# Create or Update Case — Elastic Security

> Create a new Elastic Security case, or update an existing one when caseId is provided, via POST /api/cases or PATCH /api/cases. Use this to open a new case, or to edit a case's title, description, severity, tags, category, assignees, or…

- Key: `elastic_security-create-or-update-case`
- Type: Action (Write)
- Version: 0.0.1
- App: Elastic Security (`elastic_security`) — https://pipedream.com/apps/elastic-security.md
- This page (HTML): https://pipedream.com/apps/elastic-security/actions/create-or-update-case
- Hints: open-world
- Source: https://github.com/PipedreamHQ/pipedream/blob/master/components/elastic_security/actions/create-or-update-case/create-or-update-case.mjs

## Description

Create a new Elastic Security case, or update an existing one when `caseId` is provided, via POST /api/cases or PATCH /api/cases. Use this to open a new case, or to edit a case's title, description, severity, tags, category, assignees, or status. When `caseId` is provided, the tool fetches the case's current `version` internally before updating — never guess or supply a version yourself. Run **Find Cases** first to obtain a `caseId` for updates. Use **Add Case Comment** to attach comments instead of this tool. `title` and `description` are required when creating (no `caseId`). Example: calling with `title: "Perimeter Breach"`, `description: "..."`, `severity: "high"` returns `{ id: "a1c1...", title: "Perimeter Breach", status: "open", version: "Wzc1LDFd", ... }`; calling again with that `caseId` and `status: "closed"` returns the same case updated. [See the create documentation](https://www.elastic.co/docs/api/doc/kibana/operation/operation-createcasedefaultspace) and the [update documentation](https://www.elastic.co/docs/api/doc/kibana/operation/operation-updatecasedefaultspace)

## Props

| Prop | Type | Required | Description |
|---|---|---|---|
| `caseId` | `string` | No | The ID of an existing case to update. Omit this to create a new case instead. Run Find Cases first to obtain valid case IDs. |
| `title` | `string` | No | Case title (max 160 characters). Required when creating a new case (no caseId). |
| `description` | `string` | No | Case description (max 30000 characters). Required when creating a new case (no caseId). |
| `severity` | `string` | No | Case severity. One of: low, medium, high, critical. |
| `status` | `string` | No | New case status. Only applies when updating an existing case (caseId provided) — the create API has no status field. |
| `tags` | `string[]` | No | Tags to apply to the case. Run List Tags first to reuse existing tags instead of creating near-duplicates. On update, this replaces the case's existing tag set entirely. |
| `category` | `string` | No | Case category (max 50 characters). |
| `assignees` | `string[]` | No | User profile IDs to assign to the case (max 10). Example: ["u_abc123"]. Run Find Assignable Users first to discover valid profile_uid values. On update, this replaces the case's existing assignee set entirely. |
| `syncAlerts` | `boolean` | No | Whether to sync the status of attached alerts with the case status. Defaults to true on create. |

## Run it

**MCP**

```ts
import { Client } from "@modelcontextprotocol/sdk/client/index.js"
import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js"
import { PipedreamClient } from "@pipedream/sdk"

const pd = new PipedreamClient({
  projectId: process.env.PIPEDREAM_PROJECT_ID!,
  clientId: process.env.PIPEDREAM_CLIENT_ID!,
  clientSecret: process.env.PIPEDREAM_CLIENT_SECRET!,
  projectEnvironment: "production",
})

const accessToken = await pd.rawAccessToken

const transport = new StreamableHTTPClientTransport(
  new URL("https://remote.mcp.pipedream.net/v3"),
  {
    requestInit: {
      headers: {
        Authorization: `Bearer ${accessToken}`,
        "x-pd-project-id": process.env.PIPEDREAM_PROJECT_ID!,
        "x-pd-environment": "production",
        "x-pd-external-user-id": "{external_user_id}", // any stable ID for this user in your system
        "x-pd-app-slug": "elastic_security",
      },
    },
  },
)

const mcp = new Client({ name: "my-agent", version: "1.0.0" })
await mcp.connect(transport)

const { tools } = await mcp.listTools()

// listTools() hands your model this tool's input schema, so it can
// fill the arguments itself:
const result = await mcp.callTool({
  name: "elastic_security-create-or-update-case",
  arguments: {
    caseId: "Case ID",
    title: "Title",
  },
})
```

**TypeScript**

```ts
import { PipedreamClient } from "@pipedream/sdk"

const pd = new PipedreamClient({
  projectId: process.env.PIPEDREAM_PROJECT_ID!,
  clientId: process.env.PIPEDREAM_CLIENT_ID!,
  clientSecret: process.env.PIPEDREAM_CLIENT_SECRET!,
  projectEnvironment: "production",
})

const result = await pd.actions.run({
  id: "elastic_security-create-or-update-case",
  externalUserId: "{external_user_id}", // any stable ID for this user in your system
  configuredProps: {
    elastic_security: { authProvisionId: "apn_xxxxxxx" },
    caseId: "Case ID",
    title: "Title",
  },
})

console.log(result)
```

**cURL**

```bash
curl -X POST https://api.pipedream.com/v1/connect/{project_id}/actions/run \
  -H "Content-Type: application/json" \
  -H "X-PD-Environment: production" \
  -H "Authorization: Bearer {access_token}" \
  -d '{
    "external_user_id": "{external_user_id}",
    "id": "elastic_security-create-or-update-case",
    "configured_props": {
      "elastic_security": { "authProvisionId": "apn_xxxxxxx" },
      "caseId": "Case ID",
      "title": "Title"
    }
  }'
```

---

- App: https://pipedream.com/apps/elastic-security.md · All apps: https://pipedream.com/apps