Type to search.

Get notes

Base URL
https://{kibana_url}
Auth

Returns Security Timeline notes as saved objects.

Query modes (mutually exclusive branches on the server):

  1. documentIds is set — Returns notes whose eventId matches the given Elasticsearch document _id (single string or array). Pagination query parameters (page, perPage, etc.) are not applied; the server uses a fixed page size (up to 10000 notes).

  2. savedObjectIds is set — Returns notes linked to the given Timeline saved object id(s). Same fixed cap as above; list-mode query parameters are not applied.

  3. Neither documentIds nor savedObjectIds — Lists notes using saved-objects find semantics: page (default 1), perPage (default 10), optional search, sortField, sortOrder, filter, createdByFilter, and associatedFilter.

Requires the Timeline and Notes read privilege (notes_read).

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Query parameters

documentIds union string[] | string

Event document _id values to match against each note's eventId. When this parameter is present, the response is all matching notes (up to the server's hard limit), not a paged list using page/perPage.

Example: ["id-one","id-two"]
savedObjectIds union string[] | string

Timeline savedObjectId value(s). Returns notes that reference those timelines. When present, list-mode pagination parameters are not used; up to the server's hard limit of notes may be returned.

Example: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
page string nullable

Page number for list mode (when documentIds and savedObjectIds are omitted). Passed as a string; default 1.

Example: 1
perPage string nullable

Page size for list mode (when documentIds and savedObjectIds are omitted). Passed as a string; default 10.

Example: 20

Search string for saved-objects find (list mode only).

sortField string nullable

Field to sort by for saved-objects find (list mode only).

sortOrder string nullable

Sort order (asc or desc) for saved-objects find (list mode only).

Example: desc
filter string nullable

Kuery filter string combined with other list-mode filters (for example createdByFilter or associatedFilter). Typed as a string for API compatibility; interpreted by the saved-objects layer (list mode only).

createdByFilter string nullable

Kibana user profile UID (UUID). The server resolves the user's display identifiers and returns notes whose createdBy matches any of them (list mode only).

Example: f1c2d3e4-5b6a-7890-abcd-ef1234567890
associatedFilter enum

Restricts notes by how they relate to a Timeline and/or an event document (list mode only). Some values apply extra filtering after the query. Ignored when documentIds or savedObjectIds is used.

Values: all document_only saved_object_only document_and_saved_object orphan

Response

Notes and total count for the requested mode.

application/json
notes object[] required
created number nullable

The time the note was created, using a 13-digit Epoch timestamp.

createdBy string nullable

The user who created the note.

updated number nullable

The last time the note was updated, using a 13-digit Epoch timestamp

updatedBy string nullable

The user who last updated the note

eventId string nullable

Elasticsearch document _id for the event or alert this note refers to. Same value as the documentIds query parameter when fetching notes via GET /api/note.

note string nullable

The text of the note

timelineId string required

The savedObjectId of the Timeline this note belongs to (not the note's own ID).

noteId string required

The savedObjectId of the note

version string required

The version of the note

totalCount number required

Number of notes returned (may be adjusted after the query when associatedFilter applies post-filtering).