Get draft Timeline or Timeline template details

Base URL: https://{kibana_url}

GET /api/timeline/_draft

Auth

Get the details of the draft Timeline or Timeline template for the current user. If the user doesn't have a draft Timeline, an empty Timeline is returned.

Query parameters

timelineType enum required: Which draft to load (default investigation timeline or template timeline template).; Values: default template

Responses

Indicates a successful call.

application/json

columns object[] nullable: The Timeline's columns
created number nullable: The time the Timeline was created, using a 13-digit Epoch timestamp.
createdBy string nullable: The user who created the Timeline.
dataProviders object[] nullable: Object containing query clauses
dataViewId string nullable: ID of the Timeline's Data View
dateRange object nullable: The Timeline's search period.
description string nullable: The Timeline's description
eqlOptions object nullable: EQL query that is used in the correlation tab
eventType string nullable deprecated: Event types displayed in the Timeline
excludedRowRendererIds enum[] nullable: A list of row renderers that should not be used when in Event renderers mode; Values: alert alerts auditd auditd_file library netflow plain registry suricata system system_dns system_endgame_process system_file system_fim system_security_event system_socket threat_match zeek
favorite object[] nullable
filters object[] nullable: A list of filters that should be applied to the query
indexNames string[] nullable: A list of index names to use in the query (e.g. when the default data view has been modified)
kqlMode string nullable: Indicates whether the KQL bar filters the query results or searches for additional results, where:

filter: filters query results

search: displays additional search results
kqlQuery object: KQL bar query.
savedQueryId string nullable: The ID of the saved query that might be used in the Query tab
savedSearchId string nullable: The ID of the saved search that is used in the ES|QL tab
sort union oneOf: object or object[]
status enum: The status of the Timeline.; Values: active draft immutable
templateTimelineId string nullable: A unique ID (UUID) for Timeline templates. For Timelines, the value is null.
templateTimelineVersion number nullable: Timeline template version number. For Timelines, the value is null.
timelineType enum: The type of Timeline.; Values: default template
title string nullable: The Timeline's title.
updated number nullable: The last time the Timeline was updated, using a 13-digit Epoch timestamp
updatedBy string nullable: The user who last updated the Timeline
savedObjectId string required: The savedObjectId of the Timeline or Timeline template
version string required: The version of the Timeline or Timeline template
eventIdToNoteIds object[] nullable: A list of all the notes that are associated to this Timeline.
noteIds string[] nullable: A list of all the ids of notes that are associated to this Timeline.
notes object[] nullable: A list of all the notes that are associated to this Timeline.
pinnedEventIds string[] nullable: A list of all the ids of pinned events that are associated to this Timeline.
pinnedEventsSaveObject object[] nullable: A list of all the pinned events that are associated to this Timeline.

If a draft Timeline was not found and we attempted to create one, it indicates that the user does not have the required permissions to create a draft Timeline.

application/json

This should never happen, but if a draft Timeline was not found and we attempted to create one, it indicates that there is already a draft Timeline with the given timelineId.

application/json