Get value lists
Base URL
https://{kibana_url}
GET
/api/lists/_find
GET
/s/{space_id} /api/lists/_find
Auth
Get a paginated subset of value lists. By default, the first page is returned, with 20 results per page.
Expand all
space_id
string optional
An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.
page
integer
The page number to return.
per_page
integer
The number of value lists to return per page.
sort_field
string · format: nonempty · min length: 1
Determines which field is used to sort the results.
Example:
name
sort_order
enum
Determines the sort order, which can be desc or asc
Values:
desc
asc
cursor
string · format: nonempty · min length: 1
Returns the lists that come after the last lists returned in the previous call (use the cursor value returned in the previous call). This parameter uses the tie_breaker_id field to ensure all lists are sorted and returned correctly.
Example:
WzIwLFsiYjU3Yzc2MmMtMzAzNi00NjVjLTliZmItN2JmYjVlNmU1MTVhIl1d
filter
string
Filters the returned results according to the value of the specified field,
using the
Example:
value:127.0.0.1
cursor
string · format: nonempty · min length: 1 required
data
object [] required
−
Hide 14 properties
_version
string
The version id, normally returned by the API when the document is retrieved. Use it ensure updates are done against the latest version.
@timestamp
string · format: date-time
created_at
string · format: date-time required
Autogenerated date of object creation.
created_by
string required
Autogenerated value - user that created object.
description
string · format: nonempty · min length: 1 required
Describes the value list.
id
string · format: nonempty · min length: 1 required
Value list's identifier.
immutable
boolean required
meta
object
Placeholder for metadata about the value list.
name
string · format: nonempty · min length: 1 required
Value list's name.
tie_breaker_id
string required
Field used in search to ensure all containers are sorted and returned correctly.
type
enum required
Specifies the Elasticsearch data type of excludes the list container holds. Some common examples:
keyword: Many ECS fields are Elasticsearch keywordsip: IP addressesip_range: Range of IP addresses (supports IPv4, IPv6, and CIDR notation)
Values:
binary
boolean
byte
date
date_nanos
date_range
double
double_range
float
float_range
geo_point
geo_shape
half_float
integer
integer_range
ip
ip_range
keyword
long
long_range
shape
short
text
+
show 11 more values
updated_at
string · format: date-time required
Autogenerated date of last object update.
updated_by
string required
Autogenerated value - user that last updated object.
version
integer · min: 1 required
The document version number.
page
integer · min: 0 required
per_page
integer · min: 0 required
total
integer · min: 0 required
400
Invalid input data response
application/json
One of:
−
Hide 2 properties
status_code
integer required
401
Unsuccessful authentication response
application/json
statusCode
integer required
403
Not enough privileges response
application/json
statusCode
integer required
500
Internal server error response
application/json
status_code
integer required
Thank you for your feedback.
Base URL
https://{kibana_url}
Examples
Request
Console
1 / 2 languages
‹
›
1
GET kbn:/api/lists/_find
Generated from the API spec
1
2
curl -X GET "${KIBANA_URL}/api/lists/_find" \
-H "Authorization: ApiKey ${API_KEY}"
Generated from the API spec
Response
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
{
"cursor": "WzIwLFsiZjU1MDgxODgtYjFlOS00ZTZlLTk2NjItZDAzOWE3ZDg5ODk5Il1d",
"data": [
{
"_version": "WzAsMV0=",
"@timestamp": "2025-01-08T04:47:34.273Z\n",
"created_at": "2025-01-08T04:47:34.273Z\n",
"created_by": "elastic",
"description": "This list describes bad internet ip",
"id": "ip_list",
"immutable": false,
"name": "Simple list with an ip",
"tie_breaker_id": "f5508188-b1e9-4e6e-9662-d039a7d89899",
"type": "ip",
"updated_at": "2025-01-08T04:47:34.273Z\n",
"updated_by": "elastic",
"version": 1
}
],
"page": 1,
"per_page": 20,
"total": 1
}
1
2
3
4
5
{
"error": "Bad Request",
"message": "[request query]: page: Expected number, received nan",
"statusCode": 400
}
1
2
3
4
5
{
"error": "Unauthorized",
"message": "[security_exception\\n\\tRoot causes:\\n\\t\\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
"statusCode": 401
}
1
2
3
4
5
{
"error": "Forbidden",
"message": "API [GET /api/lists/_find?page=1\u0026per_page=20] is unauthorized for user, this action is granted by the Kibana privileges [lists-read]",
"statusCode": 403
}
1
2
3
4
{
"message": "Internal Server Error",
"status_code": 500
}