---
title: "Get notes"
method: GET
path: "/api/note"
tags: ["Security Timeline API"]
---

# Get notes

`GET /api/note`

**Spaces method and path for this operation:**

<div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/note</span></div>

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Returns Security Timeline notes as saved objects.

**Query modes (mutually exclusive branches on the server):**

1. **`documentIds` is set** — Returns notes whose `eventId` matches the given Elasticsearch document `_id` (single string or array). Pagination query parameters (`page`, `perPage`, etc.) are **not** applied; the server uses a fixed page size (up to 10000 notes).

2. **`savedObjectIds` is set** — Returns notes linked to the given Timeline saved object id(s). Same fixed cap as above; list-mode query parameters are **not** applied.

3. **Neither `documentIds` nor `savedObjectIds`** — Lists notes using saved-objects find semantics: `page` (default 1), `perPage` (default 10), optional `search`, `sortField`, `sortOrder`, `filter`, `createdByFilter`, and `associatedFilter`.

Requires the **Timeline and Notes** read privilege (`notes_read`).

## Query parameters

- `documentIds` union — One document ID or an array of IDs (Elasticsearch `_id` of the event).
  - string[]
  - string
- `savedObjectIds` union — One Timeline saved object ID or an array of IDs.
  - string[]
  - string
- `page` string, nullable
- `perPage` string, nullable
- `search` string, nullable
- `sortField` string, nullable
- `sortOrder` string, nullable
- `filter` string, nullable
- `createdByFilter` string, nullable
- `associatedFilter` 'all' | 'document_only' | 'saved_object_only' | 'document_and_saved_object' | 'orphan' — How the note is associated with a Timeline saved object and/or an event (`eventId`). `all`: no association-based restriction from this parameter. `document_only`: document-linked notes (non-empty `eventId`) without timeline association in the API's internal sense; post-filtering drops notes without a usable `eventId`. `saved_object_only`: timeline notes with no linked event (`eventId` empty or absent); post-filtering keeps timeline-only notes. `document_and_saved_object`: notes on a timeline and linked to an event; post-filtering enforces a real `eventId`. `orphan`: not on a timeline and `eventId` is empty (stricter than missing `eventId` in some cases).

## Response `200`

Notes and total count for the requested mode.

- SecurityTimelineAPIGetNotesResult
  - `notes` SecurityTimelineAPINote[], required
    - `created` number, nullable — The time the note was created, using a 13-digit Epoch timestamp.
    - `createdBy` string, nullable — The user who created the note.
    - `updated` number, nullable — The last time the note was updated, using a 13-digit Epoch timestamp
    - `updatedBy` string, nullable — The user who last updated the note
    - `eventId` string, nullable — Elasticsearch document `_id` for the event or alert this note refers to. Same value as the `documentIds` query parameter when fetching notes via GET /api/note.
    - `note` string, nullable — The text of the note
    - `timelineId` string, required — The `savedObjectId` of the Timeline this note belongs to (not the note's own ID).
    - `noteId` string, required — The `savedObjectId` of the note
    - `version` string, required — The version of the note
  - `totalCount` number, required — Number of notes returned (may be adjusted after the query when `associatedFilter` applies post-filtering).

---

[API](https://skmtc.net/elastic/apis/kibana-apis.md) · [All operations](https://skmtc.net/elastic/apis/kibana-apis/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/elastic/kibana-apis/versions/531c9e2a7d23/schema)