# Update a case comment or alert

**PATCH /api/cases/{caseId}/comments**

**Spaces method and path for this operation:**

<div><span class="operation-verb patch">patch</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/{caseId}/comments</span></div>

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you're updating. NOTE: You cannot change the comment type or the owner of a comment.



## Servers
- https://localhost:5601: https://localhost:5601 ()


## Authentication methods
- Api key auth
- Basic auth


## Parameters
### Headers
- **kbn-xsrf** (string)
  Cross-site request forgery protection

### Path parameters
- **caseId** (string)
  The identifier for the case. To retrieve case IDs, use the search cases (`_find)` API. All non-ASCII characters must be URL encoded.


### Body: application/json (object)

- **alertId** (string | array[string])
  The alert identifiers. It is required only when `type` is `alert`. You can use an array of strings to add multiple alerts to a case, provided that they all relate to the same rule; `index` must also be an array with the same length or number of elements. Adding multiple alerts in this manner is recommended rather than calling the API multiple times. This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.
- **id** (string)
  The identifier for the comment. To retrieve comment IDs, use the get comments API.
- **index** (string | array[string])
  The alert indices. It is required only when `type` is `alert`. If you are adding multiple alerts to a case, use an array of strings; the position of each index name in the array must match the position of the corresponding alert identifier in the `alertId` array.  This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.
- **owner** (string)
  The application that owns the cases: Stack Management, Observability, or Elastic Security.
- **rule** (object)
  The rule that is associated with the alerts. It is required only when `type` is `alert`. This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.
- **type** (string)
  The type of comment.
- **version** (string)
  The current comment version. To retrieve version values, use the get comments API.


## Responses
### 200
Indicates a successful call.

#### Body: application/json (object)
- **assignees** (array[object] | null)
  An array containing users that are assigned to the case.
- **category** (string | null)
  The case category.
- **closed_at** (string(date-time) | null)

- **closed_by** (object | null)

- **comments** (array[object])
  An array of comment objects for the case.
- **connector** (object)

- **created_at** (string(date-time))

- **created_by** (object)

- **customFields** (array[object])
  Custom field values for the case.
- **description** (string)

- **duration** (integer | null)
  The elapsed time from the creation of the case to its closure (in seconds). If the case has not been closed, the duration is set to null. If the case was closed after less than half a second, the duration is rounded down to zero.
- **external_service** (object | null)

- **id** (string)

- **incremental_id** (integer | null)
  A monotonically increasing number assigned to each case, unique per space. This value is generated asynchronously after the case is created and may not be present immediately in the response.
- **observables** (array[object])
  Observables attached to the case.
- **owner** (string)
  The application that owns the cases: Stack Management, Observability, or Elastic Security.
- **settings** (object)
  An object that contains the case settings.
- **severity** (string)
  The severity of the case.
- **status** (string)
  The status of the case.
- **tags** (array[string])

- **title** (string)

- **total_observables** (integer | null)
  The number of observables attached to the case.
- **totalAlerts** (integer)

- **totalComment** (integer)

- **totalEvents** (integer)
  The number of events attached to the case.
- **updated_at** (string(date-time) | null)

- **updated_by** (object | null)

- **version** (string)


### 401
Authorization information is missing or invalid.

#### Body: application/json (object)
- **error** (string)

- **message** (string)

- **statusCode** (integer)



[Powered by Bump.sh](https://bump.sh)