---
title: "Get a case comment or alert"
method: GET
path: "/api/cases/{caseId}/comments/{commentId}"
tags: ["cases"]
---

# Get a case comment or alert

`GET /api/cases/{caseId}/comments/{commentId}`

**Spaces method and path for this operation:**

<div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/{caseId}/comments/{commentId}</span></div>

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases with the comments you're seeking.

## Path parameters

- `caseId` string, required
- `commentId` string, required

## Response `200`

Indicates a successful call.

- union
  - CasesAlertCommentResponseProperties
    - `alertId` string[]
    - `created_at` string, date-time
    - `created_by` object
      - `email` string, nullable, required
      - `full_name` string, nullable, required
      - `profile_uid` string
      - `username` string, nullable, required
    - `id` string
    - `index` string[]
    - `owner` 'cases' | 'observability' | 'securitySolution' — The application that owns the cases: Stack Management, Observability, or Elastic Security.
    - `pushed_at` string, date-time, nullable
    - `pushed_by` object, nullable
      - `email` string, nullable, required
      - `full_name` string, nullable, required
      - `profile_uid` string
      - `username` string, nullable, required
    - `rule` object
      - `id` string, nullable — The rule identifier.
      - `name` string, nullable — The rule name.
    - `type` 'alert', required
    - `updated_at` string, date-time, nullable
    - `updated_by` object, nullable
      - `email` string, nullable, required
      - `full_name` string, nullable, required
      - `profile_uid` string
      - `username` string, nullable, required
    - `version` string
  - CasesUserCommentResponseProperties
    - `comment` string
    - `created_at` string, date-time
    - `created_by` CasesCaseResponseCreatedByProperties
      - `email` string, nullable, required
      - `full_name` string, nullable, required
      - `profile_uid` string
      - `username` string, nullable, required
    - `id` string
    - `owner` 'cases' | 'observability' | 'securitySolution' — The application that owns the cases: Stack Management, Observability, or Elastic Security.
    - `pushed_at` string, date-time, nullable
    - `pushed_by` CasesCaseResponsePushedByProperties, nullable
      - `email` string, nullable, required
      - `full_name` string, nullable, required
      - `profile_uid` string
      - `username` string, nullable, required
    - `type` 'user', required
    - `updated_at` string, date-time, nullable
    - `updated_by` CasesCaseResponseUpdatedByProperties, nullable
      - `email` string, nullable, required
      - `full_name` string, nullable, required
      - `profile_uid` string
      - `username` string, nullable, required
    - `version` string

## Other responses

- `401` — Authorization information is missing or invalid.

---

[API](https://skmtc.net/elastic/apis/kibana-apis.md) · [All operations](https://skmtc.net/elastic/apis/kibana-apis/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/elastic/kibana-apis/versions/531c9e2a7d23/schema)