--- title: "Update a field definition" method: PUT path: "/api/cases/field_definitions/{field_definition_id}" tags: ["cases"] --- # Update a field definition `PUT /api/cases/field_definitions/{field_definition_id}` **Spaces method and path for this operation:**
put /s/{space_id}/api/cases/field_definitions/{field_definition_id}
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information. Updates editable attributes of a field definition. Server-managed attributes (`displayOrder`, `legacyKey`) are preserved. You must have the "Manage templates" sub-privilege for the Cases feature of the owning solution. A field's `name` and YAML `type` are immutable after creation — an attempt to change either returns `409` with `attributes.code = "field_identity_immutable"` and `attributes.changed` listing which identity attributes were modified. Setting `isGlobal` to `false` when the field is linked to an active custom field in the Cases configuration returns `409`; otherwise demotion is allowed. Requires the Cases feature to be enabled in the space. Use `dry_run=true` to validate the request without writing anything. ## Path parameters - `field_definition_id` string, required ## Query parameters - `dry_run` boolean ## Request body - CasesFieldDefinitionPutRequest — The body for updating a field definition. Identity constraints: the `name` property must match the `name` key in the YAML `definition`. When `name` is omitted, the server extracts it from the `definition` YAML automatically. A field's `name` and YAML `type` are immutable — an attempt to change either returns `409` with `attributes.code = "field_identity_immutable"` and `attributes.changed` listing which identity attributes were modified. Unlike the POST endpoint, PUT allows an unchanged `definition` to be submitted even if it exceeds 30 000 characters, so that field definitions created through internal tooling remain modifiable. When the submitted `definition` differs from the stored value, the 30 000-character limit is enforced. A hard upper bound of 1 000 000 characters always applies regardless of whether the definition is changed. - `definition` string, required — The field definition as a YAML string describing a single field (type, label, control, metadata). - `description` string — Optional human-readable description of the field's purpose. - `isGlobal` boolean — When true, this field is rendered in every case for this owner, regardless of the template used. Global fields cannot be demoted (set to false) while they are linked to an active custom field in the Cases configuration. - `name` string — The field name, unique per owner (case-insensitive). Must match the `name` key inside the YAML definition. When omitted, the name is extracted from the definition YAML automatically. Immutable after creation. Unlike POST, the 50-character limit is not enforced on PUT so that definitions with legacy names that exceed the limit remain modifiable. - `owner` string, required — The application that owns this field definition. ## Response `200` Indicates a successful call. Returns the updated field definition, or `{ "valid": true }` when `dry_run=true`. - union - CasesFieldDefinitionResponse — A field definition from the field library. The `legacyKey` attribute, which is a server-managed link to a migrated custom field, is not included in the public API response. - `definition` string, required — The field definition as a YAML string. New definitions are limited to 30 000 characters, but existing definitions created via internal tooling may be longer. - `description` string — Optional human-readable description of the field's purpose. - `displayOrder` integer — Position of a global field in the case details view. Assigned by the server and changed via the Field Library reorder controls. - `fieldDefinitionId` string, required — Unique server-assigned identifier for the field definition (UUID). May be UUIDv4 for definitions created through the public API, or UUIDv5 for definitions created by internal migration processes. - `isGlobal` boolean — When true, this field is rendered in every case regardless of which template the case uses. - `name` string, required — The field name. Must match the `name` property in the YAML definition and is unique per owner (case-insensitive). Immutable after creation. - `owner` string, required — The application that owns this field definition. - object - `valid` boolean, required ## Other responses - `400` — The request body is invalid, the YAML definition is malformed, the `name` does not match the YAML definition's `name`, or the owner would be changed. - `401` — Authorization information is missing or invalid. - `403` — The user does not have the manage templates privilege for the owner. - `404` — The field definition was not found. - `409` — A field's name or type cannot be changed after creation, or a global field cannot be demoted while linked to an active custom field. --- [API](https://skmtc.dev/elastic/apis/kibana-apis.md) · [All operations](https://skmtc.dev/elastic/apis/kibana-apis/llms.txt) · [OpenAPI document](https://skmtc.dev/elastic/apis/kibana-apis/revisions/84f30e7da461?raw)