrets_properties_jira - Connector secrets properties for a Jira connector Up

-
Defines secrets for connectors when type is .jira.
-
-
apiToken
String The Jira API authentication token for HTTP basic authentication.
-
email
String The account email for HTTP Basic authentication.
-
-
-
-

secrets_properties_opsgenie - Connector secrets properties for an Opsgenie connector Up

-
Defines secrets for connectors when type is .opsgenie.
-
-
apiKey
String The Opsgenie API authentication key for HTTP Basic authentication.
-
-
-
-

secrets_properties_resilient - Connector secrets properties for IBM Resilient connector Up

-
Defines secrets for connectors when type is .resilient.
-
-
apiKeyId
String The authentication key ID for HTTP Basic authentication.
-
apiKeySecret
String The authentication key secret for HTTP Basic authentication.
-
-
-
-

secrets_properties_servicenow - Connector secrets properties for ServiceNow ITOM, ServiceNow ITSM, and ServiceNow SecOps connectors Up

-
Defines secrets for connectors when type is .servicenow, .servicenow-sir, or .servicenow-itom.
-
-
clientSecret (optional)
String The client secret assigned to your OAuth application. This property is required when isOAuth is true.
-
password (optional)
String The password for HTTP basic authentication. This property is required when isOAuth is false.
-
privateKey (optional)
String The RSA private key that you created for use in ServiceNow. This property is required when isOAuth is true.
-
privateKeyPassword (optional)
String The password for the RSA private key. This property is required when isOAuth is true and you set a password on your private key.
-
username (optional)
String The username for HTTP basic authentication. This property is required when isOAuth is false.
-
-
-
-

secrets_properties_slack_api - Connector secrets properties for a Web API Slack connector Up

-
Defines secrets for connectors when type is .slack.
-
-
token
String Slack bot user OAuth token.
-
-
-
-

secrets_properties_slack_webhook - Connector secrets properties for a Webhook Slack connector Up

-
Defines secrets for connectors when type is .slack.
-
-
webhookUrl
String Slack webhook url.
-
-
-
-

secrets_properties_swimlane - Connector secrets properties for a Swimlane connector Up

-
Defines secrets for connectors when type is .swimlane.
-
-
apiToken (optional)
String Swimlane API authentication token.
-
-
-
-

updateConnector_400_response - Up

-
-
-
error (optional)
String
-
message (optional)
String
-
statusCode (optional)
Integer
-
-
-
-

update_connector_request_cases_webhook - Update Webhook - Case Managment connector request Up

-
-
-
config
config_properties_cases_webhook
-
name
String The display name for the connector.
-
secrets (optional)
secrets_properties_cases_webhook
-
-
-
-

update_connector_request_index - Update index connector request Up

-
-
-
config
config_properties_index
-
name
String The display name for the connector.
-
-
-
-

update_connector_request_jira - Update Jira connector request Up

-
-
-
config
config_properties_jira
-
name
String The display name for the connector.
-
secrets
secrets_properties_jira
-
-
-
-

update_connector_request_opsgenie - Update Opsgenie connector request Up

-
-
-
config
config_properties_opsgenie
-
name
String The display name for the connector.
-
secrets
secrets_properties_opsgenie
-
-
-
-

update_connector_request_resilient - Update IBM Resilient connector request Up

-
-
-
config
config_properties_resilient
-
name
String The display name for the connector.
-
secrets
secrets_properties_resilient
-
-
-
-

update_connector_request_serverlog - Update server log connector request Up

-
-
-
name
String The display name for the connector.
-
-
-
-

update_connector_request_servicenow - Update ServiceNow ITSM connector or ServiceNow SecOps request Up

-
-
-
config
config_properties_servicenow
-
name
String The display name for the connector.
-
secrets
secrets_properties_servicenow
-
-
-
-

update_connector_request_servicenow_itom - Create ServiceNow ITOM connector request Up

-
-
-
config
config_properties_servicenow_itom
-
name
String The display name for the connector.
-
secrets
secrets_properties_servicenow
-
-
-
-

update_connector_request_slack_api - Update Slack connector request Up

-
-
-
name
String The display name for the connector.
-
secrets
secrets_properties_slack_api
-
-
-
-

update_connector_request_slack_webhook - Update Slack connector request Up

-
-
-
name
String The display name for the connector.
-
secrets
secrets_properties_slack_webhook
-
-
-
-

update_connector_request_swimlane - Update Swimlane connector request Up

-
-
-
config
config_properties_swimlane
-
name
String The display name for the connector.
-
secrets
secrets_properties_swimlane
-
-
-
-++++ diff --git a/docs/api-generated/connectors/connector-apis.asciidoc b/docs/api-generated/connectors/connector-apis.asciidoc deleted file mode 100644 index d35bad3d3d633..0000000000000 --- a/docs/api-generated/connectors/connector-apis.asciidoc +++ /dev/null @@ -1,10 +0,0 @@ -[[connector-apis]] -== Connector APIs - -preview::[] - -//// -This file includes content that has been generated from https://github.com/elastic/kibana/tree/main/x-pack/plugins/actions/docs/openapi. Any modifications required must be done in that open API specification. -//// - -include::connector-apis-passthru.asciidoc[] \ No newline at end of file diff --git a/docs/api-generated/machine-learning/ml-apis-passthru.asciidoc b/docs/api-generated/machine-learning/ml-apis-passthru.asciidoc deleted file mode 100644 index 116ddbe0d7273..0000000000000 --- a/docs/api-generated/machine-learning/ml-apis-passthru.asciidoc +++ /dev/null @@ -1,205 +0,0 @@ -//// -This content is generated from the open API specification. -Any modifications made to this file will be overwritten. -//// - -++++ -
-

Access

-
    -
  1. APIKey KeyParamName:ApiKey KeyInQuery:false KeyInHeader:true
    2. -
  2. HTTP Basic Authentication
    3. -
- -

Methods

- [ Jump to Models ] - -

Table of Contents

-
-

Ml

- - -

Ml

-
-
- Up - 
get /s/{spaceId}/api/ml/saved_objects/sync
-
Synchronizes Kibana saved objects for machine learning jobs and trained models. (mlSync)
-
You must have all privileges for the Machine Learning feature in the Analytics section of the Kibana feature privileges. This API runs automatically when you start Kibana and periodically thereafter.
- -

Path parameters

-
-
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- - - - -

Query parameters

-
-
simulate (optional)
- -
Query Parameter — When true, simulates the synchronization by returning only the list of actions that would be performed. default: null
-
- - -

Return type

-
- mlSync200Response - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "datafeedsAdded" : {
-    "key" : {
-      "success" : true
-    }
-  },
-  "savedObjectsCreated" : {
-    "anomaly-detector" : {
-      "key" : {
-        "success" : true
-      }
-    },
-    "data-frame-analytics" : {
-      "key" : {
-        "success" : true
-      }
-    },
-    "trained-model" : {
-      "key" : {
-        "success" : true
-      }
-    }
-  },
-  "savedObjectsDeleted" : {
-    "anomaly-detector" : {
-      "key" : {
-        "success" : true
-      }
-    },
-    "data-frame-analytics" : {
-      "key" : {
-        "success" : true
-      }
-    },
-    "trained-model" : {
-      "key" : {
-        "success" : true
-      }
-    }
-  },
-  "datafeedsRemoved" : {
-    "key" : {
-      "success" : true
-    }
-  }
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call - mlSync200Response -

401

- Authorization information is missing or invalid. - mlSync4xxResponse -
-
- -

Models

- [ Jump to Methods ] - -

Table of Contents

-
    -
  1. mlSync200Response - Successful sync API response
    2. -
  2. mlSync4xxResponse - Unsuccessful sync API response
    3. -
  3. mlSyncResponseAnomalyDetectors - Sync API response for anomaly detection jobs
    4. -
  4. mlSyncResponseDataFrameAnalytics - Sync API response for data frame analytics jobs
    5. -
  5. mlSyncResponseDatafeeds - Sync API response for datafeeds
    6. -
  6. mlSyncResponseSavedObjectsCreated - Sync API response for created saved objects
    7. -
  7. mlSyncResponseSavedObjectsDeleted - Sync API response for deleted saved objects
    8. -
  8. mlSyncResponseTrainedModels - Sync API response for trained models
    9. -
- -
-

mlSync200Response - Successful sync API response Up

-
-
-
datafeedsAdded (optional)
map[String, mlSyncResponseDatafeeds] If a saved object for an anomaly detection job is missing a datafeed identifier, it is added when you run the sync machine learning saved objects API.
-
datafeedsRemoved (optional)
map[String, mlSyncResponseDatafeeds] If a saved object for an anomaly detection job references a datafeed that no longer exists, it is deleted when you run the sync machine learning saved objects API.
-
savedObjectsCreated (optional)
mlSyncResponseSavedObjectsCreated
-
savedObjectsDeleted (optional)
mlSyncResponseSavedObjectsDeleted
-
-
-
-

mlSync4xxResponse - Unsuccessful sync API response Up

-
-
-
error (optional)
String
-
message (optional)
String
-
statusCode (optional)
Integer
-
-
-
-

mlSyncResponseAnomalyDetectors - Sync API response for anomaly detection jobs Up

-
The sync machine learning saved objects API response contains this object when there are anomaly detection jobs affected by the synchronization. There is an object for each relevant job, which contains the synchronization status.
-
-
success (optional)
Boolean The success or failure of the synchronization.
-
-
-
-

mlSyncResponseDataFrameAnalytics - Sync API response for data frame analytics jobs Up

-
The sync machine learning saved objects API response contains this object when there are data frame analytics jobs affected by the synchronization. There is an object for each relevant job, which contains the synchronization status.
-
-
success (optional)
Boolean The success or failure of the synchronization.
-
-
-
-

mlSyncResponseDatafeeds - Sync API response for datafeeds Up

-
The sync machine learning saved objects API response contains this object when there are datafeeds affected by the synchronization. There is an object for each relevant datafeed, which contains the synchronization status.
-
-
success (optional)
Boolean The success or failure of the synchronization.
-
-
-
-

mlSyncResponseSavedObjectsCreated - Sync API response for created saved objects Up

-
If saved objects are missing for machine learning jobs or trained models, they are created when you run the sync machine learning saved objects API.
-
-
anomalyMinusdetector (optional)
map[String, mlSyncResponseAnomalyDetectors] If saved objects are missing for anomaly detection jobs, they are created.
-
dataMinusframeMinusanalytics (optional)
map[String, mlSyncResponseDataFrameAnalytics] If saved objects are missing for data frame analytics jobs, they are created.
-
trainedMinusmodel (optional)
map[String, mlSyncResponseTrainedModels] If saved objects are missing for trained models, they are created.
-
-
-
-

mlSyncResponseSavedObjectsDeleted - Sync API response for deleted saved objects Up

-
If saved objects exist for machine learning jobs or trained models that no longer exist, they are deleted when you run the sync machine learning saved objects API.
-
-
anomalyMinusdetector (optional)
map[String, mlSyncResponseAnomalyDetectors] If there are saved objects exist for nonexistent anomaly detection jobs, they are deleted.
-
dataMinusframeMinusanalytics (optional)
map[String, mlSyncResponseDataFrameAnalytics] If there are saved objects exist for nonexistent data frame analytics jobs, they are deleted.
-
trainedMinusmodel (optional)
map[String, mlSyncResponseTrainedModels] If there are saved objects exist for nonexistent trained models, they are deleted.
-
-
-
-

mlSyncResponseTrainedModels - Sync API response for trained models Up

-
The sync machine learning saved objects API response contains this object when there are trained models affected by the synchronization. There is an object for each relevant trained model, which contains the synchronization status.
-
-
success (optional)
Boolean The success or failure of the synchronization.
-
-
-
-++++ diff --git a/docs/api-generated/machine-learning/ml-apis.asciidoc b/docs/api-generated/machine-learning/ml-apis.asciidoc deleted file mode 100644 index 2d87d72616a75..0000000000000 --- a/docs/api-generated/machine-learning/ml-apis.asciidoc +++ /dev/null @@ -1,10 +0,0 @@ -[[machine-learning-apis]] -== Machine learning APIs - -preview::[] - -//// -This file includes content that has been generated from https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/common/openapi. Any modifications required must be done in that open API specification. -//// - -include::ml-apis-passthru.asciidoc[] \ No newline at end of file diff --git a/docs/api-generated/rules/rule-apis-passthru.asciidoc b/docs/api-generated/rules/rule-apis-passthru.asciidoc deleted file mode 100644 index 39b43ad9dfff2..0000000000000 --- a/docs/api-generated/rules/rule-apis-passthru.asciidoc +++ /dev/null @@ -1,3456 +0,0 @@ -//// -This content is generated from the open API specification. -Any modifications made to this file will be overwritten. -//// - -++++ -
-

Access

-
    -
  1. APIKey KeyParamName:ApiKey KeyInQuery:false KeyInHeader:true
    2. -
  2. HTTP Basic Authentication
    3. -
- -

Methods

- [ Jump to Models ] - -

Table of Contents

-
-

Alerting

- - -

Alerting

-
-
- Up - 
post /s/{spaceId}/api/alerting/rule
-
Creates a rule with a randomly generated rule identifier. (createRule)
-
To create a rule, you must have all privileges for the appropriate Kibana features, depending on the consumer and rule_type_id of the rule you're creating. For example, you must have privileges for the Management > Stack rules feature, Analytics > Discover and Machine Learning features, Observability features, or Security features. If the rule has actions, you must also have read privileges for the Management > Actions and Connectors feature. This API supports both key- and token-based authentication. To use key-based authentication, create an API key in Kibana and use it in the header of the API call. To use token-based authentication, provide a username and password; an API key that matches the current privileges of the user is created automatically. In both cases, the API key is subsequently used for authorization when the rule runs.
- -

Path parameters

-
-
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- -

Consumes

- This API call consumes the following media types via the Content-Type request header: -
    -
  • application/json
    • -
- -

Request body

-
-
create_rule_request create_rule_request (required)
- -
Body Parameter —
- -
- -

Request headers

-
-
kbn-xsrf (required)
- -
Header Parameter — Cross-site request forgery protection default: null
- -
- - - -

Return type

-
- rule_response_properties - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "throttle" : "10m",
-  "created_at" : "2022-12-05T23:36:58.284Z",
-  "api_key_created_by_user" : false,
-  "enabled" : true,
-  "running" : true,
-  "notify_when" : "notify_when",
-  "next_run" : "2022-12-06T00:14:43.818Z",
-  "updated_at" : "2022-12-05T23:36:58.284Z",
-  "execution_status" : {
-    "last_execution_date" : "2022-12-06T00:13:43.89Z",
-    "last_duration" : 55,
-    "status" : "ok"
-  },
-  "scheduled_task_id" : "b530fed0-74f5-11ed-9801-35303b735aef",
-  "id" : "b530fed0-74f5-11ed-9801-35303b735aef",
-  "consumer" : "alerts",
-  "last_run" : {
-    "alerts_count" : {
-      "ignored" : 6,
-      "new" : 1,
-      "recovered" : 5,
-      "active" : 0
-    },
-    "outcome_msg" : [ "outcome_msg", "outcome_msg" ],
-    "outcome_order" : 5,
-    "warning" : "warning",
-    "outcome" : "succeeded"
-  },
-  "params" : {
-    "key" : ""
-  },
-  "created_by" : "elastic",
-  "muted_alert_ids" : [ "muted_alert_ids", "muted_alert_ids" ],
-  "rule_type_id" : "monitoring_alert_cluster_health",
-  "revision" : 2,
-  "tags" : [ "tags", "tags" ],
-  "api_key_owner" : "elastic",
-  "schedule" : {
-    "interval" : "1m"
-  },
-  "name" : "cluster_health_rule",
-  "updated_by" : "elastic",
-  "mute_all" : false,
-  "actions" : [ {
-    "alerts_filter" : {
-      "timeframe" : {
-        "hours" : {
-          "start" : "08:00",
-          "end" : "17:00"
-        },
-        "timezone" : "Europe/Madrid",
-        "days" : [ 1, 2, 3, 4, 5 ]
-      },
-      "query" : {
-        "kql" : "kql",
-        "filters" : [ {
-          "$state" : "{}",
-          "meta" : {
-            "field" : "field",
-            "controlledBy" : "controlledBy",
-            "negate" : true,
-            "alias" : "alias",
-            "index" : "index",
-            "disabled" : true,
-            "params" : "{}",
-            "type" : "type",
-            "value" : "value",
-            "isMultiIndex" : true,
-            "key" : "key",
-            "group" : "group"
-          },
-          "query" : "{}"
-        }, {
-          "$state" : "{}",
-          "meta" : {
-            "field" : "field",
-            "controlledBy" : "controlledBy",
-            "negate" : true,
-            "alias" : "alias",
-            "index" : "index",
-            "disabled" : true,
-            "params" : "{}",
-            "type" : "type",
-            "value" : "value",
-            "isMultiIndex" : true,
-            "key" : "key",
-            "group" : "group"
-          },
-          "query" : "{}"
-        } ]
-      }
-    },
-    "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
-    "params" : {
-      "key" : ""
-    },
-    "uuid" : "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61",
-    "connector_type_id" : ".server-log",
-    "frequency" : {
-      "summary" : true,
-      "throttle" : "10m",
-      "notify_when" : "onActiveAlert"
-    },
-    "group" : "default"
-  }, {
-    "alerts_filter" : {
-      "timeframe" : {
-        "hours" : {
-          "start" : "08:00",
-          "end" : "17:00"
-        },
-        "timezone" : "Europe/Madrid",
-        "days" : [ 1, 2, 3, 4, 5 ]
-      },
-      "query" : {
-        "kql" : "kql",
-        "filters" : [ {
-          "$state" : "{}",
-          "meta" : {
-            "field" : "field",
-            "controlledBy" : "controlledBy",
-            "negate" : true,
-            "alias" : "alias",
-            "index" : "index",
-            "disabled" : true,
-            "params" : "{}",
-            "type" : "type",
-            "value" : "value",
-            "isMultiIndex" : true,
-            "key" : "key",
-            "group" : "group"
-          },
-          "query" : "{}"
-        }, {
-          "$state" : "{}",
-          "meta" : {
-            "field" : "field",
-            "controlledBy" : "controlledBy",
-            "negate" : true,
-            "alias" : "alias",
-            "index" : "index",
-            "disabled" : true,
-            "params" : "{}",
-            "type" : "type",
-            "value" : "value",
-            "isMultiIndex" : true,
-            "key" : "key",
-            "group" : "group"
-          },
-          "query" : "{}"
-        } ]
-      }
-    },
-    "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
-    "params" : {
-      "key" : ""
-    },
-    "uuid" : "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61",
-    "connector_type_id" : ".server-log",
-    "frequency" : {
-      "summary" : true,
-      "throttle" : "10m",
-      "notify_when" : "onActiveAlert"
-    },
-    "group" : "default"
-  } ]
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - rule_response_properties -

401

- Authorization information is missing or invalid. - 401_response -

404

- Object is not found. - 404_response -
-
-
-
- Up - 
post /s/{spaceId}/api/alerting/rule/{ruleId}
-
Creates a rule. (createRuleId)
-
To create a rule, you must have all privileges for the appropriate Kibana features, depending on the consumer and rule_type_id of the rule you're creating. For example, you must have privileges for the Management > Stack rules feature, Analytics > Discover and Machine Learning features, Observability features, or Security features. If the rule has actions, you must also have read privileges for the Management > Actions and Connectors feature. This API supports both key- and token-based authentication. To use key-based authentication, create an API key in Kibana and use it in the header of the API call. To use token-based authentication, provide a username and password; an API key that matches the current privileges of the user is created automatically. In both cases, the API key is subsequently used for authorization when the rule runs.
- -

Path parameters

-
-
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
ruleId (required)
- -
Path Parameter — An UUID v1 or v4 identifier for the rule. If you omit this parameter, an identifier is randomly generated. default: null
-
- -

Consumes

- This API call consumes the following media types via the Content-Type request header: -
    -
  • application/json
    • -
- -

Request body

-
-
create_rule_request create_rule_request (required)
- -
Body Parameter —
- -
- -

Request headers

-
-
kbn-xsrf (required)
- -
Header Parameter — Cross-site request forgery protection default: null
- -
- - - -

Return type

-
- rule_response_properties - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "throttle" : "10m",
-  "created_at" : "2022-12-05T23:36:58.284Z",
-  "api_key_created_by_user" : false,
-  "enabled" : true,
-  "running" : true,
-  "notify_when" : "notify_when",
-  "next_run" : "2022-12-06T00:14:43.818Z",
-  "updated_at" : "2022-12-05T23:36:58.284Z",
-  "execution_status" : {
-    "last_execution_date" : "2022-12-06T00:13:43.89Z",
-    "last_duration" : 55,
-    "status" : "ok"
-  },
-  "scheduled_task_id" : "b530fed0-74f5-11ed-9801-35303b735aef",
-  "id" : "b530fed0-74f5-11ed-9801-35303b735aef",
-  "consumer" : "alerts",
-  "last_run" : {
-    "alerts_count" : {
-      "ignored" : 6,
-      "new" : 1,
-      "recovered" : 5,
-      "active" : 0
-    },
-    "outcome_msg" : [ "outcome_msg", "outcome_msg" ],
-    "outcome_order" : 5,
-    "warning" : "warning",
-    "outcome" : "succeeded"
-  },
-  "params" : {
-    "key" : ""
-  },
-  "created_by" : "elastic",
-  "muted_alert_ids" : [ "muted_alert_ids", "muted_alert_ids" ],
-  "rule_type_id" : "monitoring_alert_cluster_health",
-  "revision" : 2,
-  "tags" : [ "tags", "tags" ],
-  "api_key_owner" : "elastic",
-  "schedule" : {
-    "interval" : "1m"
-  },
-  "name" : "cluster_health_rule",
-  "updated_by" : "elastic",
-  "mute_all" : false,
-  "actions" : [ {
-    "alerts_filter" : {
-      "timeframe" : {
-        "hours" : {
-          "start" : "08:00",
-          "end" : "17:00"
-        },
-        "timezone" : "Europe/Madrid",
-        "days" : [ 1, 2, 3, 4, 5 ]
-      },
-      "query" : {
-        "kql" : "kql",
-        "filters" : [ {
-          "$state" : "{}",
-          "meta" : {
-            "field" : "field",
-            "controlledBy" : "controlledBy",
-            "negate" : true,
-            "alias" : "alias",
-            "index" : "index",
-            "disabled" : true,
-            "params" : "{}",
-            "type" : "type",
-            "value" : "value",
-            "isMultiIndex" : true,
-            "key" : "key",
-            "group" : "group"
-          },
-          "query" : "{}"
-        }, {
-          "$state" : "{}",
-          "meta" : {
-            "field" : "field",
-            "controlledBy" : "controlledBy",
-            "negate" : true,
-            "alias" : "alias",
-            "index" : "index",
-            "disabled" : true,
-            "params" : "{}",
-            "type" : "type",
-            "value" : "value",
-            "isMultiIndex" : true,
-            "key" : "key",
-            "group" : "group"
-          },
-          "query" : "{}"
-        } ]
-      }
-    },
-    "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
-    "params" : {
-      "key" : ""
-    },
-    "uuid" : "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61",
-    "connector_type_id" : ".server-log",
-    "frequency" : {
-      "summary" : true,
-      "throttle" : "10m",
-      "notify_when" : "onActiveAlert"
-    },
-    "group" : "default"
-  }, {
-    "alerts_filter" : {
-      "timeframe" : {
-        "hours" : {
-          "start" : "08:00",
-          "end" : "17:00"
-        },
-        "timezone" : "Europe/Madrid",
-        "days" : [ 1, 2, 3, 4, 5 ]
-      },
-      "query" : {
-        "kql" : "kql",
-        "filters" : [ {
-          "$state" : "{}",
-          "meta" : {
-            "field" : "field",
-            "controlledBy" : "controlledBy",
-            "negate" : true,
-            "alias" : "alias",
-            "index" : "index",
-            "disabled" : true,
-            "params" : "{}",
-            "type" : "type",
-            "value" : "value",
-            "isMultiIndex" : true,
-            "key" : "key",
-            "group" : "group"
-          },
-          "query" : "{}"
-        }, {
-          "$state" : "{}",
-          "meta" : {
-            "field" : "field",
-            "controlledBy" : "controlledBy",
-            "negate" : true,
-            "alias" : "alias",
-            "index" : "index",
-            "disabled" : true,
-            "params" : "{}",
-            "type" : "type",
-            "value" : "value",
-            "isMultiIndex" : true,
-            "key" : "key",
-            "group" : "group"
-          },
-          "query" : "{}"
-        } ]
-      }
-    },
-    "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
-    "params" : {
-      "key" : ""
-    },
-    "uuid" : "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61",
-    "connector_type_id" : ".server-log",
-    "frequency" : {
-      "summary" : true,
-      "throttle" : "10m",
-      "notify_when" : "onActiveAlert"
-    },
-    "group" : "default"
-  } ]
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - rule_response_properties -

401

- Authorization information is missing or invalid. - 401_response -

404

- Object is not found. - 404_response -
-
-
-
- Up - 
delete /s/{spaceId}/api/alerting/rule/{ruleId}
-
Deletes a rule. (deleteRule)
-
To delete a rule, you must have all privileges for the appropriate Kibana features, depending on the consumer and rule_type_id of the rule you're deleting. For example, the Management > Stack Rules feature, Analytics > Discover or Machine Learning features, Observability, or Security features. WARNING: After you delete a rule, you cannot recover it. If the API key that is used by the rule was created automatically, it is deleted.
- -

Path parameters

-
-
ruleId (required)
- -
Path Parameter — An identifier for the rule. default: null
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- - - -

Request headers

-
-
kbn-xsrf (required)
- -
Header Parameter — Cross-site request forgery protection default: null
- -
- - - - - - - -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

204

- Indicates a successful call. - -

401

- Authorization information is missing or invalid. - 401_response -

404

- Object is not found. - 404_response -
-
-
-
- Up - 
post /s/{spaceId}/api/alerting/rule/{ruleId}/_disable
-
Disables a rule. (disableRule)
-
You must have all privileges for the appropriate Kibana features, depending on the consumer and rule_type_id of the rule. For example, the Management > Stack Rules feature, Analytics > Discover and Machine Learning features, Observability, and Security features.
- -

Path parameters

-
-
ruleId (required)
- -
Path Parameter — An identifier for the rule. default: null
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- - - -

Request headers

-
-
kbn-xsrf (required)
- -
Header Parameter — Cross-site request forgery protection default: null
- -
- - - - - - - -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

204

- Indicates a successful call. - -

401

- Authorization information is missing or invalid. - 401_response -

404

- Object is not found. - 404_response -
-
-
-
- Up - 
post /s/{spaceId}/api/alerting/rule/{ruleId}/_enable
-
Enables a rule. (enableRule)
-
To enable a rule, you must have all privileges for the appropriate Kibana features, depending on the consumer and rule_type_id of the rule. For example, the Management > Stack Rules feature, Analytics > Discover and Machine Learning features, Observability, and Security features. This API supports both key- and token-based authentication. To use key-based authentication, create an API key in Kibana and use it in the header of the API call. To use token-based authentication, provide a username and password; an API key that matches the current privileges of the user is created automatically. In both cases, the API key is subsequently used for authorization when the rule runs.
- -

Path parameters

-
-
ruleId (required)
- -
Path Parameter — An identifier for the rule. default: null
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- - - -

Request headers

-
-
kbn-xsrf (required)
- -
Header Parameter — Cross-site request forgery protection default: null
- -
- - - - - - - -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

204

- Indicates a successful call. - -

401

- Authorization information is missing or invalid. - 401_response -

404

- Object is not found. - 401_response -
-
-
-
- Up - 
get /s/{spaceId}/api/alerting/rules/_find
-
Retrieves information about rules. (findRules)
-
You must have read privileges for the appropriate Kibana features, depending on the consumer and rule_type_id of the rules you're seeking. For example, you must have privileges for the Management > Stack rules feature, Analytics > Discover and Machine Learning features, Observability features, or Security features. To find rules associated with the Stack Monitoring feature, use the monitoring_user built-in role.
- -

Path parameters

-
-
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- - - - -

Query parameters

-
-
default_search_operator (optional)
- -
Query Parameter — The default operator to use for the simple_query_string. default: OR
fields (optional)
- -
Query Parameter — The fields to return in the attributes key of the response. default: null
filter (optional)
- -
Query Parameter — A KQL string that you filter with an attribute from your saved object. It should look like savedObjectType.attributes.title: "myTitle". However, if you used a direct attribute of a saved object, such as updatedAt, you must define your filter, for example, savedObjectType.updatedAt > 2018-12-22. default: null
has_reference (optional)
- -
Query Parameter — Filters the rules that have a relation with the reference objects with a specific type and identifier. default: null
page (optional)
- -
Query Parameter — The page number to return. default: 1
per_page (optional)
- -
Query Parameter — The number of rules to return per page. default: 20
search (optional)
- -
Query Parameter — An Elasticsearch simple_query_string query that filters the objects in the response. default: null
search_fields (optional)
- -
Query Parameter — The fields to perform the simple_query_string parsed query against. default: null
sort_field (optional)
- -
Query Parameter — Determines which field is used to sort the results. The field must exist in the attributes key of the response. default: null
sort_order (optional)
- -
Query Parameter — Determines the sort order. default: desc
-
- - -

Return type

-
- findRules_200_response - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "per_page" : 6,
-  "total" : 1,
-  "data" : [ {
-    "throttle" : "10m",
-    "created_at" : "2022-12-05T23:36:58.284Z",
-    "api_key_created_by_user" : false,
-    "enabled" : true,
-    "running" : true,
-    "notify_when" : "notify_when",
-    "next_run" : "2022-12-06T00:14:43.818Z",
-    "updated_at" : "2022-12-05T23:36:58.284Z",
-    "execution_status" : {
-      "last_execution_date" : "2022-12-06T00:13:43.89Z",
-      "last_duration" : 55,
-      "status" : "ok"
-    },
-    "scheduled_task_id" : "b530fed0-74f5-11ed-9801-35303b735aef",
-    "id" : "b530fed0-74f5-11ed-9801-35303b735aef",
-    "consumer" : "alerts",
-    "last_run" : {
-      "alerts_count" : {
-        "ignored" : 6,
-        "new" : 1,
-        "recovered" : 5,
-        "active" : 0
-      },
-      "outcome_msg" : [ "outcome_msg", "outcome_msg" ],
-      "outcome_order" : 5,
-      "warning" : "warning",
-      "outcome" : "succeeded"
-    },
-    "params" : {
-      "key" : ""
-    },
-    "created_by" : "elastic",
-    "muted_alert_ids" : [ "muted_alert_ids", "muted_alert_ids" ],
-    "rule_type_id" : "monitoring_alert_cluster_health",
-    "revision" : 2,
-    "tags" : [ "tags", "tags" ],
-    "api_key_owner" : "elastic",
-    "schedule" : {
-      "interval" : "1m"
-    },
-    "name" : "cluster_health_rule",
-    "updated_by" : "elastic",
-    "mute_all" : false,
-    "actions" : [ {
-      "alerts_filter" : {
-        "timeframe" : {
-          "hours" : {
-            "start" : "08:00",
-            "end" : "17:00"
-          },
-          "timezone" : "Europe/Madrid",
-          "days" : [ 1, 2, 3, 4, 5 ]
-        },
-        "query" : {
-          "kql" : "kql",
-          "filters" : [ {
-            "$state" : "{}",
-            "meta" : {
-              "field" : "field",
-              "controlledBy" : "controlledBy",
-              "negate" : true,
-              "alias" : "alias",
-              "index" : "index",
-              "disabled" : true,
-              "params" : "{}",
-              "type" : "type",
-              "value" : "value",
-              "isMultiIndex" : true,
-              "key" : "key",
-              "group" : "group"
-            },
-            "query" : "{}"
-          }, {
-            "$state" : "{}",
-            "meta" : {
-              "field" : "field",
-              "controlledBy" : "controlledBy",
-              "negate" : true,
-              "alias" : "alias",
-              "index" : "index",
-              "disabled" : true,
-              "params" : "{}",
-              "type" : "type",
-              "value" : "value",
-              "isMultiIndex" : true,
-              "key" : "key",
-              "group" : "group"
-            },
-            "query" : "{}"
-          } ]
-        }
-      },
-      "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
-      "params" : {
-        "key" : ""
-      },
-      "uuid" : "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61",
-      "connector_type_id" : ".server-log",
-      "frequency" : {
-        "summary" : true,
-        "throttle" : "10m",
-        "notify_when" : "onActiveAlert"
-      },
-      "group" : "default"
-    }, {
-      "alerts_filter" : {
-        "timeframe" : {
-          "hours" : {
-            "start" : "08:00",
-            "end" : "17:00"
-          },
-          "timezone" : "Europe/Madrid",
-          "days" : [ 1, 2, 3, 4, 5 ]
-        },
-        "query" : {
-          "kql" : "kql",
-          "filters" : [ {
-            "$state" : "{}",
-            "meta" : {
-              "field" : "field",
-              "controlledBy" : "controlledBy",
-              "negate" : true,
-              "alias" : "alias",
-              "index" : "index",
-              "disabled" : true,
-              "params" : "{}",
-              "type" : "type",
-              "value" : "value",
-              "isMultiIndex" : true,
-              "key" : "key",
-              "group" : "group"
-            },
-            "query" : "{}"
-          }, {
-            "$state" : "{}",
-            "meta" : {
-              "field" : "field",
-              "controlledBy" : "controlledBy",
-              "negate" : true,
-              "alias" : "alias",
-              "index" : "index",
-              "disabled" : true,
-              "params" : "{}",
-              "type" : "type",
-              "value" : "value",
-              "isMultiIndex" : true,
-              "key" : "key",
-              "group" : "group"
-            },
-            "query" : "{}"
-          } ]
-        }
-      },
-      "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
-      "params" : {
-        "key" : ""
-      },
-      "uuid" : "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61",
-      "connector_type_id" : ".server-log",
-      "frequency" : {
-        "summary" : true,
-        "throttle" : "10m",
-        "notify_when" : "onActiveAlert"
-      },
-      "group" : "default"
-    } ]
-  }, {
-    "throttle" : "10m",
-    "created_at" : "2022-12-05T23:36:58.284Z",
-    "api_key_created_by_user" : false,
-    "enabled" : true,
-    "running" : true,
-    "notify_when" : "notify_when",
-    "next_run" : "2022-12-06T00:14:43.818Z",
-    "updated_at" : "2022-12-05T23:36:58.284Z",
-    "execution_status" : {
-      "last_execution_date" : "2022-12-06T00:13:43.89Z",
-      "last_duration" : 55,
-      "status" : "ok"
-    },
-    "scheduled_task_id" : "b530fed0-74f5-11ed-9801-35303b735aef",
-    "id" : "b530fed0-74f5-11ed-9801-35303b735aef",
-    "consumer" : "alerts",
-    "last_run" : {
-      "alerts_count" : {
-        "ignored" : 6,
-        "new" : 1,
-        "recovered" : 5,
-        "active" : 0
-      },
-      "outcome_msg" : [ "outcome_msg", "outcome_msg" ],
-      "outcome_order" : 5,
-      "warning" : "warning",
-      "outcome" : "succeeded"
-    },
-    "params" : {
-      "key" : ""
-    },
-    "created_by" : "elastic",
-    "muted_alert_ids" : [ "muted_alert_ids", "muted_alert_ids" ],
-    "rule_type_id" : "monitoring_alert_cluster_health",
-    "revision" : 2,
-    "tags" : [ "tags", "tags" ],
-    "api_key_owner" : "elastic",
-    "schedule" : {
-      "interval" : "1m"
-    },
-    "name" : "cluster_health_rule",
-    "updated_by" : "elastic",
-    "mute_all" : false,
-    "actions" : [ {
-      "alerts_filter" : {
-        "timeframe" : {
-          "hours" : {
-            "start" : "08:00",
-            "end" : "17:00"
-          },
-          "timezone" : "Europe/Madrid",
-          "days" : [ 1, 2, 3, 4, 5 ]
-        },
-        "query" : {
-          "kql" : "kql",
-          "filters" : [ {
-            "$state" : "{}",
-            "meta" : {
-              "field" : "field",
-              "controlledBy" : "controlledBy",
-              "negate" : true,
-              "alias" : "alias",
-              "index" : "index",
-              "disabled" : true,
-              "params" : "{}",
-              "type" : "type",
-              "value" : "value",
-              "isMultiIndex" : true,
-              "key" : "key",
-              "group" : "group"
-            },
-            "query" : "{}"
-          }, {
-            "$state" : "{}",
-            "meta" : {
-              "field" : "field",
-              "controlledBy" : "controlledBy",
-              "negate" : true,
-              "alias" : "alias",
-              "index" : "index",
-              "disabled" : true,
-              "params" : "{}",
-              "type" : "type",
-              "value" : "value",
-              "isMultiIndex" : true,
-              "key" : "key",
-              "group" : "group"
-            },
-            "query" : "{}"
-          } ]
-        }
-      },
-      "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
-      "params" : {
-        "key" : ""
-      },
-      "uuid" : "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61",
-      "connector_type_id" : ".server-log",
-      "frequency" : {
-        "summary" : true,
-        "throttle" : "10m",
-        "notify_when" : "onActiveAlert"
-      },
-      "group" : "default"
-    }, {
-      "alerts_filter" : {
-        "timeframe" : {
-          "hours" : {
-            "start" : "08:00",
-            "end" : "17:00"
-          },
-          "timezone" : "Europe/Madrid",
-          "days" : [ 1, 2, 3, 4, 5 ]
-        },
-        "query" : {
-          "kql" : "kql",
-          "filters" : [ {
-            "$state" : "{}",
-            "meta" : {
-              "field" : "field",
-              "controlledBy" : "controlledBy",
-              "negate" : true,
-              "alias" : "alias",
-              "index" : "index",
-              "disabled" : true,
-              "params" : "{}",
-              "type" : "type",
-              "value" : "value",
-              "isMultiIndex" : true,
-              "key" : "key",
-              "group" : "group"
-            },
-            "query" : "{}"
-          }, {
-            "$state" : "{}",
-            "meta" : {
-              "field" : "field",
-              "controlledBy" : "controlledBy",
-              "negate" : true,
-              "alias" : "alias",
-              "index" : "index",
-              "disabled" : true,
-              "params" : "{}",
-              "type" : "type",
-              "value" : "value",
-              "isMultiIndex" : true,
-              "key" : "key",
-              "group" : "group"
-            },
-            "query" : "{}"
-          } ]
-        }
-      },
-      "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
-      "params" : {
-        "key" : ""
-      },
-      "uuid" : "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61",
-      "connector_type_id" : ".server-log",
-      "frequency" : {
-        "summary" : true,
-        "throttle" : "10m",
-        "notify_when" : "onActiveAlert"
-      },
-      "group" : "default"
-    } ]
-  } ],
-  "page" : 0
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - findRules_200_response -

401

- Authorization information is missing or invalid. - 401_response -
-
-
-
- Up - 
get /s/{spaceId}/api/alerting/_health
-
Retrieves the health status of the alerting framework. (getAlertingHealth)
-
You must have read privileges for the Management > Stack Rules feature or for at least one of the Analytics > Discover, Analytics > Machine Learning, Observability, or Security features.
- -

Path parameters

-
-
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- - - - - - -

Return type

-
- getAlertingHealth_200_response - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "alerting_framework_health" : {
-    "execution_health" : {
-      "status" : "ok",
-      "timestamp" : "2023-01-13T01:28:00.28Z"
-    },
-    "read_health" : {
-      "status" : "ok",
-      "timestamp" : "2023-01-13T01:28:00.28Z"
-    },
-    "decryption_health" : {
-      "status" : "ok",
-      "timestamp" : "2023-01-13T01:28:00.28Z"
-    }
-  },
-  "has_permanent_encryption_key" : true,
-  "is_sufficiently_secure" : true
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - getAlertingHealth_200_response -

401

- Authorization information is missing or invalid. - 401_response -
-
-
-
- Up - 
get /s/{spaceId}/api/alerting/rule/{ruleId}
-
Retrieves a rule by its identifier. (getRule)
-
You must have read privileges for the appropriate Kibana features, depending on the consumer and rule_type_id of the rules you're seeking. For example, the Management > Stack Rules feature, Analytics > Discover and Machine Learning features, Observability features, or Security features. To get rules associated with the Stack Monitoring feature, use the monitoring_user built-in role.
- -

Path parameters

-
-
ruleId (required)
- -
Path Parameter — An identifier for the rule. default: null
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- - - - - - -

Return type

-
- rule_response_properties - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "throttle" : "10m",
-  "created_at" : "2022-12-05T23:36:58.284Z",
-  "api_key_created_by_user" : false,
-  "enabled" : true,
-  "running" : true,
-  "notify_when" : "notify_when",
-  "next_run" : "2022-12-06T00:14:43.818Z",
-  "updated_at" : "2022-12-05T23:36:58.284Z",
-  "execution_status" : {
-    "last_execution_date" : "2022-12-06T00:13:43.89Z",
-    "last_duration" : 55,
-    "status" : "ok"
-  },
-  "scheduled_task_id" : "b530fed0-74f5-11ed-9801-35303b735aef",
-  "id" : "b530fed0-74f5-11ed-9801-35303b735aef",
-  "consumer" : "alerts",
-  "last_run" : {
-    "alerts_count" : {
-      "ignored" : 6,
-      "new" : 1,
-      "recovered" : 5,
-      "active" : 0
-    },
-    "outcome_msg" : [ "outcome_msg", "outcome_msg" ],
-    "outcome_order" : 5,
-    "warning" : "warning",
-    "outcome" : "succeeded"
-  },
-  "params" : {
-    "key" : ""
-  },
-  "created_by" : "elastic",
-  "muted_alert_ids" : [ "muted_alert_ids", "muted_alert_ids" ],
-  "rule_type_id" : "monitoring_alert_cluster_health",
-  "revision" : 2,
-  "tags" : [ "tags", "tags" ],
-  "api_key_owner" : "elastic",
-  "schedule" : {
-    "interval" : "1m"
-  },
-  "name" : "cluster_health_rule",
-  "updated_by" : "elastic",
-  "mute_all" : false,
-  "actions" : [ {
-    "alerts_filter" : {
-      "timeframe" : {
-        "hours" : {
-          "start" : "08:00",
-          "end" : "17:00"
-        },
-        "timezone" : "Europe/Madrid",
-        "days" : [ 1, 2, 3, 4, 5 ]
-      },
-      "query" : {
-        "kql" : "kql",
-        "filters" : [ {
-          "$state" : "{}",
-          "meta" : {
-            "field" : "field",
-            "controlledBy" : "controlledBy",
-            "negate" : true,
-            "alias" : "alias",
-            "index" : "index",
-            "disabled" : true,
-            "params" : "{}",
-            "type" : "type",
-            "value" : "value",
-            "isMultiIndex" : true,
-            "key" : "key",
-            "group" : "group"
-          },
-          "query" : "{}"
-        }, {
-          "$state" : "{}",
-          "meta" : {
-            "field" : "field",
-            "controlledBy" : "controlledBy",
-            "negate" : true,
-            "alias" : "alias",
-            "index" : "index",
-            "disabled" : true,
-            "params" : "{}",
-            "type" : "type",
-            "value" : "value",
-            "isMultiIndex" : true,
-            "key" : "key",
-            "group" : "group"
-          },
-          "query" : "{}"
-        } ]
-      }
-    },
-    "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
-    "params" : {
-      "key" : ""
-    },
-    "uuid" : "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61",
-    "connector_type_id" : ".server-log",
-    "frequency" : {
-      "summary" : true,
-      "throttle" : "10m",
-      "notify_when" : "onActiveAlert"
-    },
-    "group" : "default"
-  }, {
-    "alerts_filter" : {
-      "timeframe" : {
-        "hours" : {
-          "start" : "08:00",
-          "end" : "17:00"
-        },
-        "timezone" : "Europe/Madrid",
-        "days" : [ 1, 2, 3, 4, 5 ]
-      },
-      "query" : {
-        "kql" : "kql",
-        "filters" : [ {
-          "$state" : "{}",
-          "meta" : {
-            "field" : "field",
-            "controlledBy" : "controlledBy",
-            "negate" : true,
-            "alias" : "alias",
-            "index" : "index",
-            "disabled" : true,
-            "params" : "{}",
-            "type" : "type",
-            "value" : "value",
-            "isMultiIndex" : true,
-            "key" : "key",
-            "group" : "group"
-          },
-          "query" : "{}"
-        }, {
-          "$state" : "{}",
-          "meta" : {
-            "field" : "field",
-            "controlledBy" : "controlledBy",
-            "negate" : true,
-            "alias" : "alias",
-            "index" : "index",
-            "disabled" : true,
-            "params" : "{}",
-            "type" : "type",
-            "value" : "value",
-            "isMultiIndex" : true,
-            "key" : "key",
-            "group" : "group"
-          },
-          "query" : "{}"
-        } ]
-      }
-    },
-    "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
-    "params" : {
-      "key" : ""
-    },
-    "uuid" : "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61",
-    "connector_type_id" : ".server-log",
-    "frequency" : {
-      "summary" : true,
-      "throttle" : "10m",
-      "notify_when" : "onActiveAlert"
-    },
-    "group" : "default"
-  } ]
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - rule_response_properties -

401

- Authorization information is missing or invalid. - 401_response -

404

- Object is not found. - 404_response -
-
-
-
- Up - 
get /s/{spaceId}/api/alerting/rule_types
-
Retrieves a list of rule types. (getRuleTypes)
-
If you have read privileges for one or more Kibana features, the API response contains information about the appropriate rule types. For example, there are rule types associated with the Management > Stack Rules feature, Analytics > Discover and Machine Learning features, Observability features, and Security features. To get rule types associated with the Stack Monitoring feature, use the monitoring_user built-in role.
- -

Path parameters

-
-
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- - - - - - -

Return type

-
- array[getRuleTypes_200_response_inner] - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "recovery_action_group" : {
-    "name" : "name",
-    "id" : "id"
-  },
-  "does_set_recovery_context" : true,
-  "is_exportable" : true,
-  "authorized_consumers" : {
-    "alerts" : {
-      "all" : true,
-      "read" : true
-    },
-    "discover" : {
-      "all" : true,
-      "read" : true
-    },
-    "stackAlerts" : {
-      "all" : true,
-      "read" : true
-    },
-    "infrastructure" : {
-      "all" : true,
-      "read" : true
-    },
-    "siem" : {
-      "all" : true,
-      "read" : true
-    },
-    "monitoring" : {
-      "all" : true,
-      "read" : true
-    },
-    "logs" : {
-      "all" : true,
-      "read" : true
-    },
-    "apm" : {
-      "all" : true,
-      "read" : true
-    },
-    "ml" : {
-      "all" : true,
-      "read" : true
-    },
-    "uptime" : {
-      "all" : true,
-      "read" : true
-    }
-  },
-  "action_groups" : [ {
-    "name" : "name",
-    "id" : "id"
-  }, {
-    "name" : "name",
-    "id" : "id"
-  } ],
-  "minimum_license_required" : "basic",
-  "action_variables" : {
-    "context" : [ {
-      "name" : "name",
-      "description" : "description",
-      "useWithTripleBracesInTemplates" : true
-    }, {
-      "name" : "name",
-      "description" : "description",
-      "useWithTripleBracesInTemplates" : true
-    } ],
-    "state" : [ {
-      "name" : "name",
-      "description" : "description"
-    }, {
-      "name" : "name",
-      "description" : "description"
-    } ],
-    "params" : [ {
-      "name" : "name",
-      "description" : "description"
-    }, {
-      "name" : "name",
-      "description" : "description"
-    } ]
-  },
-  "rule_task_timeout" : "5m",
-  "name" : "name",
-  "enabled_in_license" : true,
-  "producer" : "stackAlerts",
-  "id" : "id",
-  "default_action_group_id" : "default_action_group_id"
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - -

401

- Authorization information is missing or invalid. - 401_response -
-
-
-
- Up - 
post /s/{spaceId}/api/alerts/alert/{alertId}
-
Create an alert. (legacyCreateAlert)
-
Deprecated in 7.13.0. Use the create rule API instead.
- -

Path parameters

-
-
alertId (required)
- -
Path Parameter — An UUID v1 or v4 identifier for the alert. If this parameter is omitted, the identifier is randomly generated. default: null
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- -

Consumes

- This API call consumes the following media types via the Content-Type request header: -
    -
  • application/json
    • -
- -

Request body

-
-
Legacy_create_alert_request_properties Legacy_create_alert_request_properties (required)
- -
Body Parameter —
- -
- -

Request headers

-
-
kbn-xsrf (required)
- -
Header Parameter — Cross-site request forgery protection default: null
- -
- - - -

Return type

-
- alert_response_properties - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "alertTypeId" : ".index-threshold",
-  "throttle" : "throttle",
-  "updatedBy" : "elastic",
-  "executionStatus" : {
-    "lastExecutionDate" : "2022-12-06T00:13:43.89Z",
-    "status" : "ok"
-  },
-  "params" : {
-    "key" : ""
-  },
-  "enabled" : true,
-  "mutedInstanceIds" : [ "mutedInstanceIds", "mutedInstanceIds" ],
-  "tags" : [ "tags", "tags" ],
-  "createdAt" : "2022-12-05T23:36:58.284Z",
-  "schedule" : {
-    "interval" : "interval"
-  },
-  "notifyWhen" : "onActionGroupChange",
-  "createdBy" : "elastic",
-  "muteAll" : false,
-  "name" : "my alert",
-  "scheduledTaskId" : "b530fed0-74f5-11ed-9801-35303b735aef",
-  "id" : "b530fed0-74f5-11ed-9801-35303b735aef",
-  "actions" : [ "{}", "{}" ],
-  "apiKeyOwner" : "elastic",
-  "updatedAt" : "2022-12-05T23:36:58.284Z"
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - alert_response_properties -

401

- Authorization information is missing or invalid. - 401_response -
-
-
-
- Up - 
post /s/{spaceId}/api/alerts/alert/{alertId}/_disable
-
Disables an alert. (legacyDisableAlert)
-
Deprecated in 7.13.0. Use the disable rule API instead.
- -

Path parameters

-
-
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
alertId (required)
- -
Path Parameter — The identifier for the alert. default: null
-
- - - -

Request headers

-
-
kbn-xsrf (required)
- -
Header Parameter — Cross-site request forgery protection default: null
- -
- - - - - - - -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

204

- Indicates a successful call. - -

401

- Authorization information is missing or invalid. - 401_response -
-
-
-
- Up - 
post /s/{spaceId}/api/alerts/alert/{alertId}/_enable
-
Enables an alert. (legacyEnableAlert)
-
Deprecated in 7.13.0. Use the enable rule API instead.
- -

Path parameters

-
-
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
alertId (required)
- -
Path Parameter — The identifier for the alert. default: null
-
- - - -

Request headers

-
-
kbn-xsrf (required)
- -
Header Parameter — Cross-site request forgery protection default: null
- -
- - - - - - - -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

204

- Indicates a successful call. - -

401

- Authorization information is missing or invalid. - 401_response -
-
-
-
- Up - 
get /s/{spaceId}/api/alerts/alerts/_find
-
Retrieves a paginated set of alerts. (legacyFindAlerts)
-
Deprecated in 7.13.0. Use the find rules API instead. NOTE: Alert params are stored as a flattened field type and analyzed as keywords. As alerts change in Kibana, the results on each page of the response also change. Use the find API for traditional paginated results, but avoid using it to export large amounts of data.
- -

Path parameters

-
-
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- - - - -

Query parameters

-
-
default_search_operator (optional)
- -
Query Parameter — The default operator to use for the simple_query_string. default: OR
fields (optional)
- -
Query Parameter — The fields to return in the attributes key of the response. default: null
filter (optional)
- -
Query Parameter — A KQL string that you filter with an attribute from your saved object. It should look like savedObjectType.attributes.title: "myTitle". However, if you used a direct attribute of a saved object, such as updatedAt, you must define your filter, for example, savedObjectType.updatedAt > 2018-12-22. default: null
has_reference (optional)
- -
Query Parameter — Filters the rules that have a relation with the reference objects with a specific type and identifier. default: null
page (optional)
- -
Query Parameter — The page number to return. default: 1
per_page (optional)
- -
Query Parameter — The number of alerts to return per page. default: 20
search (optional)
- -
Query Parameter — An Elasticsearch simple_query_string query that filters the alerts in the response. default: null
search_fields (optional)
- -
Query Parameter — The fields to perform the simple_query_string parsed query against. default: null
sort_field (optional)
- -
Query Parameter — Determines which field is used to sort the results. The field must exist in the attributes key of the response. default: null
sort_order (optional)
- -
Query Parameter — Determines the sort order. default: desc
-
- - -

Return type

-
- legacyFindAlerts_200_response - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "total" : 1,
-  "perPage" : 6,
-  "data" : [ {
-    "alertTypeId" : ".index-threshold",
-    "throttle" : "throttle",
-    "updatedBy" : "elastic",
-    "executionStatus" : {
-      "lastExecutionDate" : "2022-12-06T00:13:43.89Z",
-      "status" : "ok"
-    },
-    "params" : {
-      "key" : ""
-    },
-    "enabled" : true,
-    "mutedInstanceIds" : [ "mutedInstanceIds", "mutedInstanceIds" ],
-    "tags" : [ "tags", "tags" ],
-    "createdAt" : "2022-12-05T23:36:58.284Z",
-    "schedule" : {
-      "interval" : "interval"
-    },
-    "notifyWhen" : "onActionGroupChange",
-    "createdBy" : "elastic",
-    "muteAll" : false,
-    "name" : "my alert",
-    "scheduledTaskId" : "b530fed0-74f5-11ed-9801-35303b735aef",
-    "id" : "b530fed0-74f5-11ed-9801-35303b735aef",
-    "actions" : [ "{}", "{}" ],
-    "apiKeyOwner" : "elastic",
-    "updatedAt" : "2022-12-05T23:36:58.284Z"
-  }, {
-    "alertTypeId" : ".index-threshold",
-    "throttle" : "throttle",
-    "updatedBy" : "elastic",
-    "executionStatus" : {
-      "lastExecutionDate" : "2022-12-06T00:13:43.89Z",
-      "status" : "ok"
-    },
-    "params" : {
-      "key" : ""
-    },
-    "enabled" : true,
-    "mutedInstanceIds" : [ "mutedInstanceIds", "mutedInstanceIds" ],
-    "tags" : [ "tags", "tags" ],
-    "createdAt" : "2022-12-05T23:36:58.284Z",
-    "schedule" : {
-      "interval" : "interval"
-    },
-    "notifyWhen" : "onActionGroupChange",
-    "createdBy" : "elastic",
-    "muteAll" : false,
-    "name" : "my alert",
-    "scheduledTaskId" : "b530fed0-74f5-11ed-9801-35303b735aef",
-    "id" : "b530fed0-74f5-11ed-9801-35303b735aef",
-    "actions" : [ "{}", "{}" ],
-    "apiKeyOwner" : "elastic",
-    "updatedAt" : "2022-12-05T23:36:58.284Z"
-  } ],
-  "page" : 0
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - legacyFindAlerts_200_response -

401

- Authorization information is missing or invalid. - 401_response -
-
-
-
- Up - 
get /s/{spaceId}/api/alerts/alert/{alertId}
-
Retrieves an alert by its identifier. (legacyGetAlert)
-
Deprecated in 7.13.0. Use the get rule API instead.
- -

Path parameters

-
-
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
alertId (required)
- -
Path Parameter — The identifier for the alert. default: null
-
- - - - - - -

Return type

-
- alert_response_properties - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "alertTypeId" : ".index-threshold",
-  "throttle" : "throttle",
-  "updatedBy" : "elastic",
-  "executionStatus" : {
-    "lastExecutionDate" : "2022-12-06T00:13:43.89Z",
-    "status" : "ok"
-  },
-  "params" : {
-    "key" : ""
-  },
-  "enabled" : true,
-  "mutedInstanceIds" : [ "mutedInstanceIds", "mutedInstanceIds" ],
-  "tags" : [ "tags", "tags" ],
-  "createdAt" : "2022-12-05T23:36:58.284Z",
-  "schedule" : {
-    "interval" : "interval"
-  },
-  "notifyWhen" : "onActionGroupChange",
-  "createdBy" : "elastic",
-  "muteAll" : false,
-  "name" : "my alert",
-  "scheduledTaskId" : "b530fed0-74f5-11ed-9801-35303b735aef",
-  "id" : "b530fed0-74f5-11ed-9801-35303b735aef",
-  "actions" : [ "{}", "{}" ],
-  "apiKeyOwner" : "elastic",
-  "updatedAt" : "2022-12-05T23:36:58.284Z"
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - alert_response_properties -

401

- Authorization information is missing or invalid. - 401_response -
-
-
-
- Up - 
get /s/{spaceId}/api/alerts/alerts/list_alert_types
-
Retrieves a list of alert types. (legacyGetAlertTypes)
-
Deprecated in 7.13.0. Use the get rule types API instead.
- -

Path parameters

-
-
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- - - - - - -

Return type

-
- array[legacyGetAlertTypes_200_response_inner] - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "defaultActionGroupId" : "defaultActionGroupId",
-  "isExportable" : true,
-  "actionVariables" : {
-    "context" : [ {
-      "name" : "name",
-      "description" : "description"
-    }, {
-      "name" : "name",
-      "description" : "description"
-    } ],
-    "state" : [ {
-      "name" : "name",
-      "description" : "description"
-    }, {
-      "name" : "name",
-      "description" : "description"
-    } ],
-    "params" : [ {
-      "name" : "name",
-      "description" : "description"
-    }, {
-      "name" : "name",
-      "description" : "description"
-    } ]
-  },
-  "actionGroups" : [ {
-    "name" : "name",
-    "id" : "id"
-  }, {
-    "name" : "name",
-    "id" : "id"
-  } ],
-  "name" : "name",
-  "producer" : "producer",
-  "authorizedConsumers" : "{}",
-  "recoveryActionGroup" : {
-    "name" : "name",
-    "id" : "id"
-  },
-  "enabledInLicense" : true,
-  "id" : "id",
-  "minimumLicenseRequired" : "minimumLicenseRequired"
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - -

401

- Authorization information is missing or invalid. - 401_response -
-
-
-
- Up - 
get /s/{spaceId}/api/alerts/alerts/_health
-
Retrieves the health status of the alerting framework. (legacyGetAlertingHealth)
-
Deprecated in 7.13.0. Use the get alerting framework health API instead.
- -

Path parameters

-
-
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- - - - - - -

Return type

-
- legacyGetAlertingHealth_200_response - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "hasPermanentEncryptionKey" : true,
-  "alertingFrameworkHealth" : {
-    "executionHealth" : {
-      "status" : "ok",
-      "timestamp" : "2023-01-13T01:28:00.28Z"
-    },
-    "decryptionHealth" : {
-      "status" : "ok",
-      "timestamp" : "2023-01-13T01:28:00.28Z"
-    },
-    "readHealth" : {
-      "status" : "ok",
-      "timestamp" : "2023-01-13T01:28:00.28Z"
-    }
-  },
-  "isSufficientlySecure" : true
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - legacyGetAlertingHealth_200_response -

401

- Authorization information is missing or invalid. - 401_response -
-
-
-
- Up - 
post /s/{spaceId}/api/alerts/alert/{alertId}/alert_instance/{alertInstanceId}/_mute
-
Mutes an alert instance. (legacyMuteAlertInstance)
-
Deprecated in 7.13.0. Use the mute alert API instead.
- -

Path parameters

-
-
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
alertId (required)
- -
Path Parameter — An identifier for the alert. default: null
alertInstanceId (required)
- -
Path Parameter — An identifier for the alert instance. default: null
-
- - - -

Request headers

-
-
kbn-xsrf (required)
- -
Header Parameter — Cross-site request forgery protection default: null
- -
- - - - - - - -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

204

- Indicates a successful call. - -

401

- Authorization information is missing or invalid. - 401_response -
-
-
-
- Up - 
post /s/{spaceId}/api/alerts/alert/{alertId}/_mute_all
-
Mutes all alert instances. (legacyMuteAllAlertInstances)
-
Deprecated in 7.13.0. Use the mute all alerts API instead.
- -

Path parameters

-
-
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
alertId (required)
- -
Path Parameter — The identifier for the alert. default: null
-
- - - -

Request headers

-
-
kbn-xsrf (required)
- -
Header Parameter — Cross-site request forgery protection default: null
- -
- - - - - - - -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

204

- Indicates a successful call. - -

401

- Authorization information is missing or invalid. - 401_response -
-
-
-
- Up - 
post /s/{spaceId}/api/alerts/alert/{alertId}/alert_instance/{alertInstanceId}/_unmute
-
Unmutes an alert instance. (legacyUnmuteAlertInstance)
-
Deprecated in 7.13.0. Use the unmute alert API instead.
- -

Path parameters

-
-
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
alertId (required)
- -
Path Parameter — An identifier for the alert. default: null
alertInstanceId (required)
- -
Path Parameter — An identifier for the alert instance. default: null
-
- - - -

Request headers

-
-
kbn-xsrf (required)
- -
Header Parameter — Cross-site request forgery protection default: null
- -
- - - - - - - -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

204

- Indicates a successful call. - -

401

- Authorization information is missing or invalid. - 401_response -
-
-
-
- Up - 
post /s/{spaceId}/api/alerts/alert/{alertId}/_unmute_all
-
Unmutes all alert instances. (legacyUnmuteAllAlertInstances)
-
Deprecated in 7.13.0. Use the unmute all alerts API instead.
- -

Path parameters

-
-
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
alertId (required)
- -
Path Parameter — The identifier for the alert. default: null
-
- - - -

Request headers

-
-
kbn-xsrf (required)
- -
Header Parameter — Cross-site request forgery protection default: null
- -
- - - - - - - -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

204

- Indicates a successful call. - -

401

- Authorization information is missing or invalid. - 401_response -
-
-
-
- Up - 
put /s/{spaceId}/api/alerts/alert/{alertId}
-
Updates the attributes for an alert. (legacyUpdateAlert)
-
Deprecated in 7.13.0. Use the update rule API instead.
- -

Path parameters

-
-
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
alertId (required)
- -
Path Parameter — The identifier for the alert. default: null
-
- -

Consumes

- This API call consumes the following media types via the Content-Type request header: -
    -
  • application/json
    • -
- -

Request body

-
-
Legacy_update_alert_request_properties Legacy_update_alert_request_properties (required)
- -
Body Parameter —
- -
- -

Request headers

-
-
kbn-xsrf (required)
- -
Header Parameter — Cross-site request forgery protection default: null
- -
- - - -

Return type

-
- alert_response_properties - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "alertTypeId" : ".index-threshold",
-  "throttle" : "throttle",
-  "updatedBy" : "elastic",
-  "executionStatus" : {
-    "lastExecutionDate" : "2022-12-06T00:13:43.89Z",
-    "status" : "ok"
-  },
-  "params" : {
-    "key" : ""
-  },
-  "enabled" : true,
-  "mutedInstanceIds" : [ "mutedInstanceIds", "mutedInstanceIds" ],
-  "tags" : [ "tags", "tags" ],
-  "createdAt" : "2022-12-05T23:36:58.284Z",
-  "schedule" : {
-    "interval" : "interval"
-  },
-  "notifyWhen" : "onActionGroupChange",
-  "createdBy" : "elastic",
-  "muteAll" : false,
-  "name" : "my alert",
-  "scheduledTaskId" : "b530fed0-74f5-11ed-9801-35303b735aef",
-  "id" : "b530fed0-74f5-11ed-9801-35303b735aef",
-  "actions" : [ "{}", "{}" ],
-  "apiKeyOwner" : "elastic",
-  "updatedAt" : "2022-12-05T23:36:58.284Z"
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - alert_response_properties -

401

- Authorization information is missing or invalid. - 401_response -
-
-
-
- Up - 
delete /s/{spaceId}/api/alerts/alert/{alertId}
-
Permanently removes an alert. (legaryDeleteAlert)
-
Deprecated in 7.13.0. Use the delete rule API instead. WARNING: After you delete an alert, you cannot recover it.
- -

Path parameters

-
-
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
alertId (required)
- -
Path Parameter — The identifier for the alert. default: null
-
- - - -

Request headers

-
-
kbn-xsrf (required)
- -
Header Parameter — Cross-site request forgery protection default: null
- -
- - - - - - - -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

204

- Indicates a successful call. - -

401

- Authorization information is missing or invalid. - 401_response -
-
-
-
- Up - 
post /s/{spaceId}/api/alerting/rule/{ruleId}/alert/{alertId}/_mute
-
Mutes an alert. (muteAlert)
-
You must have all privileges for the appropriate Kibana features, depending on the consumer and rule_type_id of the rule. For example, the Management > Stack Rules feature, Analytics > Discover and Machine Learning features, Observability, and Security features. If the rule has actions, you must also have read privileges for the Management > Actions and Connectors feature.
- -

Path parameters

-
-
alertId (required)
- -
Path Parameter — An identifier for the alert. The identifier is generated by the rule and might be any arbitrary string. default: null
ruleId (required)
- -
Path Parameter — An identifier for the rule. default: null
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- - - -

Request headers

-
-
kbn-xsrf (required)
- -
Header Parameter — Cross-site request forgery protection default: null
- -
- - - - - - - -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

204

- Indicates a successful call. - -

401

- Authorization information is missing or invalid. - 401_response -
-
-
-
- Up - 
post /s/{spaceId}/api/alerting/rule/{ruleId}/_mute_all
-
Mutes all alerts. (muteAllAlerts)
-
This API snoozes the notifications for the rule indefinitely. The rule checks continue to occur but alerts will not trigger any actions. You must have all privileges for the appropriate Kibana features, depending on the consumer and rule_type_id of the rule. For example, the Management > Stack Rules feature, Analytics > Discover and Machine Learning features, Observability, and Security features. If the rule has actions, you must also have read privileges for the Management > Actions and Connectors feature.
- -

Path parameters

-
-
ruleId (required)
- -
Path Parameter — An identifier for the rule. default: null
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- - - -

Request headers

-
-
kbn-xsrf (required)
- -
Header Parameter — Cross-site request forgery protection default: null
- -
- - - - - - - -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

204

- Indicates a successful call. - -

401

- Authorization information is missing or invalid. - 401_response -
-
-
-
- Up - 
post /s/{spaceId}/api/alerting/rule/{ruleId}/alert/{alertId}/_unmute
-
Unmutes an alert. (unmuteAlert)
-
You must have all privileges for the appropriate Kibana features, depending on the consumer and rule_type_id of the rule. For example, the Management > Stack Rules feature, Analytics > Discover and Machine Learning features, Observability, and Security features. If the rule has actions, you must also have read privileges for the Management > Actions and Connectors feature.
- -

Path parameters

-
-
alertId (required)
- -
Path Parameter — An identifier for the alert. The identifier is generated by the rule and might be any arbitrary string. default: null
ruleId (required)
- -
Path Parameter — An identifier for the rule. default: null
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- - - -

Request headers

-
-
kbn-xsrf (required)
- -
Header Parameter — Cross-site request forgery protection default: null
- -
- - - - - - - -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

204

- Indicates a successful call. - -

401

- Authorization information is missing or invalid. - 401_response -
-
-
-
- Up - 
post /s/{spaceId}/api/alerting/rule/{ruleId}/_unmute_all
-
Unmutes all alerts. (unmuteAllAlerts)
-
If the rule has its notifications snoozed indefinitely, this API cancels the snooze. You must have all privileges for the appropriate Kibana features, depending on the consumer and rule_type_id of the rule. For example, the Management > Stack Rules feature, Analytics > Discover and Machine Learning features, Observability, and Security features. If the rule has actions, you must also have read privileges for the Management > Actions and Connectors feature.
- -

Path parameters

-
-
ruleId (required)
- -
Path Parameter — An identifier for the rule. default: null
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- - - -

Request headers

-
-
kbn-xsrf (required)
- -
Header Parameter — Cross-site request forgery protection default: null
- -
- - - - - - - -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

204

- Indicates a successful call. - -

401

- Authorization information is missing or invalid. - 401_response -
-
-
-
- Up - 
put /s/{spaceId}/api/alerting/rule/{ruleId}
-
Updates the attributes for a rule. (updateRule)
-
To update a rule, you must have all privileges for the appropriate Kibana features, depending on the consumer and rule_type_id of the rule you're updating. For example, you must have privileges for the Management > Stack rules feature, Analytics > Discover and Machine Learning features, Observability features, or Security features. If the rule has actions, you must also have read privileges for the Management > Actions and Connectors feature. This API supports both key- and token-based authentication. To use key-based authentication, create an API key in Kibana and use it in the header of the API call. To use token-based authentication, provide a username and password; an API key that matches the current privileges of the user is created automatically. In both cases, the API key is subsequently used for authorization when the rule runs. NOTE: If the API key has different privileges than the key that created or most recently updated the rule, the rule behavior might change. Though some properties are optional, when you update the rule the existing property values are overwritten with default values. Therefore, it is recommended to explicitly set all property values.
- -

Path parameters

-
-
ruleId (required)
- -
Path Parameter — An identifier for the rule. default: null
spaceId (required)
- -
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
-
- -

Consumes

- This API call consumes the following media types via the Content-Type request header: -
    -
  • application/json
    • -
- -

Request body

-
-
update_rule_request update_rule_request (required)
- -
Body Parameter —
- -
- -

Request headers

-
-
kbn-xsrf (required)
- -
Header Parameter — Cross-site request forgery protection default: null
- -
- - - -

Return type

-
- rule_response_properties - -
- - - -

Example data

-
Content-Type: application/json
- 
{
-  "throttle" : "10m",
-  "created_at" : "2022-12-05T23:36:58.284Z",
-  "api_key_created_by_user" : false,
-  "enabled" : true,
-  "running" : true,
-  "notify_when" : "notify_when",
-  "next_run" : "2022-12-06T00:14:43.818Z",
-  "updated_at" : "2022-12-05T23:36:58.284Z",
-  "execution_status" : {
-    "last_execution_date" : "2022-12-06T00:13:43.89Z",
-    "last_duration" : 55,
-    "status" : "ok"
-  },
-  "scheduled_task_id" : "b530fed0-74f5-11ed-9801-35303b735aef",
-  "id" : "b530fed0-74f5-11ed-9801-35303b735aef",
-  "consumer" : "alerts",
-  "last_run" : {
-    "alerts_count" : {
-      "ignored" : 6,
-      "new" : 1,
-      "recovered" : 5,
-      "active" : 0
-    },
-    "outcome_msg" : [ "outcome_msg", "outcome_msg" ],
-    "outcome_order" : 5,
-    "warning" : "warning",
-    "outcome" : "succeeded"
-  },
-  "params" : {
-    "key" : ""
-  },
-  "created_by" : "elastic",
-  "muted_alert_ids" : [ "muted_alert_ids", "muted_alert_ids" ],
-  "rule_type_id" : "monitoring_alert_cluster_health",
-  "revision" : 2,
-  "tags" : [ "tags", "tags" ],
-  "api_key_owner" : "elastic",
-  "schedule" : {
-    "interval" : "1m"
-  },
-  "name" : "cluster_health_rule",
-  "updated_by" : "elastic",
-  "mute_all" : false,
-  "actions" : [ {
-    "alerts_filter" : {
-      "timeframe" : {
-        "hours" : {
-          "start" : "08:00",
-          "end" : "17:00"
-        },
-        "timezone" : "Europe/Madrid",
-        "days" : [ 1, 2, 3, 4, 5 ]
-      },
-      "query" : {
-        "kql" : "kql",
-        "filters" : [ {
-          "$state" : "{}",
-          "meta" : {
-            "field" : "field",
-            "controlledBy" : "controlledBy",
-            "negate" : true,
-            "alias" : "alias",
-            "index" : "index",
-            "disabled" : true,
-            "params" : "{}",
-            "type" : "type",
-            "value" : "value",
-            "isMultiIndex" : true,
-            "key" : "key",
-            "group" : "group"
-          },
-          "query" : "{}"
-        }, {
-          "$state" : "{}",
-          "meta" : {
-            "field" : "field",
-            "controlledBy" : "controlledBy",
-            "negate" : true,
-            "alias" : "alias",
-            "index" : "index",
-            "disabled" : true,
-            "params" : "{}",
-            "type" : "type",
-            "value" : "value",
-            "isMultiIndex" : true,
-            "key" : "key",
-            "group" : "group"
-          },
-          "query" : "{}"
-        } ]
-      }
-    },
-    "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
-    "params" : {
-      "key" : ""
-    },
-    "uuid" : "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61",
-    "connector_type_id" : ".server-log",
-    "frequency" : {
-      "summary" : true,
-      "throttle" : "10m",
-      "notify_when" : "onActiveAlert"
-    },
-    "group" : "default"
-  }, {
-    "alerts_filter" : {
-      "timeframe" : {
-        "hours" : {
-          "start" : "08:00",
-          "end" : "17:00"
-        },
-        "timezone" : "Europe/Madrid",
-        "days" : [ 1, 2, 3, 4, 5 ]
-      },
-      "query" : {
-        "kql" : "kql",
-        "filters" : [ {
-          "$state" : "{}",
-          "meta" : {
-            "field" : "field",
-            "controlledBy" : "controlledBy",
-            "negate" : true,
-            "alias" : "alias",
-            "index" : "index",
-            "disabled" : true,
-            "params" : "{}",
-            "type" : "type",
-            "value" : "value",
-            "isMultiIndex" : true,
-            "key" : "key",
-            "group" : "group"
-          },
-          "query" : "{}"
-        }, {
-          "$state" : "{}",
-          "meta" : {
-            "field" : "field",
-            "controlledBy" : "controlledBy",
-            "negate" : true,
-            "alias" : "alias",
-            "index" : "index",
-            "disabled" : true,
-            "params" : "{}",
-            "type" : "type",
-            "value" : "value",
-            "isMultiIndex" : true,
-            "key" : "key",
-            "group" : "group"
-          },
-          "query" : "{}"
-        } ]
-      }
-    },
-    "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
-    "params" : {
-      "key" : ""
-    },
-    "uuid" : "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61",
-    "connector_type_id" : ".server-log",
-    "frequency" : {
-      "summary" : true,
-      "throttle" : "10m",
-      "notify_when" : "onActiveAlert"
-    },
-    "group" : "default"
-  } ]
-}
- -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    -
  • application/json
    • -
- -

Responses

-

200

- Indicates a successful call. - rule_response_properties -

401

- Authorization information is missing or invalid. - 401_response -

404

- Object is not found. - 404_response -
-
- -

Models

- [ Jump to Methods ] - -

Table of Contents

-
    -
  1. 401_response - Unsuccessful rule API response
    2. -
  2. 404_response -
    3. -
  3. Legacy_create_alert_request_properties - Legacy create alert request properties
    4. -
  4. Legacy_create_alert_request_properties_schedule -
    5. -
  5. Legacy_update_alert_request_properties - Legacy update alert request properties
    6. -
  6. Legacy_update_alert_request_properties_actions_inner -
    7. -
  7. Legacy_update_alert_request_properties_schedule -
    8. -
  8. actions_inner -
    9. -
  9. actions_inner_alerts_filter -
    10. -
  10. actions_inner_alerts_filter_query -
    11. -
  11. actions_inner_alerts_filter_query_filters_inner -
    12. -
  12. actions_inner_alerts_filter_query_filters_inner_meta -
    13. -
  13. actions_inner_alerts_filter_timeframe -
    14. -
  14. actions_inner_alerts_filter_timeframe_hours -
    15. -
  15. actions_inner_frequency -
    16. -
  16. alert_response_properties - Legacy alert response properties
    17. -
  17. alert_response_properties_executionStatus -
    18. -
  18. alert_response_properties_schedule -
    19. -
  19. create_rule_request - Create rule request
    20. -
  20. findRules_200_response -
    21. -
  21. findRules_has_reference_parameter -
    22. -
  22. findRules_search_fields_parameter -
    23. -
  23. getAlertingHealth_200_response -
    24. -
  24. getAlertingHealth_200_response_alerting_framework_health -
    25. -
  25. getAlertingHealth_200_response_alerting_framework_health_decryption_health -
    26. -
  26. getAlertingHealth_200_response_alerting_framework_health_execution_health -
    27. -
  27. getAlertingHealth_200_response_alerting_framework_health_read_health -
    28. -
  28. getRuleTypes_200_response_inner -
    29. -
  29. getRuleTypes_200_response_inner_action_groups_inner -
    30. -
  30. getRuleTypes_200_response_inner_action_variables -
    31. -
  31. getRuleTypes_200_response_inner_action_variables_context_inner -
    32. -
  32. getRuleTypes_200_response_inner_action_variables_params_inner -
    33. -
  33. getRuleTypes_200_response_inner_authorized_consumers -
    34. -
  34. getRuleTypes_200_response_inner_authorized_consumers_alerts -
    35. -
  35. getRuleTypes_200_response_inner_recovery_action_group -
    36. -
  36. legacyFindAlerts_200_response -
    37. -
  37. legacyGetAlertTypes_200_response_inner -
    38. -
  38. legacyGetAlertTypes_200_response_inner_actionVariables -
    39. -
  39. legacyGetAlertTypes_200_response_inner_actionVariables_context_inner -
    40. -
  40. legacyGetAlertTypes_200_response_inner_recoveryActionGroup -
    41. -
  41. legacyGetAlertingHealth_200_response -
    42. -
  42. legacyGetAlertingHealth_200_response_alertingFrameworkHealth -
    43. -
  43. legacyGetAlertingHealth_200_response_alertingFrameworkHealth_decryptionHealth -
    44. -
  44. legacyGetAlertingHealth_200_response_alertingFrameworkHealth_executionHealth -
    45. -
  45. legacyGetAlertingHealth_200_response_alertingFrameworkHealth_readHealth -
    46. -
  46. notify_when -
    47. -
  47. rule_response_properties - Rule response properties
    48. -
  48. rule_response_properties_execution_status -
    49. -
  49. rule_response_properties_last_run -
    50. -
  50. rule_response_properties_last_run_alerts_count -
    51. -
  51. schedule -
    52. -
  52. update_rule_request - Update rule request
    53. -
- -
-

401_response - Unsuccessful rule API response Up

-
-
-
error (optional)
String
-
Enum:
-
Unauthorized
-
message (optional)
String
-
statusCode (optional)
Integer
-
Enum:
-
401
-
-
-
-

404_response - Up

-
-
-
error (optional)
String
-
Enum:
-
Not Found
-
message (optional)
String
-
statusCode (optional)
Integer
-
Enum:
-
404
-
-
-
-

Legacy_create_alert_request_properties - Legacy create alert request properties Up

-
-
-
actions (optional)
array[Legacy_update_alert_request_properties_actions_inner]
-
alertTypeId
String The ID of the alert type that you want to call when the alert is scheduled to run.
-
consumer
String The name of the application that owns the alert. This name has to match the Kibana feature name, as that dictates the required role-based access control privileges.
-
enabled (optional)
Boolean Indicates if you want to run the alert on an interval basis after it is created.
-
name
String A name to reference and search.
-
notifyWhen
String The condition for throttling the notification.
-
Enum:
-
onActionGroupChange
onActiveAlert
onThrottleInterval
-
params
Object The parameters to pass to the alert type executor params value. This will also validate against the alert type params validator, if defined.
-
schedule
Legacy_create_alert_request_properties_schedule
-
tags (optional)
array[String] A list of keywords to reference and search.
-
throttle (optional)
String How often this alert should fire the same actions. This will prevent the alert from sending out the same notification over and over. For example, if an alert with a schedule of 1 minute stays in a triggered state for 90 minutes, setting a throttle of 10m or 1h will prevent it from sending 90 notifications during this period.
-
-
-
-

Legacy_create_alert_request_properties_schedule - Up

-
The schedule specifying when this alert should be run. A schedule is structured such that the key specifies the format you wish to use and its value specifies the schedule.
-
-
interval (optional)
String The interval format specifies the interval in seconds, minutes, hours or days at which the alert should execute.
-
-
-
-

Legacy_update_alert_request_properties - Legacy update alert request properties Up

-
-
-
actions (optional)
array[Legacy_update_alert_request_properties_actions_inner]
-
name
String A name to reference and search.
-
notifyWhen
String The condition for throttling the notification.
-
Enum:
-
onActionGroupChange
onActiveAlert
onThrottleInterval
-
params
Object The parameters to pass to the alert type executor params value. This will also validate against the alert type params validator, if defined.
-
schedule
Legacy_update_alert_request_properties_schedule
-
tags (optional)
array[String] A list of keywords to reference and search.
-
throttle (optional)
String How often this alert should fire the same actions. This will prevent the alert from sending out the same notification over and over. For example, if an alert with a schedule of 1 minute stays in a triggered state for 90 minutes, setting a throttle of 10m or 1h will prevent it from sending 90 notifications during this period.
-
-
-
-

Legacy_update_alert_request_properties_actions_inner - Up

-
-
-
actionTypeId
String The identifier for the action type.
-
group
String Grouping actions is recommended for escalations for different types of alert instances. If you don't need this functionality, set it to default.
-
id
String The ID of the action saved object to execute.
-
params
Object The map to the params that the action type will receive. params are handled as Mustache templates and passed a default set of context.
-
-
-
-

Legacy_update_alert_request_properties_schedule - Up

-
The schedule specifying when this alert should be run. A schedule is structured such that the key specifies the format you wish to use and its value specifies the schedule.
-
-
interval (optional)
String The interval format specifies the interval in seconds, minutes, hours or days at which the alert should execute.
-
-
-
-

actions_inner - Up

-
-
-
alerts_filter (optional)
actions_inner_alerts_filter
-
connector_type_id (optional)
String The type of connector. This property appears in responses but cannot be set in requests.
-
frequency (optional)
actions_inner_frequency
-
group (optional)
String The group name for the actions. If you don't need to group actions, set to default.
-
id (optional)
String The identifier for the connector saved object.
-
params (optional)
map[String, oas_any_type_not_mapped] The parameters for the action, which are sent to the connector. The params are handled as Mustache templates and passed a default set of context.
-
uuid (optional)
String A universally unique identifier (UUID) for the action.
-
-
-
-

actions_inner_alerts_filter - Up

-
Conditions that affect whether the action runs. If you specify multiple conditions, all conditions must be met for the action to run. For example, if an alert occurs within the specified time frame and matches the query, the action runs.
-
-
query (optional)
actions_inner_alerts_filter_query
-
timeframe (optional)
actions_inner_alerts_filter_timeframe
-
-
-
-

actions_inner_alerts_filter_query - Up

-
Defines a query filter that determines whether the action runs.
-
-
kql (optional)
String A filter written in Kibana Query Language (KQL).
-
filters (optional)
array[actions_inner_alerts_filter_query_filters_inner]
-
-
-
-

actions_inner_alerts_filter_query_filters_inner - Up

-
A filter written in Elasticsearch Query Domain Specific Language (DSL) as defined in the kbn-es-query package.
-
-
meta (optional)
actions_inner_alerts_filter_query_filters_inner_meta
-
query (optional)
Object
-
Dollarstate (optional)
Object
-
-
-
-

actions_inner_alerts_filter_query_filters_inner_meta - Up

-
-
-
alias (optional)
String
-
controlledBy (optional)
String
-
disabled (optional)
Boolean
-
field (optional)
String
-
group (optional)
String
-
index (optional)
String
-
isMultiIndex (optional)
Boolean
-
key (optional)
String
-
negate (optional)
Boolean
-
params (optional)
Object
-
type (optional)
String
-
value (optional)
String
-
-
-
-

actions_inner_alerts_filter_timeframe - Up

-
Defines a period that limits whether the action runs.
-
-
days (optional)
array[Integer] Defines the days of the week that the action can run, represented as an array of numbers. For example, 1 represents Monday. An empty array is equivalent to specifying all the days of the week.
-
hours (optional)
actions_inner_alerts_filter_timeframe_hours
-
timezone (optional)
String The ISO time zone for the hours values. Values such as UTC and UTC+1 also work but lack built-in daylight savings time support and are not recommended.
-
-
-
-

actions_inner_alerts_filter_timeframe_hours - Up

-
Defines the range of time in a day that the action can run. If the start value is 00:00 and the end value is 24:00, actions be generated all day.
-
-
end (optional)
String The end of the time frame in 24-hour notation (hh:mm).
-
start (optional)
String The start of the time frame in 24-hour notation (hh:mm).
-
-
-
-

actions_inner_frequency - Up

-
The parameters that affect how often actions are generated. NOTE: You cannot specify these parameters when notify_when or throttle are defined at the rule level.
-
-
notify_when
notify_when
-
summary
Boolean Indicates whether the action is a summary.
-
throttle (optional)
String The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if notify_when is set to onThrottleInterval. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.
-
-
-
-

alert_response_properties - Legacy alert response properties Up

-
-
-
actions (optional)
array[Object]
-
alertTypeId (optional)
String
-
apiKeyOwner (optional)
String
-
createdAt (optional)
Date The date and time that the alert was created. format: date-time
-
createdBy (optional)
String The identifier for the user that created the alert.
-
enabled (optional)
Boolean Indicates whether the alert is currently enabled.
-
executionStatus (optional)
alert_response_properties_executionStatus
-
id (optional)
String The identifier for the alert.
-
muteAll (optional)
Boolean
-
mutedInstanceIds (optional)
array[String]
-
name (optional)
String The name of the alert.
-
notifyWhen (optional)
String
-
params (optional)
map[String, oas_any_type_not_mapped]
-
schedule (optional)
alert_response_properties_schedule
-
scheduledTaskId (optional)
String
-
tags (optional)
array[String]
-
throttle (optional)
String
-
updatedAt (optional)
String
-
updatedBy (optional)
String The identifier for the user that updated this alert most recently.
-
-
-
-

alert_response_properties_executionStatus - Up

-
-
-
lastExecutionDate (optional)
Date format: date-time
-
status (optional)
String
-
-
-
-

alert_response_properties_schedule - Up

-
-
-
interval (optional)
String
-
-
-
-

create_rule_request - Create rule request Up

-
The create rule API request body varies depending on the type of rule and actions.
-
-
actions (optional)
array[actions_inner]
-
consumer
String The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
-
enabled (optional)
Boolean Indicates whether you want to run the rule on an interval basis after it is created.
-
name
String The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
-
notify_when (optional)
notify_when
-
params
map[String, oas_any_type_not_mapped] The parameters for the rule.
-
rule_type_id
String The ID of the rule type that you want to call when the rule is scheduled to run. For example, .es-query, .index-threshold, logs.alert.document.count, monitoring_alert_cluster_health, siem.thresholdRule, or xpack.ml.anomaly_detection_alert.
-
schedule
schedule
-
tags (optional)
array[String] The tags for the rule.
-
throttle (optional)
String The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if notify_when is set to onThrottleInterval. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.
-
-
-
-

findRules_200_response - Up

-
-
-
data (optional)
array[rule_response_properties]
-
page (optional)
Integer
-
per_page (optional)
Integer
-
total (optional)
Integer
-
-
-
-

findRules_has_reference_parameter - Up

-
-
-
id (optional)
String
-
type (optional)
String
-
-
-
-

findRules_search_fields_parameter - Up

-
-
-
-
-
-

getAlertingHealth_200_response - Up

-
-
-
alerting_framework_health (optional)
getAlertingHealth_200_response_alerting_framework_health
-
has_permanent_encryption_key (optional)
Boolean If false, the encrypted saved object plugin does not have a permanent encryption key.
-
is_sufficiently_secure (optional)
Boolean If false, security is enabled but TLS is not.
-
-
-
-

getAlertingHealth_200_response_alerting_framework_health - Up

-
Three substates identify the health of the alerting framework: decryption_health, execution_health, and read_health.
-
-
decryption_health (optional)
getAlertingHealth_200_response_alerting_framework_health_decryption_health
-
execution_health (optional)
getAlertingHealth_200_response_alerting_framework_health_execution_health
-
read_health (optional)
getAlertingHealth_200_response_alerting_framework_health_read_health
-
-
-
-

getAlertingHealth_200_response_alerting_framework_health_decryption_health - Up

-
The timestamp and status of the rule decryption.
-
-
status (optional)
String
-
Enum:
-
error
ok
warn
-
timestamp (optional)
Date format: date-time
-
-
-
-

getAlertingHealth_200_response_alerting_framework_health_execution_health - Up

-
The timestamp and status of the rule run.
-
-
status (optional)
String
-
Enum:
-
error
ok
warn
-
timestamp (optional)
Date format: date-time
-
-
-
-

getAlertingHealth_200_response_alerting_framework_health_read_health - Up

-
The timestamp and status of the rule reading events.
-
-
status (optional)
String
-
Enum:
-
error
ok
warn
-
timestamp (optional)
Date format: date-time
-
-
-
-

getRuleTypes_200_response_inner - Up

-
-
-
action_groups (optional)
array[getRuleTypes_200_response_inner_action_groups_inner] An explicit list of groups for which the rule type can schedule actions, each with the action group's unique ID and human readable name. Rule actions validation uses this configuration to ensure that groups are valid.
-
action_variables (optional)
getRuleTypes_200_response_inner_action_variables
-
authorized_consumers (optional)
getRuleTypes_200_response_inner_authorized_consumers
-
default_action_group_id (optional)
String The default identifier for the rule type group.
-
does_set_recovery_context (optional)
Boolean Indicates whether the rule passes context variables to its recovery action.
-
enabled_in_license (optional)
Boolean Indicates whether the rule type is enabled or disabled based on the subscription.
-
id (optional)
String The unique identifier for the rule type.
-
is_exportable (optional)
Boolean Indicates whether the rule type is exportable in Stack Management > Saved Objects.
-
minimum_license_required (optional)
String The subscriptions required to use the rule type.
-
name (optional)
String The descriptive name of the rule type.
-
producer (optional)
String An identifier for the application that produces this rule type.
-
recovery_action_group (optional)
getRuleTypes_200_response_inner_recovery_action_group
-
rule_task_timeout (optional)
String
-
-
-
-

getRuleTypes_200_response_inner_action_groups_inner - Up

-
-
-
id (optional)
String
-
name (optional)
String
-
-
-
-

getRuleTypes_200_response_inner_action_variables - Up

-
A list of action variables that the rule type makes available via context and state in action parameter templates, and a short human readable description. When you create a rule in Kibana, it uses this information to prompt you for these variables in action parameter editors.
-
-
context (optional)
array[getRuleTypes_200_response_inner_action_variables_context_inner]
-
params (optional)
array[getRuleTypes_200_response_inner_action_variables_params_inner]
-
state (optional)
array[getRuleTypes_200_response_inner_action_variables_params_inner]
-
-
-
-

getRuleTypes_200_response_inner_action_variables_context_inner - Up

-
-
-
name (optional)
String
-
description (optional)
String
-
useWithTripleBracesInTemplates (optional)
Boolean
-
-
-
-

getRuleTypes_200_response_inner_action_variables_params_inner - Up

-
-
-
description (optional)
String
-
name (optional)
String
-
-
-
-

getRuleTypes_200_response_inner_authorized_consumers - Up

-
The list of the plugins IDs that have access to the rule type.
-
-
alerts (optional)
getRuleTypes_200_response_inner_authorized_consumers_alerts
-
apm (optional)
getRuleTypes_200_response_inner_authorized_consumers_alerts
-
discover (optional)
getRuleTypes_200_response_inner_authorized_consumers_alerts
-
infrastructure (optional)
getRuleTypes_200_response_inner_authorized_consumers_alerts
-
logs (optional)
getRuleTypes_200_response_inner_authorized_consumers_alerts
-
ml (optional)
getRuleTypes_200_response_inner_authorized_consumers_alerts
-
monitoring (optional)
getRuleTypes_200_response_inner_authorized_consumers_alerts
-
siem (optional)
getRuleTypes_200_response_inner_authorized_consumers_alerts
-
stackAlerts (optional)
getRuleTypes_200_response_inner_authorized_consumers_alerts
-
uptime (optional)
getRuleTypes_200_response_inner_authorized_consumers_alerts
-
-
-
-

getRuleTypes_200_response_inner_authorized_consumers_alerts - Up

-
-
-
all (optional)
Boolean
-
read (optional)
Boolean
-
-
-
-

getRuleTypes_200_response_inner_recovery_action_group - Up

-
An action group to use when an alert goes from an active state to an inactive one.
-
-
id (optional)
String
-
name (optional)
String
-
-
-
-

legacyFindAlerts_200_response - Up

-
-
-
data (optional)
array[alert_response_properties]
-
page (optional)
Integer
-
perPage (optional)
Integer
-
total (optional)
Integer
-
-
-
-

legacyGetAlertTypes_200_response_inner - Up

-
-
-
actionGroups (optional)
array[getRuleTypes_200_response_inner_action_groups_inner] An explicit list of groups for which the alert type can schedule actions, each with the action group's unique ID and human readable name. Alert actions validation uses this configuration to ensure that groups are valid.
-
actionVariables (optional)
legacyGetAlertTypes_200_response_inner_actionVariables
-
authorizedConsumers (optional)
Object The list of the plugins IDs that have access to the alert type.
-
defaultActionGroupId (optional)
String The default identifier for the alert type group.
-
enabledInLicense (optional)
Boolean Indicates whether the rule type is enabled based on the subscription.
-
id (optional)
String The unique identifier for the alert type.
-
isExportable (optional)
Boolean Indicates whether the alert type is exportable in Saved Objects Management UI.
-
minimumLicenseRequired (optional)
String The subscriptions required to use the alert type.
-
name (optional)
String The descriptive name of the alert type.
-
producer (optional)
String An identifier for the application that produces this alert type.
-
recoveryActionGroup (optional)
legacyGetAlertTypes_200_response_inner_recoveryActionGroup
-
-
-
-

legacyGetAlertTypes_200_response_inner_actionVariables - Up

-
A list of action variables that the alert type makes available via context and state in action parameter templates, and a short human readable description. The Alert UI will use this information to prompt users for these variables in action parameter editors.
-
-
context (optional)
array[legacyGetAlertTypes_200_response_inner_actionVariables_context_inner]
-
params (optional)
array[getRuleTypes_200_response_inner_action_variables_params_inner]
-
state (optional)
array[getRuleTypes_200_response_inner_action_variables_params_inner]
-
-
-
-

legacyGetAlertTypes_200_response_inner_actionVariables_context_inner - Up

-
-
-
name (optional)
String
-
description (optional)
String
-
-
-
-

legacyGetAlertTypes_200_response_inner_recoveryActionGroup - Up

-
An action group to use when an alert instance goes from an active state to an inactive one. If it is not specified, the default recovered action group is used.
-
-
id (optional)
String
-
name (optional)
String
-
-
-
-

legacyGetAlertingHealth_200_response - Up

-
-
-
alertingFrameworkHealth (optional)
legacyGetAlertingHealth_200_response_alertingFrameworkHealth
-
hasPermanentEncryptionKey (optional)
Boolean If false, the encrypted saved object plugin does not have a permanent encryption key.
-
isSufficientlySecure (optional)
Boolean If false, security is enabled but TLS is not.
-
-
-
-

legacyGetAlertingHealth_200_response_alertingFrameworkHealth - Up

-
Three substates identify the health of the alerting framework: decryptionHealth, executionHealth, and readHealth.
-
-
decryptionHealth (optional)
legacyGetAlertingHealth_200_response_alertingFrameworkHealth_decryptionHealth
-
executionHealth (optional)
legacyGetAlertingHealth_200_response_alertingFrameworkHealth_executionHealth
-
readHealth (optional)
legacyGetAlertingHealth_200_response_alertingFrameworkHealth_readHealth
-
-
-
-

legacyGetAlertingHealth_200_response_alertingFrameworkHealth_decryptionHealth - Up

-
The timestamp and status of the alert decryption.
-
-
status (optional)
String
-
Enum:
-
error
ok
warn
-
timestamp (optional)
Date format: date-time
-
-
-
-

legacyGetAlertingHealth_200_response_alertingFrameworkHealth_executionHealth - Up

-
The timestamp and status of the alert execution.
-
-
status (optional)
String
-
Enum:
-
error
ok
warn
-
timestamp (optional)
Date format: date-time
-
-
-
-

legacyGetAlertingHealth_200_response_alertingFrameworkHealth_readHealth - Up

-
The timestamp and status of the alert reading events.
-
-
status (optional)
String
-
Enum:
-
error
ok
warn
-
timestamp (optional)
Date format: date-time
-
-
-
-

notify_when - Up

-
Indicates how often alerts generate actions. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: You cannot specify notify_when at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.
-
-
-
-
-

rule_response_properties - Rule response properties Up

-
-
-
actions
array[actions_inner]
-
api_key_created_by_user (optional)
Boolean Indicates whether the API key that is associated with the rule was created by the user.
-
api_key_owner
String The owner of the API key that is associated with the rule and used to run background tasks.
-
consumer
String The application or feature that owns the rule. For example, alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
-
created_at
Date The date and time that the rule was created. format: date-time
-
created_by
String The identifier for the user that created the rule.
-
enabled
Boolean Indicates whether the rule is currently enabled.
-
execution_status
rule_response_properties_execution_status
-
id
String The identifier for the rule.
-
last_run (optional)
rule_response_properties_last_run
-
muted_alert_ids
array[String]
-
mute_all
Boolean
-
name
String The name of the rule.
-
next_run (optional)
Date format: date-time
-
notify_when (optional)
String Indicates how often alerts generate actions.
-
params
map[String, oas_any_type_not_mapped] The parameters for the rule.
-
revision (optional)
Integer The rule revision number.
-
rule_type_id
String The identifier for the type of rule. For example, .es-query, .index-threshold, logs.alert.document.count, monitoring_alert_cluster_health, siem.thresholdRule, or xpack.ml.anomaly_detection_alert.
-
running (optional)
Boolean Indicates whether the rule is running.
-
schedule
schedule
-
scheduled_task_id (optional)
String
-
tags
array[String] The tags for the rule.
-
throttle
String The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if notify_when is set to onThrottleInterval. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.
-
updated_at
String The date and time that the rule was updated most recently.
-
updated_by
String The identifier for the user that updated this rule most recently.
-
-
-
-

rule_response_properties_execution_status - Up

-
-
-
last_duration (optional)
Integer
-
last_execution_date (optional)
Date format: date-time
-
status (optional)
String
-
-
-
-

rule_response_properties_last_run - Up

-
-
-
alerts_count (optional)
rule_response_properties_last_run_alerts_count
-
outcome (optional)
String
-
outcome_msg (optional)
array[String]
-
outcome_order (optional)
Integer
-
warning (optional)
String
-
-
-
-

rule_response_properties_last_run_alerts_count - Up

-
-
-
active (optional)
Integer
-
ignored (optional)
Integer
-
new (optional)
Integer
-
recovered (optional)
Integer
-
-
-
-

schedule - Up

-
The check interval, which specifies how frequently the rule conditions are checked. The interval is specified in seconds, minutes, hours, or days.
-
-
interval (optional)
String
-
-
-
-

update_rule_request - Update rule request Up

-
The update rule API request body varies depending on the type of rule and actions.
-
-
actions (optional)
array[actions_inner]
-
name
String The name of the rule.
-
notify_when (optional)
notify_when
-
params
map[String, oas_any_type_not_mapped] The parameters for the rule.
-
schedule
schedule
-
tags (optional)
array[String] The tags for the rule.
-
throttle (optional)
String The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if notify_when is set to onThrottleInterval. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.
-
-
-
-++++ diff --git a/docs/api-generated/rules/rule-apis.asciidoc b/docs/api-generated/rules/rule-apis.asciidoc deleted file mode 100644 index fb963582fb6da..0000000000000 --- a/docs/api-generated/rules/rule-apis.asciidoc +++ /dev/null @@ -1,10 +0,0 @@ -[[rule-apis]] -== Alert and rule APIs - -preview::[] - -//// -This file includes content that has been generated from https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/docs/openapi. Any modifications required must be done in that open API specification. -//// - -include::rule-apis-passthru.asciidoc[] \ No newline at end of file diff --git a/docs/api-generated/template/index.mustache b/docs/api-generated/template/index.mustache deleted file mode 100644 index 8c1162f909508..0000000000000 --- a/docs/api-generated/template/index.mustache +++ /dev/null @@ -1,170 +0,0 @@ -//// -This content is generated from the open API specification. -Any modifications made to this file will be overwritten. -//// - -++++ -
-

Access

- {{#hasAuthMethods}} -
    - {{#authMethods}} -
  1. {{#isBasic}}HTTP Basic Authentication{{/isBasic}}{{#isOAuth}}OAuth AuthorizationUrl:{{authorizationUrl}}TokenUrl:{{tokenUrl}}{{/isOAuth}}{{#isApiKey}}APIKey KeyParamName:{{keyParamName}} KeyInQuery:{{isKeyInQuery}} KeyInHeader:{{isKeyInHeader}}{{/isApiKey}}
    2. - {{/authMethods}} -
- {{/hasAuthMethods}} - -

Methods

- [ Jump to Models ] - - {{! for the tables of content, I cheat and don't use CSS styles.... }} -

Table of Contents

-
{{access}}
- {{#apiInfo}} - {{#apis}} - {{#operations}} -

{{baseName}}

- - {{/operations}} - {{/apis}} - {{/apiInfo}} - - {{#apiInfo}} - {{#apis}} - {{#operations}} -

{{baseName}}

- {{#operation}} -
-
- Up - 
{{httpMethod}} {{path}}
-
{{summary}} ({{nickname}})
- {{! notes is operation.description. So why rename it and make it super confusing???? }} -
{{notes}}
- - {{#hasPathParams}} -

Path parameters

-
- {{#pathParams}}{{>pathParam}}{{/pathParams}} -
- {{/hasPathParams}} - - {{#hasConsumes}} -

Consumes

- This API call consumes the following media types via the Content-Type request header: -
    - {{#consumes}} -
  • {{{mediaType}}}
    • - {{/consumes}} -
- {{/hasConsumes}} - - {{#hasBodyParam}} -

Request body

-
- {{#bodyParams}}{{>bodyParam}}{{/bodyParams}} -
- {{/hasBodyParam}} - - {{#hasHeaderParams}} -

Request headers

-
- {{#headerParams}}{{>headerParam}}{{/headerParams}} -
- {{/hasHeaderParams}} - - {{#hasQueryParams}} -

Query parameters

-
- {{#queryParams}}{{>queryParam}}{{/queryParams}} -
- {{/hasQueryParams}} - - {{#hasFormParams}} -

Form parameters

-
- {{#formParams}}{{>formParam}}{{/formParams}} -
- {{/hasFormParams}} - - {{#returnType}} -

Return type

-
- {{#hasReference}}{{^returnSimpleType}}{{returnContainer}}[{{/returnSimpleType}}{{returnBaseType}}{{^returnSimpleType}}]{{/returnSimpleType}}{{/hasReference}} - {{^hasReference}}{{returnType}}{{/hasReference}} -
- {{/returnType}} - - - - {{#hasExamples}} - {{#examples}} -

Example data

-
Content-Type: {{{contentType}}}
- 
{{{example}}}
- {{/examples}} - {{/hasExamples}} - - {{#hasProduces}} -

Produces

- This API call produces the following media types according to the Accept request header; - the media type will be conveyed by the Content-Type response header. -
    - {{#produces}} -
  • {{{mediaType}}}
    • - {{/produces}} -
- {{/hasProduces}} - -

Responses

- {{#responses}} -

{{code}}

- {{message}} - {{^containerType}}{{dataType}}{{/containerType}} - {{#examples}} -

Example data

-
Content-Type: {{{contentType}}}
- 
{{example}}
- {{/examples}} - {{/responses}} -
-
- {{/operation}} - {{/operations}} - {{/apis}} - {{/apiInfo}} - -

Models

- [ Jump to Methods ] - -

Table of Contents

-
    - {{#models}} - {{#model}} -
  1. {{name}}{{#title}} - {{.}}{{/title}}
    2. - {{/model}} - {{/models}} -
- - {{#models}} - {{#model}} -
-

{{name}}{{#title}} - {{.}}{{/title}} Up

- {{#unescapedDescription}}
{{.}}
{{/unescapedDescription}} -
- {{#vars}}
{{name}} {{^required}}(optional){{/required}}
{{^isPrimitiveType}}{{dataType}}{{/isPrimitiveType}} {{unescapedDescription}} {{#dataFormat}}format: {{{.}}}{{/dataFormat}}
- {{#isEnum}} -
Enum:
- {{#_enum}}
{{this}}
{{/_enum}} - {{/isEnum}} - {{/vars}} -
-
- {{/model}} - {{/models}} -
-++++ diff --git a/docs/api/actions-and-connectors/create.asciidoc b/docs/api/actions-and-connectors/create.asciidoc index 259c5dfee00af..55168ecf796ca 100644 --- a/docs/api/actions-and-connectors/create.asciidoc +++ b/docs/api/actions-and-connectors/create.asciidoc @@ -9,7 +9,7 @@ Creates a connector. [NOTE] ==== For the most up-to-date API details, refer to the -{kib-repo}/tree/{branch}/x-pack/plugins/actions/docs/openapi[open API specification]. For a preview, check out <>. +{kib-repo}/tree/{branch}/x-pack/plugins/actions/docs/openapi[open API specification]. ==== [[create-connector-api-request]] diff --git a/docs/api/actions-and-connectors/delete.asciidoc b/docs/api/actions-and-connectors/delete.asciidoc index d908f276b7461..81619cdf26b5c 100644 --- a/docs/api/actions-and-connectors/delete.asciidoc +++ b/docs/api/actions-and-connectors/delete.asciidoc @@ -11,7 +11,7 @@ WARNING: When you delete a connector, _it cannot be recovered_. [NOTE] ==== For the most up-to-date API details, refer to the -{kib-repo}/tree/{branch}/x-pack/plugins/actions/docs/openapi[open API specification]. For a preview, check out <>. +{kib-repo}/tree/{branch}/x-pack/plugins/actions/docs/openapi[open API specification]. ==== [discrete] diff --git a/docs/api/actions-and-connectors/execute.asciidoc b/docs/api/actions-and-connectors/execute.asciidoc index 6d94c61f6232b..1f241202b4adc 100644 --- a/docs/api/actions-and-connectors/execute.asciidoc +++ b/docs/api/actions-and-connectors/execute.asciidoc @@ -9,7 +9,7 @@ Runs a connector by ID. [NOTE] ==== For the most up-to-date API details, refer to the -{kib-repo}/tree/{branch}/x-pack/plugins/actions/docs/openapi[open API specification]. For a preview, check out <>. +{kib-repo}/tree/{branch}/x-pack/plugins/actions/docs/openapi[open API specification]. ==== [[execute-connector-api-request]] diff --git a/docs/api/actions-and-connectors/get.asciidoc b/docs/api/actions-and-connectors/get.asciidoc index a43787dc2a33e..92414babd1638 100644 --- a/docs/api/actions-and-connectors/get.asciidoc +++ b/docs/api/actions-and-connectors/get.asciidoc @@ -9,7 +9,7 @@ Retrieves a connector by ID. [NOTE] ==== For the most up-to-date API details, refer to the -{kib-repo}/tree/{branch}/x-pack/plugins/actions/docs/openapi[open API specification]. For a preview, check out <>. +{kib-repo}/tree/{branch}/x-pack/plugins/actions/docs/openapi[open API specification]. ==== [discrete] diff --git a/docs/api/actions-and-connectors/get_all.asciidoc b/docs/api/actions-and-connectors/get_all.asciidoc index 2b5fbe20bf56e..ba2cab86b654f 100644 --- a/docs/api/actions-and-connectors/get_all.asciidoc +++ b/docs/api/actions-and-connectors/get_all.asciidoc @@ -9,7 +9,7 @@ Retrieves all connectors. [NOTE] ==== For the most up-to-date API details, refer to the -{kib-repo}/tree/{branch}/x-pack/plugins/actions/docs/openapi[open API specification]. For a preview, check out <>. +{kib-repo}/tree/{branch}/x-pack/plugins/actions/docs/openapi[open API specification]. ==== [discrete] diff --git a/docs/api/actions-and-connectors/list.asciidoc b/docs/api/actions-and-connectors/list.asciidoc index d7658cdd11da4..e978f75d36c1f 100644 --- a/docs/api/actions-and-connectors/list.asciidoc +++ b/docs/api/actions-and-connectors/list.asciidoc @@ -9,7 +9,7 @@ Retrieves a list of all connector types. [NOTE] ==== For the most up-to-date API details, refer to the -{kib-repo}/tree/{branch}/x-pack/plugins/actions/docs/openapi[open API specification]. For a preview, check out <>. +{kib-repo}/tree/{branch}/x-pack/plugins/actions/docs/openapi[open API specification]. ==== [[list-connector-types-api-request]] diff --git a/docs/api/actions-and-connectors/update.asciidoc b/docs/api/actions-and-connectors/update.asciidoc index b690d3fac995b..7fe3d85ad0ca7 100644 --- a/docs/api/actions-and-connectors/update.asciidoc +++ b/docs/api/actions-and-connectors/update.asciidoc @@ -9,7 +9,7 @@ Updates the attributes for a connector. [NOTE] ==== For the most up-to-date API details, refer to the -{kib-repo}/tree/{branch}/x-pack/plugins/actions/docs/openapi[open API specification]. For a preview, check out <>. +{kib-repo}/tree/{branch}/x-pack/plugins/actions/docs/openapi[open API specification]. ==== [[update-connector-api-request]] diff --git a/docs/api/alerting/create_rule.asciidoc b/docs/api/alerting/create_rule.asciidoc index 2bce4a1c49193..faac08b2b613e 100644 --- a/docs/api/alerting/create_rule.asciidoc +++ b/docs/api/alerting/create_rule.asciidoc @@ -9,7 +9,7 @@ Create {kib} rules. [NOTE] ==== For the most up-to-date API details, refer to the -{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[open API specification]. For a preview, check out <>. +{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[open API specification]. ==== [[create-rule-api-request]] diff --git a/docs/api/alerting/delete_rule.asciidoc b/docs/api/alerting/delete_rule.asciidoc index 143507fa20600..220b4dfa9ece4 100644 --- a/docs/api/alerting/delete_rule.asciidoc +++ b/docs/api/alerting/delete_rule.asciidoc @@ -11,7 +11,7 @@ WARNING: After you delete a rule, you cannot recover it. [NOTE] ==== For the most up-to-date API details, refer to the -{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[open API specification]. For a preview, check out <>. +{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[open API specification]. ==== [[delete-rule-api-request]] diff --git a/docs/api/alerting/disable_rule.asciidoc b/docs/api/alerting/disable_rule.asciidoc index d1c41eed9eaf1..8f370072a689c 100644 --- a/docs/api/alerting/disable_rule.asciidoc +++ b/docs/api/alerting/disable_rule.asciidoc @@ -9,7 +9,7 @@ Disable a rule. [NOTE] ==== For the most up-to-date API details, refer to the -{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[open API specification]. For a preview, check out <>. +{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[open API specification]. ==== [[disable-rule-api-request]] diff --git a/docs/api/alerting/enable_rule.asciidoc b/docs/api/alerting/enable_rule.asciidoc index b87c0b9228b1b..f51f6c9295332 100644 --- a/docs/api/alerting/enable_rule.asciidoc +++ b/docs/api/alerting/enable_rule.asciidoc @@ -11,7 +11,7 @@ WARNING: This API supports <> only. [NOTE] ==== For the most up-to-date API details, refer to the -{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[open API specification]. For a preview, check out <>. +{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[open API specification]. ==== [[enable-rule-api-request]] diff --git a/docs/api/alerting/find_rules.asciidoc b/docs/api/alerting/find_rules.asciidoc index 0879cc77770aa..a9a9ee225db7e 100644 --- a/docs/api/alerting/find_rules.asciidoc +++ b/docs/api/alerting/find_rules.asciidoc @@ -9,7 +9,7 @@ Retrieve a paginated set of rules based on condition. [NOTE] ==== For the most up-to-date API details, refer to the -{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[open API specification]. For a preview, check out <>. +{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[open API specification]. ==== [[find-rules-api-request]] diff --git a/docs/api/alerting/get_rules.asciidoc b/docs/api/alerting/get_rules.asciidoc index 60c879116948a..ff60d5bad52d1 100644 --- a/docs/api/alerting/get_rules.asciidoc +++ b/docs/api/alerting/get_rules.asciidoc @@ -9,7 +9,7 @@ Retrieve a rule by ID. [NOTE] ==== For the most up-to-date API details, refer to the -{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[open API specification]. For a preview, check out <>. +{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[open API specification]. ==== [[get-rule-api-request]] diff --git a/docs/api/alerting/health.asciidoc b/docs/api/alerting/health.asciidoc index 2a37abc864878..cd9d1c9449a82 100644 --- a/docs/api/alerting/health.asciidoc +++ b/docs/api/alerting/health.asciidoc @@ -9,7 +9,7 @@ Retrieve the health status of the alerting framework. [NOTE] ==== For the most up-to-date API details, refer to the -{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[open API specification]. For a preview, check out <>. +{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[open API specification]. ==== [[get-alerting-framework-health-api-request]] diff --git a/docs/api/alerting/list_rule_types.asciidoc b/docs/api/alerting/list_rule_types.asciidoc index 32b4be086705a..7640d50b3ccd0 100644 --- a/docs/api/alerting/list_rule_types.asciidoc +++ b/docs/api/alerting/list_rule_types.asciidoc @@ -9,7 +9,7 @@ Retrieve a list of rule types that the user is authorized to access. [NOTE] ==== For the most up-to-date API details, refer to the -{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[open API specification]. For a preview, check out <>. +{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[open API specification]. ==== diff --git a/docs/api/alerting/mute_alert.asciidoc b/docs/api/alerting/mute_alert.asciidoc index 3ac99f0d3dda0..ad6d87848dfee 100644 --- a/docs/api/alerting/mute_alert.asciidoc +++ b/docs/api/alerting/mute_alert.asciidoc @@ -9,7 +9,7 @@ Mute an alert. [NOTE] ==== For the most up-to-date API details, refer to the -{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[open API specification]. For a preview, check out <>. +{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[open API specification]. ==== [[mute-alert-api-request]] diff --git a/docs/api/alerting/mute_all_alerts.asciidoc b/docs/api/alerting/mute_all_alerts.asciidoc index a3c1fc0084245..b33d337d473ca 100644 --- a/docs/api/alerting/mute_all_alerts.asciidoc +++ b/docs/api/alerting/mute_all_alerts.asciidoc @@ -9,7 +9,7 @@ Mute all alerts. [NOTE] ==== For the most up-to-date API details, refer to the -{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[open API specification]. For a preview, check out <>. +{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[open API specification]. ==== [[mute-all-alerts-api-request]] diff --git a/docs/api/alerting/unmute_alert.asciidoc b/docs/api/alerting/unmute_alert.asciidoc index 8efa95a16edd7..81bb641b259f9 100644 --- a/docs/api/alerting/unmute_alert.asciidoc +++ b/docs/api/alerting/unmute_alert.asciidoc @@ -9,7 +9,7 @@ Unmute an alert. [NOTE] ==== For the most up-to-date API details, refer to the -{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[open API specification]. For a preview, check out <>. +{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[open API specification]. ==== [[unmute-alert-api-request]] diff --git a/docs/api/alerting/unmute_all_alerts.asciidoc b/docs/api/alerting/unmute_all_alerts.asciidoc index a4e2a91847397..0594727c71268 100644 --- a/docs/api/alerting/unmute_all_alerts.asciidoc +++ b/docs/api/alerting/unmute_all_alerts.asciidoc @@ -9,7 +9,7 @@ Unmute all alerts. [NOTE] ==== For the most up-to-date API details, refer to the -{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[open API specification]. For a preview, check out <>. +{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[open API specification]. ==== [[unmute-all-alerts-api-all-request]] diff --git a/docs/api/alerting/update_rule.asciidoc b/docs/api/alerting/update_rule.asciidoc index 11ca1dc35fc85..124adc79582fe 100644 --- a/docs/api/alerting/update_rule.asciidoc +++ b/docs/api/alerting/update_rule.asciidoc @@ -9,7 +9,7 @@ Update the attributes for an existing rule. [NOTE] ==== For the most up-to-date API details, refer to the -{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[open API specification]. For a preview, check out <>. +{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[open API specification]. ==== [[update-rule-api-request]] diff --git a/docs/api/cases/cases-api-add-comment.asciidoc b/docs/api/cases/cases-api-add-comment.asciidoc index 48c3ffb5845b8..28b8959d5a017 100644 --- a/docs/api/cases/cases-api-add-comment.asciidoc +++ b/docs/api/cases/cases-api-add-comment.asciidoc @@ -9,7 +9,7 @@ Adds a comment or alert to a case. [NOTE] ==== For the most up-to-date API details, refer to the -{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. For a preview, check out <>. +{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. ==== === {api-request-title} diff --git a/docs/api/cases/cases-api-create.asciidoc b/docs/api/cases/cases-api-create.asciidoc index f124d3500228c..2145acd360532 100644 --- a/docs/api/cases/cases-api-create.asciidoc +++ b/docs/api/cases/cases-api-create.asciidoc @@ -9,7 +9,7 @@ Creates a case. [NOTE] ==== For the most up-to-date API details, refer to the -{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. For a preview, check out <>. +{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. ==== === {api-request-title} diff --git a/docs/api/cases/cases-api-delete-cases.asciidoc b/docs/api/cases/cases-api-delete-cases.asciidoc index 013dc9567db2e..abf518d212095 100644 --- a/docs/api/cases/cases-api-delete-cases.asciidoc +++ b/docs/api/cases/cases-api-delete-cases.asciidoc @@ -9,7 +9,7 @@ Deletes one or more cases. [NOTE] ==== For the most up-to-date API details, refer to the -{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. For a preview, check out <>. +{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. ==== === {api-request-title} diff --git a/docs/api/cases/cases-api-delete-comments.asciidoc b/docs/api/cases/cases-api-delete-comments.asciidoc index 130158bd021c2..dc8fe0e120574 100644 --- a/docs/api/cases/cases-api-delete-comments.asciidoc +++ b/docs/api/cases/cases-api-delete-comments.asciidoc @@ -9,7 +9,7 @@ Deletes one or all comments and alerts from a case. [NOTE] ==== For the most up-to-date API details, refer to the -{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. For a preview, check out <>. +{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. ==== === {api-request-title} diff --git a/docs/api/cases/cases-api-find-case-activity.asciidoc b/docs/api/cases/cases-api-find-case-activity.asciidoc index e59540c654e28..d15e2a8bea9d5 100644 --- a/docs/api/cases/cases-api-find-case-activity.asciidoc +++ b/docs/api/cases/cases-api-find-case-activity.asciidoc @@ -9,7 +9,7 @@ Finds user activity for a case. [NOTE] ==== For the most up-to-date API details, refer to the -{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. For a preview, check out <>. +{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. ==== === {api-request-title} diff --git a/docs/api/cases/cases-api-find-cases.asciidoc b/docs/api/cases/cases-api-find-cases.asciidoc index 4f80086e8f8c4..f042bcfa605e3 100644 --- a/docs/api/cases/cases-api-find-cases.asciidoc +++ b/docs/api/cases/cases-api-find-cases.asciidoc @@ -9,7 +9,7 @@ Retrieves a paginated subset of cases. [NOTE] ==== For the most up-to-date API details, refer to the -{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. For a preview, check out <>. +{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. ==== === {api-request-title} diff --git a/docs/api/cases/cases-api-find-connectors.asciidoc b/docs/api/cases/cases-api-find-connectors.asciidoc index 6968bc55d88bb..974e3e9a2211b 100644 --- a/docs/api/cases/cases-api-find-connectors.asciidoc +++ b/docs/api/cases/cases-api-find-connectors.asciidoc @@ -13,7 +13,7 @@ returned. Refer to the list of supported external incident management systems in [NOTE] ==== For the most up-to-date API details, refer to the -{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. For a preview, check out <>. +{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. ==== === {api-request-title} diff --git a/docs/api/cases/cases-api-get-alerts.asciidoc b/docs/api/cases/cases-api-get-alerts.asciidoc index 1b9c1da1bd926..fea5b5f9a7354 100644 --- a/docs/api/cases/cases-api-get-alerts.asciidoc +++ b/docs/api/cases/cases-api-get-alerts.asciidoc @@ -11,7 +11,7 @@ Gets all alerts attached to a case. [NOTE] ==== For the most up-to-date API details, refer to the -{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. For a preview, check out <>. +{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. ==== === {api-request-title} diff --git a/docs/api/cases/cases-api-get-case-activity.asciidoc b/docs/api/cases/cases-api-get-case-activity.asciidoc index db5835709a6ab..2baa19ebf6985 100644 --- a/docs/api/cases/cases-api-get-case-activity.asciidoc +++ b/docs/api/cases/cases-api-get-case-activity.asciidoc @@ -11,7 +11,7 @@ deprecated::[8.1.0,Use <> instead.] [NOTE] ==== For the most up-to-date API details, refer to the -{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. For a preview, check out <>. +{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. ==== === {api-request-title} diff --git a/docs/api/cases/cases-api-get-case.asciidoc b/docs/api/cases/cases-api-get-case.asciidoc index b5942f0424408..fe2b4c54b85e5 100644 --- a/docs/api/cases/cases-api-get-case.asciidoc +++ b/docs/api/cases/cases-api-get-case.asciidoc @@ -9,7 +9,7 @@ Returns information about a case. [NOTE] ==== For the most up-to-date API details, refer to the -{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. For a preview, check out <>. +{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. ==== === {api-request-title} diff --git a/docs/api/cases/cases-api-get-cases-by-alert.asciidoc b/docs/api/cases/cases-api-get-cases-by-alert.asciidoc index 14b45f9b4b0e7..47a0c5973830a 100644 --- a/docs/api/cases/cases-api-get-cases-by-alert.asciidoc +++ b/docs/api/cases/cases-api-get-cases-by-alert.asciidoc @@ -11,7 +11,7 @@ Returns the cases associated with a specific alert. [NOTE] ==== For the most up-to-date API details, refer to the -{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. For a preview, check out <>. +{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. ==== diff --git a/docs/api/cases/cases-api-get-comments.asciidoc b/docs/api/cases/cases-api-get-comments.asciidoc index 5f7bb938f588a..fb0e497f4ebf1 100644 --- a/docs/api/cases/cases-api-get-comments.asciidoc +++ b/docs/api/cases/cases-api-get-comments.asciidoc @@ -9,7 +9,7 @@ Gets a comment or all comments for a case. [NOTE] ==== For the most up-to-date API details, refer to the -{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. For a preview, check out <>. +{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. ==== === {api-request-title} diff --git a/docs/api/cases/cases-api-get-configuration.asciidoc b/docs/api/cases/cases-api-get-configuration.asciidoc index fec5eb8bdedd6..e78eaa634f716 100644 --- a/docs/api/cases/cases-api-get-configuration.asciidoc +++ b/docs/api/cases/cases-api-get-configuration.asciidoc @@ -10,7 +10,7 @@ default connector for cases. [NOTE] ==== For the most up-to-date API details, refer to the -{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. For a preview, check out <>. +{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. ==== === {api-request-title} diff --git a/docs/api/cases/cases-api-get-reporters.asciidoc b/docs/api/cases/cases-api-get-reporters.asciidoc index 9792bc77ae517..48f373c65986a 100644 --- a/docs/api/cases/cases-api-get-reporters.asciidoc +++ b/docs/api/cases/cases-api-get-reporters.asciidoc @@ -9,7 +9,7 @@ Returns information about the users who opened cases. [NOTE] ==== For the most up-to-date API details, refer to the -{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. For a preview, check out <>. +{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. ==== diff --git a/docs/api/cases/cases-api-get-status.asciidoc b/docs/api/cases/cases-api-get-status.asciidoc index a6d64bc4e9585..ce9205febae5a 100644 --- a/docs/api/cases/cases-api-get-status.asciidoc +++ b/docs/api/cases/cases-api-get-status.asciidoc @@ -9,7 +9,7 @@ Returns the number of cases that are open, closed, and in progress. [NOTE] ==== For the most up-to-date API details, refer to the -{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. For a preview, check out <>. +{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. ==== deprecated::[8.1.0] diff --git a/docs/api/cases/cases-api-get-tags.asciidoc b/docs/api/cases/cases-api-get-tags.asciidoc index e22a2f08cfda5..993c7d88f538a 100644 --- a/docs/api/cases/cases-api-get-tags.asciidoc +++ b/docs/api/cases/cases-api-get-tags.asciidoc @@ -9,7 +9,7 @@ Aggregates and returns a list of case tags. [NOTE] ==== For the most up-to-date API details, refer to the -{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. For a preview, check out <>. +{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. ==== === {api-request-title} diff --git a/docs/api/cases/cases-api-push.asciidoc b/docs/api/cases/cases-api-push.asciidoc index 5f7a0c268ff1c..e3bf2464d19b7 100644 --- a/docs/api/cases/cases-api-push.asciidoc +++ b/docs/api/cases/cases-api-push.asciidoc @@ -9,7 +9,7 @@ Pushes a case to an external service. [NOTE] ==== For the most up-to-date API details, refer to the -{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. For a preview, check out <>. +{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. ==== === {api-request-title} diff --git a/docs/api/cases/cases-api-set-configuration.asciidoc b/docs/api/cases/cases-api-set-configuration.asciidoc index a32cc555ed052..6d7e9320672e6 100644 --- a/docs/api/cases/cases-api-set-configuration.asciidoc +++ b/docs/api/cases/cases-api-set-configuration.asciidoc @@ -10,7 +10,7 @@ default connector for cases. [NOTE] ==== For the most up-to-date API details, refer to the -{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. For a preview, check out <>. +{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. ==== === {api-request-title} diff --git a/docs/api/cases/cases-api-update-comment.asciidoc b/docs/api/cases/cases-api-update-comment.asciidoc index 13adb2218029e..fc8d97e779fd0 100644 --- a/docs/api/cases/cases-api-update-comment.asciidoc +++ b/docs/api/cases/cases-api-update-comment.asciidoc @@ -9,7 +9,7 @@ Updates a comment or alert in a case. [NOTE] ==== For the most up-to-date API details, refer to the -{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. For a preview, check out <>. +{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. ==== === {api-request-title} diff --git a/docs/api/cases/cases-api-update-configuration.asciidoc b/docs/api/cases/cases-api-update-configuration.asciidoc index dcfe01ef84179..b30a8f0bb79b2 100644 --- a/docs/api/cases/cases-api-update-configuration.asciidoc +++ b/docs/api/cases/cases-api-update-configuration.asciidoc @@ -10,7 +10,7 @@ connector for cases. [NOTE] ==== For the most up-to-date API details, refer to the -{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. For a preview, check out <>. +{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. ==== === {api-request-title} diff --git a/docs/api/cases/cases-api-update.asciidoc b/docs/api/cases/cases-api-update.asciidoc index ca75e34597afc..46c5ac7763600 100644 --- a/docs/api/cases/cases-api-update.asciidoc +++ b/docs/api/cases/cases-api-update.asciidoc @@ -9,7 +9,7 @@ Updates one or more cases. [NOTE] ==== For the most up-to-date API details, refer to the -{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. For a preview, check out <>. +{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. ==== === {api-request-title} diff --git a/docs/api/machine-learning/sync.asciidoc b/docs/api/machine-learning/sync.asciidoc index af4f797ade1f2..bd65ce56dd5d1 100644 --- a/docs/api/machine-learning/sync.asciidoc +++ b/docs/api/machine-learning/sync.asciidoc @@ -9,7 +9,7 @@ Synchronizes {kib} saved objects for {ml} jobs and trained models. [NOTE] ==== For the most up-to-date API details, refer to the -{kib-repo}/tree/{branch}/x-pack/plugins/ml/common/openapi[open API specification]. For a preview, check out <>. +{kib-repo}/tree/{branch}/x-pack/plugins/ml/common/openapi[open API specification]. ==== [[machine-learning-api-sync-request]] diff --git a/docs/apis.asciidoc b/docs/apis.asciidoc deleted file mode 100644 index d85d9ce3f35eb..0000000000000 --- a/docs/apis.asciidoc +++ /dev/null @@ -1,17 +0,0 @@ -[role="exclude",id="apis"] -= APIs - -[partintro] --- - -preview::[] - -These APIs are documented using the OpenAPI specification. The current supported -version of the specification is 3.0. For more information, go to https://openapi-generator.tech/[OpenAPI Generator] - --- - -include::api-generated/cases/case-apis.asciidoc[] -include::api-generated/connectors/connector-apis.asciidoc[] -include::api-generated/machine-learning/ml-apis.asciidoc[] -include::api-generated/rules/rule-apis.asciidoc[] \ No newline at end of file diff --git a/docs/index.asciidoc b/docs/index.asciidoc index d72b97a76af2a..ac9f1f6a28e5d 100644 --- a/docs/index.asciidoc +++ b/docs/index.asciidoc @@ -17,7 +17,5 @@ include::CHANGELOG.asciidoc[] include::developer/index.asciidoc[] -include::apis.asciidoc[] - include::redirects.asciidoc[] diff --git a/docs/redirects.asciidoc b/docs/redirects.asciidoc index cbd77c47c15e3..2788df203c2a3 100644 --- a/docs/redirects.asciidoc +++ b/docs/redirects.asciidoc @@ -413,3 +413,9 @@ This page has been deleted. Refer to <>. == Alerts and Actions This page has been deleted. Refer to <>. + +[role="exclude",id="apis"] +== APIs + +For the most up-to-date API details, refer to the +{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[alerting], {kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[cases], {kib-repo}/tree/{branch}/x-pack/plugins/actions/docs/openapi[connectors], and {kib-repo}/tree/{branch}/x-pack/plugins/ml/common/openapi[machine learning] open API specifications.