Update a case template

Base URL
https://{kibana_url}
Auth

Fully replaces a case template. Every accepted update creates a new template version; previous versions stay retrievable with the version query parameter of the get template API, and cases keep the version they were created with. You must have the "Manage templates" sub-privilege for the Cases feature of the owning solution. Set dry_run=true to run the full validation without writing. Requires the Cases feature to be enabled in the space.

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

template_id string · max length: 36 required

The identifier for the template.

Example: 9da1ea2a-09f8-4d0e-bf9d-09bf8c9d0f42

Query parameters

dry_run boolean · default: false

When true, validates the request without updating the template and returns {"valid": true}.

Request body

definition string · max length: 30000 required

The template definition as a YAML string: case defaults (name, severity, category, tags, assignees, connector, settings) and a fields array of inline field definitions or $ref entries pointing into the owner's field library. Stored field values appear on cases under extended_fields keys shaped <field_name>_as_<storage_type>. Observable extraction (settings.extractObservables) is available only for Security templates. For Stack and Observability templates, setting it to true returns a 400 error. An update that keeps an already stored true for the same owner is accepted.

description string · max length: 1000

A description of the template.

isEnabled boolean · default: true

Disabled templates are hidden from the case creation flow.

name string · min length: 1 · max length: 50

The template identity name, unique per owner (case-insensitive). May be omitted when the YAML definition provides a case-default title (name:), which is then used as the identity name.

owner enum required

The application that owns the cases: Stack Management, Observability, or Elastic Security.

Values: cases observability securitySolution
tags string[] · max items: 200

The words and phrases that help categorize templates. It can be an empty array.

Responses

Indicates a successful call. Returns the new template version, or {"valid": true} for a dry run.

application/json
One of:

A case template (v2).

author string · max length: 1000

The username of the template author.

definition object required

The parsed template definition.

definitionString string · max length: 30000 required

The raw YAML definition string.

deletedAt string · format: date-time required nullable

The date the template was soft-deleted, or null if active.

description string · max length: 30000

A human-readable description of the template.

fieldCount integer

The number of fields defined in the template.

isDefault boolean

Whether this is the default template for its owner.

isEnabled boolean

Whether the template is enabled.

isLatest boolean required

Whether this is the latest version of the template.

lastUsedAt string · format: date-time

The date the template was last used to create a case.

latestVersion integer required

The latest version number of this template.

name string · max length: 100 required

The display name of the template.

owner string · max length: 50 required

The owning solution (e.g. cases, observability, securitySolution).

tags string[] · max items: 200

The words and phrases that help categorize templates. It can be an empty array.

templateId string · max length: 36 required

The unique identifier of the template, shared across all versions.

templateVersion integer required

The version number of this template revision.

usageCount integer

The number of times this template has been used to create a case.

Base URL
https://{kibana_url}