Find case activity

Base URL: https://{kibana_url}

GET /api/cases/{caseId}/user_actions/_find
GET /s/{space_id}/api/cases/{caseId}/user_actions/_find

Auth

Retrives a paginated list of user activity for a case. You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're seeking.

Path parameters

space_id string optional: An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.
caseId string required: The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded.; Example: 9c235210-6834-11ea-a78c-6ffb38a34414

Query parameters

page integer · default: 1: The page number to return.
perPage integer · max: 100 · default: 20: The number of items to return. Limited to 100 items.
sortOrder enum · default: desc: Determines the sort order.; Values: asc desc
types enum[]: Determines the types of user actions to return.; Values: action alert assignees attachment comment connector create_case description pushed settings severity status tags title user

Responses

Indicates a successful call.

application/json

page integer
perPage integer
total integer
userActions object[] · max items: 10000

Authorization information is missing or invalid.

application/json