Sign in

v53

latestOpenAPI 3.0.3raw.githubusercontent.com2026-08-076771,7565.2 MB
cases

Find case activity

Spaces method and path for this operation:

<div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/{caseId}/user_actions/_find</span></div>

Refer to Spaces for more information.

Retrieves a paginated list of user activity for a case. You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're seeking.

get/api/cases/{caseId}/user_actions/_find

Path parameters

caseIdstring required
Example:9c235210-6834-11ea-a78c-6ffb38a34414

The identifier for the case. To retrieve case IDs, use the search cases (_find) API. All non-ASCII characters must be URL encoded.

Query parameters

pageinteger

The page number to return.

perPageinteger

The number of items to return. Limited to 100 items.

sortOrder'asc' | 'desc'

Determines the sort order.

typesstring[]

Determines the types of user actions to return.

[
  "create_case"
]

Response

Indicates a successful call.

pageinteger
perPageinteger
totalinteger

Example response

{
  "userActions": [
    {
      "action": "create",
      "comment_id": "578608d0-03b1-11ed-920c-974bfa104448",
      "created_at": "2022-05-13T09:16:17.416Z",
      "created_by": {
        "profile_uid": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
        "username": "elastic"
      },
      "id": "22fd3e30-03b1-11ed-920c-974bfa104448",
      "owner": "cases",
      "payload": {
        "comment": {
          "alertId": "1c0b056b-cc9f-4b61-b5c9-cb801abd5e1d",
          "index": ".alerts-observability.logs.alerts-default",
          "owner": "cases",
          "rule": {
            "id": "94d80550-aaf4-11ec-985f-97e55adae8b9",
            "name": "security_rule"
          }
        }
      },
      "type": "create_case",
      "version": "WzM1ODg4LDFd"
    }
  ]
}