Add or update a note

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Body must include the note object. For updates, include noteId (and optionally version). To attach a note to a specific event, set note.eventId to that event's document _id; for a timeline-wide note, omit or clear eventId per product rules.

note object required

− Hide 7 properties

created number nullable

The time the note was created, using a 13-digit Epoch timestamp.

createdBy string nullable

The user who created the note.

updated number nullable

The last time the note was updated, using a 13-digit Epoch timestamp

updatedBy string nullable

The user who last updated the note

eventId string nullable

Elasticsearch document _id for the event or alert this note refers to. Same value as the documentIds query parameter when fetching notes via GET /api/note.

note string nullable

The text of the note

timelineId string required

The savedObjectId of the Timeline this note belongs to (not the note's own ID).

noteId string nullable

The savedObjectId of the note to update. Omit when creating a new note.

version string nullable

Saved object version string from a previous read; optional on update.