Module cases 

Cases: typed wrappers over the /api/cases family.

Case identity on mutation is id plus the fetched version — the API is optimistic-concurrency and a stale version answers 409 (triage spec sections 3 and 10). Cases are collaboration records: there is no mirror, no reconciliation, and deletion is a real verb (unlike alerts).

Structs

Case

A case as the API returns it. The four identity/workflow fields are required (fail-closed); everything else is optional or flattened into extra so the full server object survives a round trip to render.

NewCase

Enums

CaseStatus

The case status vocabulary. Cases legitimately use in-progress (it is a filter value); the transition verbs target only open and closed.

Constants

CASES_PATH

FIND_PATH

OWNER

Functions

add_comment

Add a user comment; the response is the updated case.

attach_alerts

Attach alerts as one comment of type alert. All alerts in one call share a rule (the API takes one rule object per comment); the caller groups by rule. alert_ids and indices are parallel arrays.

case_path

comments_path

create

Create a case. The API requires a non-empty description; when the operator gave none, or gave an empty or whitespace-only one, the title stands in — Some("") must fall back exactly like None, or it defeats the fallback and earns a server 400 on minimum length. connector and settings are required by the route; elasticctl pins the no-op connector and leaves alert-status syncing off — alert transitions stay explicit CLI actions.

decode_case

decode_find

Decode GET /api/cases/_find: {cases, page, per_page, total, ...}.

delete

Delete cases permanently. 204 with an empty body on success.

delete_path

DELETE /api/cases?ids=["a","b"] — the ids parameter is a JSON array in the query string.

find_page

One find page; the caller builds the query string (cases_ops::find_query).

get

patch_status

Bulk status update: PATCH /api/cases with {cases: [{id, version, status}]}. The response is the array of updated cases.