Get case

edit

Returns the specified case.

The Kibana Console supports only Elasticsearch APIs. You cannot interact with the Kibana APIs with the Console and must use curl or another HTTP tool instead. For more information, refer to Console.

Request URL

edit

GET <kibana host>:<port>/api/cases/<case ID>

URL parts

edit

The URL must include the case ID of the case you are retrieving. Call Find cases to retrieve case IDs.

URL query parameters

edit
Name Type Description Required

includeComments

Boolean

Determines whether case comments are returned.

No, defaults to true.

Example request

edit

Returns case ID a18b38a0-71b0-11ea-a0b2-c51ea50a58e2 without comments:

GET api/cases/a18b38a0-71b0-11ea-a0b2-c51ea50a58e2?includeComments=false

Response code

edit
200
Indicates a successful call.

Response payload

edit

The requested case JSON object.

Response example

edit
{
  "id": "a18b38a0-71b0-11ea-a0b2-c51ea50a58e2",
  "version": "Wzk4LDFd",
  "comments": [],
  "totalComment": 0,
  "closed_at": null,
  "closed_by": null,
  "created_at": "2020-03-29T11:30:02.658Z",
  "created_by": {
    "email": "ahunley@imf.usa.gov",
    "full_name": "Alan Hunley",
    "username": "ahunley"
  },
  "external_service": null,
  "updated_at": "2020-03-29T12:01:50.244Z",
  "updated_by": {
    "full_name": "Classified",
    "email": "classified@hms.oo.gov.uk",
    "username": "M"
  },
  "description": "James Bond clicked on a highly suspicious email banner advertising cheap holidays for underpaid civil servants. Operation bubblegum is active. Repeat - operation bubblegum is now active!",
  "title": "This case will self-destruct in 5 seconds",
  "status": "open",
  "connector": {
    "id": "131d4448-abe0-4789-939d-8ef60680b498",
    "name": "My connector",
    "type": ".jira",
    "fields": {
      "issueType": "10006",
      "priority": "High",
    }
  },
  "settings": {
    "syncAlerts": true
  },
  "tags": [
    "phishing",
    "social engineering",
    "bubblegum"
  ]
}