[Cases] Update cases api docs by christineweng · Pull Request #256805 · elastic/kibana

christineweng · 2026-03-09T22:25:13Z

Summary

Updated cases API docs to address:

Removed alert reference in find comment api. Related: [Cases] Restrict the Find Comment API query params #156863
- Updated response schema and examples - existing response uses full case response, which is not correct
Removed includeComment param in get case api. it is always false for public api but the response example contains comments, related: [Response Ops][Cases] Remove includeComments query param #207739
Included extractObservables to case request and response
Fixed typos

Checklist

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios
If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the docker list
This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The release_note:breaking label should be applied in these situations.
Flaky Test Runner was used on any tests changed
The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines
Review the backport guidelines and apply applicable backport:* labels.

elasticmachine · 2026-03-09T22:25:17Z

Pinging @elastic/kibana-cases (Team:Cases)

janmonschke · 2026-03-10T08:54:06Z

    - cases
  parameters:
    - $ref: '../components/parameters/case_id.yaml'
-    - $ref: '../components/parameters/includeComments.yaml'


It seems like this file can be removed as well then. There are a bunch of references to includeComments in the cases codebase. It would make sense to clean those up as well. I think the workflow examples might also contain references to this option.

I removed the schema, but includeComments are being used in resolve case, which then passes the case data to case view. Will consider a refactor to move the attachment fetch out of resolve case, and call it explicitly when attachments are needed -> added an item in https://github.com/elastic/security-team/issues/15066

kibana/x-pack/platform/plugins/shared/cases/public/containers/api.ts

Lines 123 to 128 in 7283080

const response = await KibanaServices.get().http.fetch<CaseResolveResponse>(

`${getCaseDetailsUrl(caseId)}/resolve`,

{

method: 'GET',

query: { includeComments: true },

signal,

I see what you are saying about workflows now, they pulled from public api and I removed the references in 4512bf5

AB however directly calls cases client, so technically it could pass includeComments=true and it will return a case with comments. wdyt?

kibana/x-pack/platform/plugins/shared/agent_builder_platform/server/tools/cases/cases.ts

Lines 139 to 142 in 77c67a9

const theCase = await casesClient.cases.get({

id: caseId,

includeComments,

});

I think includeComments has been deprecated for some time and they should not send it like this. Might be best to reach out to them and clean this up in a follow-up ticket. Sounds good to you?

Actually,

kibana/x-pack/platform/plugins/shared/cases/server/workflows/steps/get_case.ts

Lines 24 to 27 in 7ff04c7

const theCase = await client.cases.get({

id: input.case_id,

includeComments: input.include_comments,

});

is passing it as well...
I wonder what the reasoning is for deprecating this on get.
In any case, I should add a resolveCase endpoint and deprecate includeComments from the getCase workflow.

Well, includeComments is also deprecated in the resolve endpoint:

kibana/x-pack/platform/plugins/shared/cases/server/routes/api/cases/get_case.ts

Lines 69 to 73 in cbeead2

/**

* @deprecated since version 8.1.0

*/

includeComments: schema.boolean({ defaultValue: true, meta: { deprecated: true } }),

}),

🤔

I think the instances of this only exist by mistake. I would clean them up, as this field was deprecated.

At the time christos had this in the description of the epic

The Cases UI uses the includeComments query parameter. We would need to update the Cases UI to use the alternative endpoint for the query parameter and extend the internal GET /internal/cases/metrics to return the stats needed by the UI.

And I suspect we just never did the follow-up. Because of that, other usages popped up. +1 on cleaning up.

nastasha-solomon

Just had one question. Otherwise, looks good!

nastasha-solomon · 2026-03-12T15:18:17Z

        extractObservables:
-          description: Auto extracts observables
+          description: |
+            When true, observables (e.g. IPs, hashes, URLs) are automatically extracted from case comments. Optional; defaults to false when omitted.


How's the "optional" qualification being used in the second sentence?

Also, if the default configuration for this param is false, just need this small tweak:

Suggested change

When true, observables (e.g. IPs, hashes, URLs) are automatically extracted from case comments. Optional; defaults to false when omitted.

When `true`, observables (for example, IPs, hashes, URLs) are automatically extracted from case comments. Defaults to `false` if omitted.

Optional means we still accept a request without extractObservables.

janmonschke

Changes look good to me! Maybe add a follow-up ticket for cleaning up the usage of includeComments.

christineweng · 2026-03-13T15:19:03Z

Changes look good to me! Maybe add a follow-up ticket for cleaning up the usage of includeComments.

@janmonschke I updated an existing ticket on this -> #207797 and moved it to Todo on our board

shahargl

lgtm

elasticmachine · 2026-03-16T22:54:09Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: d71f246

Failed CI Steps

Test Failures

[job] [logs] Scout: [ security / entity_store ] plugin / local-serverless-security_complete - Entity Store Main logs extraction - Should extract properly extract host
[job] [logs] Scout: [ platform / streams_app-stateful-classic ] plugin / local-stateful-classic - Stream data quality - should open and close degraded field flyout

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`cases`	2.0MB	2.0MB	+721.0B
`workflowsManagement`	1.8MB	1.8MB	-231.0B
total			+490.0B

History

💔 Build #408474 failed 9133478
💔 Build #408443 failed aecdfd2
💔 Build #408405 failed 3161283
💛 Build #407901 was flaky d8e40f5
💔 Build #407891 failed 0c33c78
💔 Build #407735 failed c1b4d51

cc @christineweng

## Summary Updated cases API docs to address: - Removed alert reference in find comment api. Related: #156863 - Updated response schema and examples - existing response uses full case response, which is not correct - Removed `includeComment` param in get case api. [it is always false for public api](https://github.com/elastic/kibana/blob/ab858f5d9f3f91104b083c5b6d31363e41804828/x-pack/platform/plugins/shared/cases/server/routes/api/cases/get_case.ts#L40-L42) but the response example contains comments, related: #207739 - Included `extractObservables` to case request and response - Fixed typos ### Checklist - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [ ] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [ ] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker) - [ ] This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The `release_note:breaking` label should be applied in these situations. - [ ] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed - [x] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) - [x] Review the [backport guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing) and apply applicable `backport:*` labels. --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

## Summary Updated cases API docs to address: - Removed alert reference in find comment api. Related: elastic#156863 - Updated response schema and examples - existing response uses full case response, which is not correct - Removed `includeComment` param in get case api. [it is always false for public api](https://github.com/elastic/kibana/blob/ab858f5d9f3f91104b083c5b6d31363e41804828/x-pack/platform/plugins/shared/cases/server/routes/api/cases/get_case.ts#L40-L42) but the response example contains comments, related: elastic#207739 - Included `extractObservables` to case request and response - Fixed typos ### Checklist - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [ ] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [ ] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker) - [ ] This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The `release_note:breaking` label should be applied in these situations. - [ ] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed - [x] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) - [x] Review the [backport guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing) and apply applicable `backport:*` labels. --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

christineweng self-assigned this Mar 9, 2026

christineweng requested a review from a team as a code owner March 9, 2026 22:25

christineweng added release_note:skip Skip the PR/issue when compiling release notes backport:skip This PR does not require backporting Team:Cases Security Solution Cases team labels Mar 9, 2026

christineweng requested review from janmonschke and nastasha-solomon March 9, 2026 22:25

christineweng commented Mar 9, 2026

View reviewed changes

Comment thread x-pack/platform/plugins/shared/cases/server/routes/api/cases/get_case.ts Outdated

elastic-vault-github-plugin-prod Bot requested a review from a team as a code owner March 9, 2026 22:44

MykhailoKondrat approved these changes Mar 10, 2026

View reviewed changes

janmonschke reviewed Mar 10, 2026

View reviewed changes

michaelolo24 added the 9.4.0 label Mar 10, 2026

christineweng added v9.4.0 and removed 9.4.0 labels Mar 10, 2026

christineweng force-pushed the cases-api-doc-fix branch 2 times, most recently from c78a46a to 4512bf5 Compare March 10, 2026 16:49

christineweng requested a review from a team as a code owner March 10, 2026 16:49

botelastic Bot added the Team:One Workflow Team label for One Workflow (Workflow automation) label Mar 10, 2026

christineweng requested a review from adcoelho March 10, 2026 17:13

adcoelho reviewed Mar 11, 2026

View reviewed changes

Comment thread x-pack/platform/plugins/shared/cases/server/routes/api/comments/find_comments.ts

adcoelho approved these changes Mar 11, 2026

View reviewed changes

christineweng mentioned this pull request Mar 11, 2026

[Response Ops][Cases] Remove includeComments from cases client #207797

Open

christineweng force-pushed the cases-api-doc-fix branch 3 times, most recently from e059255 to 3161283 Compare March 11, 2026 16:39

elastic-vault-github-plugin-prod Bot requested a review from a team as a code owner March 11, 2026 17:46

christineweng force-pushed the cases-api-doc-fix branch from 3560f6a to 9133478 Compare March 11, 2026 17:56

nastasha-solomon approved these changes Mar 12, 2026

View reviewed changes

janmonschke approved these changes Mar 13, 2026

View reviewed changes

christineweng mentioned this pull request Mar 13, 2026

[Cases][Attachments] Case attachments V2 dual read #256133

Merged

8 tasks

jesuswr approved these changes Mar 16, 2026

View reviewed changes

shahargl approved these changes Mar 16, 2026

View reviewed changes

christineweng and others added 5 commits March 16, 2026 15:39

update cases api docs

5521736

PR comments

4065415

remove include comments from workflow

18383bd

remove comments from response and more fixes

c478ade

copy

749b801

christineweng force-pushed the cases-api-doc-fix branch from c77af19 to 749b801 Compare March 16, 2026 20:39

christineweng mentioned this pull request Mar 16, 2026

[Cases] Update cases API to include extractObservables setting #252337

Closed

christineweng enabled auto-merge (squash) March 16, 2026 20:42

Changes from yarn openapi

d71f246

christineweng merged commit c80ad6a into elastic:main Mar 16, 2026
15 checks passed

	const response = await KibanaServices.get().http.fetch<CaseResolveResponse>(
	`${getCaseDetailsUrl(caseId)}/resolve`,
	{
	method: 'GET',
	query: { includeComments: true },
	signal,

	const theCase = await casesClient.cases.get({
	id: caseId,
	includeComments,
	});

	const theCase = await client.cases.get({
	id: input.case_id,
	includeComments: input.include_comments,
	});

	/**
	* @deprecated since version 8.1.0
	*/
	includeComments: schema.boolean({ defaultValue: true, meta: { deprecated: true } }),
	}),

	When true, observables (e.g. IPs, hashes, URLs) are automatically extracted from case comments. Optional; defaults to false when omitted.
	When `true`, observables (for example, IPs, hashes, URLs) are automatically extracted from case comments. Defaults to `false` if omitted.

Conversation

christineweng commented Mar 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Checklist

Uh oh!

elasticmachine commented Mar 9, 2026

Uh oh!

Uh oh!

janmonschke Mar 10, 2026

Choose a reason for hiding this comment

Uh oh!

christineweng Mar 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

christineweng Mar 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

janmonschke Mar 10, 2026

Choose a reason for hiding this comment

Uh oh!

janmonschke Mar 10, 2026

Choose a reason for hiding this comment

Uh oh!

janmonschke Mar 10, 2026

Choose a reason for hiding this comment

Uh oh!

adcoelho Mar 11, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

nastasha-solomon left a comment

Choose a reason for hiding this comment

Uh oh!

nastasha-solomon Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

christineweng Mar 16, 2026

Choose a reason for hiding this comment

Uh oh!

janmonschke left a comment

Choose a reason for hiding this comment

Uh oh!

christineweng commented Mar 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

shahargl left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

elasticmachine commented Mar 16, 2026

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

Metrics [docs]

Async chunks

History

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

11 participants

christineweng commented Mar 9, 2026 •

edited

Loading

christineweng Mar 10, 2026 •

edited

Loading

christineweng Mar 10, 2026 •

edited

Loading

christineweng commented Mar 13, 2026 •

edited

Loading