Hey! I’ve been experiencing bad configurations by n8n on TheHive5 nodes.
Describe the problem/error
Error In the following requests:
1. Custom fields for alert or case searches
2. Responders
What is the error message (if any)?
- When I use a Custom Field from the list that the node gives me and choose the customer in this case, no alerts/cases appear. When I switch to expression, the Display Name of the Custom Field appears instead of the Technical name. I think that is the wrong configuration. When I write manually using the technical name, alerts/cases appear.
(Chosen from the list provided by the node)
(Expression view)
(Change to technical name)
(TheHive5 View)
- In TheHive5 responders nodes, in the field for entering the Case By List/URL/ID field, an error always appears stating that the field must be in string format, even when typing manually or using toString(), but with a custom http request, it works fine. Error message below:
- “errorMessage”: “Bad request - please check your parameters”, “errorDescription”: “[Invalid format for objectId: FObject(Map(__rl → FBoolean(true), value → FString(~86872208), mode → FString(id))), expected string (string)]”,"
(Case Field)
Information on your n8n setup
- n8n version: 2.4.8
- Running n8n via (Docker)
Hi @tiago.pinto
Welcome to the n8n community 
!!
Thanks for describing the problem in so much detail, that helps a lot.
The TheHive5 node in n8n has a quirk with custom fields when searching alerts or cases. The node interface uses Display Names, but TheHive’s API actually requires the Technical Name. So you need to manually enter it in the format customFields.external-ticket-id. This isn’t a bug on your end, it’s just how the node works. (customFields.external-ticket-id)
For Responders, there’s an issue with how the node handles Case IDs. It sends the Case ID as an internal object instead of a plain string, which causes the API to reject the request. The workaround is to use the HTTP Request node directly, which handles it correctly. This is a known limitation or bug in the Responders node.
Hello, Tamy, thank you for your reply!!
I appreciate the clarification about the responders.
Regarding Custom Fields, when I choose directly from the list, no alert appears because the preconfigured field itself comes with the display name. To get around this, I enter the technical name and it works, but this error appears below.
@tiago.pinto
This is not an execution error, it’s just an n8n editor validation warning. A good practice is to leave a comment in the workflow explaining this, to avoid confusion in the future.
Let me just clarify, then, what is the point of the list that n8n provides in the nodes if it doesn’t work?
Having to manually enter the code for it to work.
@tiago.pinto
That’s a fair question 
The list is there to help you see what’s available and avoid typos. But here’s the thing: TheHive’s API requires the technical name of custom fields for searches, not the display name. The node doesn’t automatically translate between them, so you need to use customFields.<technical-name> manually.
In short: the list shows you what exists, but the API determines what actually works.
2 Likes
Very well, thank you for your cooperation.
About the responder nodes, do you intend to correct the problem?
