---
title: "Add or update a note"
method: PATCH
path: "/api/note"
tags: ["Security Timeline API"]
---

# Add or update a note

`PATCH /api/note`

**Spaces method and path for this operation:**

<div><span class="operation-verb patch">patch</span>&nbsp;<span class="operation-path">/s/{space_id}/api/note</span></div>

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Creates a new note or updates an existing one.

**Create:** Send `note` and omit `noteId` to create a new saved object.

**Update:** Send `note` with the changed fields and set `noteId` to the note's saved object ID. Optionally include `version` for optimistic concurrency when the client has it from a prior read.

Requires the **Timeline and Notes** write privilege (`notes_write`).

## Request body

- object
  - `note` SecurityTimelineAPIBareNote, required
    - `created` number, nullable — The time the note was created, using a 13-digit Epoch timestamp.
    - `createdBy` string, nullable — The user who created the note.
    - `updated` number, nullable — The last time the note was updated, using a 13-digit Epoch timestamp
    - `updatedBy` string, nullable — The user who last updated the note
    - `eventId` string, nullable — Elasticsearch document `_id` for the event or alert this note refers to. Same value as the `documentIds` query parameter when fetching notes via GET /api/note.
    - `note` string, nullable — The text of the note
    - `timelineId` string, required — The `savedObjectId` of the Timeline this note belongs to (not the note's own ID).
  - `noteId` string, nullable — The `savedObjectId` of the note to update. Omit when creating a new note.
  - `version` string, nullable — Saved object version string from a previous read; optional on update.

## Response `200`

The persisted note, including `noteId` and `version`.

- SecurityTimelineAPIResponseNote
  - `note` SecurityTimelineAPINote, required
    - `created` number, nullable — The time the note was created, using a 13-digit Epoch timestamp.
    - `createdBy` string, nullable — The user who created the note.
    - `updated` number, nullable — The last time the note was updated, using a 13-digit Epoch timestamp
    - `updatedBy` string, nullable — The user who last updated the note
    - `eventId` string, nullable — Elasticsearch document `_id` for the event or alert this note refers to. Same value as the `documentIds` query parameter when fetching notes via GET /api/note.
    - `note` string, nullable — The text of the note
    - `timelineId` string, required — The `savedObjectId` of the Timeline this note belongs to (not the note's own ID).
    - `noteId` string, required — The `savedObjectId` of the note
    - `version` string, required — The version of the note

---

[API](https://skmtc.net/elastic/apis/kibana-apis.md) · [All operations](https://skmtc.net/elastic/apis/kibana-apis/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/elastic/kibana-apis/versions/531c9e2a7d23/schema)