Add `elastic kb cases` command group (Cases APIs are in Kibana's OpenAPI spec but not generated in the CLI)

[dhru42]

Summary

The elastic CLI (tested against v0.5.1) has no cases command group under elastic kb, even though the Cases REST API is fully described in Kibana's bundled OpenAPI document. We hit this while converting Kibana's Cases Agent Builder skill to the universal skill format in agent-skills-sandbox#470, where the skill's Operations table maps each call to an elastic kb cases ... command.

Evidence

• elastic kb --help and elastic kb cases --help on v0.5.1 return no cases commands (confirmed by @melissaburpo and @ghudgins).
• The Cases endpoints are present in Kibana's bundled OpenAPI spec — oas_docs/output/kibana.yaml contains 18 /api/cases* paths (/api/cases, /api/cases/_find, /api/cases/{caseId}, /api/cases/{caseId}/comments, /api/cases/{caseId}/observables, /api/cases/configure, etc.).
• The CLI README on main already lists cases as an example namespace (elastic kb cases list), so this looks like a generation/enablement gap rather than a design decision.

Ask

Generate/enable the elastic kb cases command group from the existing OpenAPI paths, and confirm the operation IDs and flag names so downstream skills can bind to them. The operations the Cases skill needs:

REST endpoint	Purpose
POST /api/cases	create
GET /api/cases/_find	search/list (with owner, tags, status, severity, search, paging, sort)
GET /api/cases/{caseId}	get one (for version before update)
PATCH /api/cases	bulk update (status/severity/tags/assignees)
DELETE /api/cases	delete
POST /api/cases/{caseId}/comments	add user comment / attach alert
GET /api/cases/{caseId}/comments/_find	list comments
GET /api/cases/{caseId}/alerts, GET /api/cases/alerts/{alertId}	alert<->case links
GET /api/cases/configure	templates / custom fields
`POST	PATCH

Notes

• These internal endpoints are expected to be excluded (no public binding needed): POST /internal/cases/_bulk_get, POST /internal/cases/{caseId}/_similar, POST /internal/cases/{caseId}/attachments/_bulk_create.
• Until the command group ships, the skill keeps the HTTP shorthand (/api/cases*) as the authoritative contract and marks the CLI commands as projected.

Context: agent-skills-sandbox#470

[JoshMock]

I've searched through the spec that we source our Kibana API surface area from and there is no cases namespace included there. I would start there and work backward to figure out where the spec needs to be defined to ensure it is published to that artifact.

[florent-leborgne]

Cases is absent from the Serverless OAS, it's only in the versioned Stack one. It is my understanding that the CLI that has been tested there is built based on the Serverless OAS. So the fix would be to make sure that Cases are added to it. I created elastic/kibana#284628 to do the wiring but it'll be up to the teams managing Cases APIs to ensure that the spec is identical between Serverless and Stack.

[JoshMock]

@florent-leborgne would this be solved by #441? I'm currently in the planning/RFC phase for that, which would include adding support for hosted Kibana APIs.

[florent-leborgne]

@JoshMock Yes I think so, the stateful OAS has more than the serverless one, or by elastic/kibana#284628 if we'll keep relying on the serverless OAS bundle for some time