---
title: "Find case activity"
method: GET
path: "/api/cases/{caseId}/user_actions/_find"
tags: ["cases"]
---

# Find case activity

`GET /api/cases/{caseId}/user_actions/_find`

**Spaces method and path for this operation:**

<div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/{caseId}/user_actions/_find</span></div>

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Retrieves a paginated list of user activity for a case. You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you're seeking.

## Path parameters

- `caseId` string, required

## Query parameters

- `page` integer
- `perPage` integer
- `sortOrder` 'asc' | 'desc'
- `types` string[]

## Response `200`

Indicates a successful call.

- object
  - `page` integer
  - `perPage` integer
  - `total` integer
  - `userActions` CasesUserActionsFindResponseProperties[]
    - `action` 'add' | 'create' | 'delete' | 'push_to_service' | 'update', required
    - `comment_id` string, nullable, required
    - `created_at` string, date-time, required
    - `created_by` object, required
      - `email` string, nullable, required
      - `full_name` string, nullable, required
      - `profile_uid` string
      - `username` string, nullable, required
    - `id` string, required
    - `owner` 'cases' | 'observability' | 'securitySolution', required — The application that owns the cases: Stack Management, Observability, or Elastic Security.
    - `payload` union, required
      - CasesPayloadAlertComment
        - `comment` object
          - `alertId` union
            - string
            - string[]
          - `index` union
            - string
            - string[]
          - `owner` 'cases' | 'observability' | 'securitySolution' — The application that owns the cases: Stack Management, Observability, or Elastic Security.
          - `rule` object
            - `id` string, nullable — The rule identifier.
            - `name` string, nullable — The rule name.
          - `type` 'alert'
      - CasesPayloadAssignees
        - `assignees` object[], nullable — An array containing users that are assigned to the case.
          - `uid` string, required — A unique identifier for the user profile. These identifiers can be found by using the suggest user profile API.
      - CasesPayloadConnector
        - `connector` object
          - `fields` object, nullable — An object containing the connector fields. To create a case without a connector, specify null. If you want to omit any individual field, specify null as its value.
            - `caseId` string — The case identifier for Swimlane connectors.
            - `category` string — The category of the incident for ServiceNow ITSM and ServiceNow SecOps connectors.
            - `destIp` boolean, nullable — Indicates whether cases will send a comma-separated list of destination IPs for ServiceNow SecOps connectors.
            - `impact` string — The effect an incident had on business for ServiceNow ITSM connectors.
            - `issueType` string — The type of issue for Jira connectors.
            - `issueTypes` string[] — The type of incident for IBM Resilient connectors.
            - `malwareHash` boolean, nullable — Indicates whether cases will send a comma-separated list of malware hashes for ServiceNow SecOps connectors.
            - `malwareUrl` boolean, nullable — Indicates whether cases will send a comma-separated list of malware URLs for ServiceNow SecOps connectors.
            - `parent` string — The key of the parent issue, when the issue type is sub-task for Jira connectors.
            - `priority` string — The priority of the issue for Jira and ServiceNow SecOps connectors.
            - `severity` string — The severity of the incident for ServiceNow ITSM connectors.
            - `severityCode` string — The severity code of the incident for IBM Resilient connectors.
            - `sourceIp` boolean, nullable — Indicates whether cases will send a comma-separated list of source IPs for ServiceNow SecOps connectors.
            - `subcategory` string — The subcategory of the incident for ServiceNow ITSM connectors.
            - `urgency` string — The extent to which the incident resolution can be delayed for ServiceNow ITSM connectors.
          - `id` string — The identifier for the connector. To create a case without a connector, use `none`.
          - `name` string — The name of the connector. To create a case without a connector, use `none`.
          - `type` '.cases-webhook' | '.jira' | '.none' | '.resilient' | '.servicenow' | '.servicenow-sir' | '.swimlane' — The type of connector.
      - CasesPayloadCreateCase
        - `assignees` object[], nullable — An array containing users that are assigned to the case.
          - `uid` string, required — A unique identifier for the user profile. These identifiers can be found by using the suggest user profile API.
        - `connector` object
          - `fields` object, nullable — An object containing the connector fields. To create a case without a connector, specify null. If you want to omit any individual field, specify null as its value.
            - `caseId` string — The case identifier for Swimlane connectors.
            - `category` string — The category of the incident for ServiceNow ITSM and ServiceNow SecOps connectors.
            - `destIp` boolean, nullable — Indicates whether cases will send a comma-separated list of destination IPs for ServiceNow SecOps connectors.
            - `impact` string — The effect an incident had on business for ServiceNow ITSM connectors.
            - `issueType` string — The type of issue for Jira connectors.
            - `issueTypes` string[] — The type of incident for IBM Resilient connectors.
            - `malwareHash` boolean, nullable — Indicates whether cases will send a comma-separated list of malware hashes for ServiceNow SecOps connectors.
            - `malwareUrl` boolean, nullable — Indicates whether cases will send a comma-separated list of malware URLs for ServiceNow SecOps connectors.
            - `parent` string — The key of the parent issue, when the issue type is sub-task for Jira connectors.
            - `priority` string — The priority of the issue for Jira and ServiceNow SecOps connectors.
            - `severity` string — The severity of the incident for ServiceNow ITSM connectors.
            - `severityCode` string — The severity code of the incident for IBM Resilient connectors.
            - `sourceIp` boolean, nullable — Indicates whether cases will send a comma-separated list of source IPs for ServiceNow SecOps connectors.
            - `subcategory` string — The subcategory of the incident for ServiceNow ITSM connectors.
            - `urgency` string — The extent to which the incident resolution can be delayed for ServiceNow ITSM connectors.
          - `id` string — The identifier for the connector. To create a case without a connector, use `none`.
          - `name` string — The name of the connector. To create a case without a connector, use `none`.
          - `type` '.cases-webhook' | '.jira' | '.none' | '.resilient' | '.servicenow' | '.servicenow-sir' | '.swimlane' — The type of connector.
        - `description` string
        - `owner` 'cases' | 'observability' | 'securitySolution' — The application that owns the cases: Stack Management, Observability, or Elastic Security.
        - `settings` CasesSettings — An object that contains the case settings.
          - `extractObservables` boolean — When true, observables (e.g. IPs, hashes, URLs) are automatically extracted from case comments. Optional; defaults to false when omitted.
          - `syncAlerts` boolean, required — Turns alert syncing on or off.
        - `severity` 'critical' | 'high' | 'low' | 'medium' — The severity of the case.
        - `status` 'closed' | 'in-progress' | 'open' — The status of the case.
        - `tags` string[]
        - `title` string
      - CasesPayloadDelete, nullable — If the `action` is `delete` and the `type` is `delete_case`, the payload is nullable.
      - CasesPayloadDescription
        - `description` string
      - CasesPayloadPushed
        - `externalService` CasesExternalService, nullable
          - `connector_id` string
          - `connector_name` string
          - `external_id` string
          - `external_title` string
          - `external_url` string
          - `pushed_at` string, date-time
          - `pushed_by` object, nullable
            - `email` string, nullable
            - `full_name` string, nullable
            - `profile_uid` string
            - `username` string, nullable
      - CasesPayloadSettings
        - `settings` CasesSettings — An object that contains the case settings.
          - `extractObservables` boolean — When true, observables (e.g. IPs, hashes, URLs) are automatically extracted from case comments. Optional; defaults to false when omitted.
          - `syncAlerts` boolean, required — Turns alert syncing on or off.
      - CasesPayloadSeverity
        - `severity` 'critical' | 'high' | 'low' | 'medium' — The severity of the case.
      - CasesPayloadStatus
        - `status` 'closed' | 'in-progress' | 'open' — The status of the case.
      - CasesPayloadTags
        - `tags` string[]
      - CasesPayloadTitle
        - `title` string
      - CasesPayloadUserComment
        - `comment` object
          - `comment` string
          - `owner` 'cases' | 'observability' | 'securitySolution' — The application that owns the cases: Stack Management, Observability, or Elastic Security.
          - `type` 'user'
    - `type` 'assignees' | 'category' | 'comment' | 'connector' | 'create_case' | 'customFields' | 'delete_case' | 'description' | 'extended_fields' | 'observables' | 'pushed' | 'settings' | 'severity' | 'status' | 'tags' | 'title', required — The type of action.
    - `version` string, required

## Other responses

- `401` — Authorization information is missing or invalid.

---

[API](https://skmtc.net/elastic/apis/kibana-apis.md) · [All operations](https://skmtc.net/elastic/apis/kibana-apis/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/elastic/kibana-apis/versions/531c9e2a7d23/schema)