--- title: "Get draft Timeline or Timeline template details" method: GET path: "/api/timeline/_draft" tags: ["Security Timeline API"] --- # Get draft Timeline or Timeline template details `GET /api/timeline/_draft` **Spaces method and path for this operation:**
get /s/{space_id}/api/timeline/_draft
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information. Get the details of the draft Timeline or Timeline template for the current user. If the user doesn't have a draft Timeline, an empty Timeline is returned. ## Query parameters - `timelineType` 'default' | 'template', required — The type of Timeline. ## Response `200` Indicates a successful call. - SecurityTimelineAPITimelineResponse - `columns` SecurityTimelineAPIColumnHeaderResult[], nullable — The Timeline's columns - `aggregatable` boolean, nullable - `category` string, nullable - `columnHeaderType` string, nullable - `description` string, nullable - `example` string, nullable - `id` string, nullable - `indexes` string[], nullable - `name` string, nullable - `placeholder` string, nullable - `searchable` boolean, nullable - `type` string, nullable - `created` number, nullable — The time the Timeline was created, using a 13-digit Epoch timestamp. - `createdBy` string, nullable — The user who created the Timeline. - `dataProviders` SecurityTimelineAPIDataProviderResult[], nullable — Object containing query clauses - `and` SecurityTimelineAPIDataProviderQueryMatch[], nullable - `enabled` boolean, nullable - `excluded` boolean, nullable - `id` string, nullable - `kqlQuery` string, nullable - `name` string, nullable - `queryMatch` SecurityTimelineAPIQueryMatchResult - `displayField` string, nullable - `displayValue` string, nullable - `field` string, nullable - `operator` string, nullable - `value` union - string, nullable - string[], nullable - `type` 'default' | 'template' — The type of data provider. - `enabled` boolean, nullable - `excluded` boolean, nullable - `id` string, nullable - `kqlQuery` string, nullable - `name` string, nullable - `queryMatch` SecurityTimelineAPIQueryMatchResult - `displayField` string, nullable - `displayValue` string, nullable - `field` string, nullable - `operator` string, nullable - `value` union - string, nullable - string[], nullable - `type` 'default' | 'template' — The type of data provider. - `dataViewId` string, nullable — ID of the Timeline's Data View - `dateRange` object, nullable — The Timeline's search period. - `end` union - string, nullable - number, nullable - `start` union - string, nullable - number, nullable - `description` string, nullable — The Timeline's description - `eqlOptions` object, nullable — EQL query that is used in the correlation tab - `eventCategoryField` string, nullable - `query` string, nullable - `size` union - string, nullable - number, nullable - `tiebreakerField` string, nullable - `timestampField` string, nullable - `eventType` string, nullable — Event types displayed in the Timeline - `excludedRowRendererIds` SecurityTimelineAPIRowRendererId[], nullable — A list of row renderers that should not be used when in `Event renderers` mode - `favorite` SecurityTimelineAPIFavoriteTimelineResult[], nullable - `favoriteDate` number, nullable - `fullName` string, nullable - `userName` string, nullable - `filters` SecurityTimelineAPIFilterTimelineResult[], nullable — A list of filters that should be applied to the query - `exists` string, nullable - `match_all` string, nullable - `meta` object, nullable - `alias` string, nullable - `controlledBy` string, nullable - `disabled` boolean, nullable - `field` string, nullable - `formattedValue` string, nullable - `index` string, nullable - `key` string, nullable - `negate` boolean, nullable - `params` string, nullable - `type` string, nullable - `value` string, nullable - `missing` string, nullable - `query` string, nullable - `range` string, nullable - `script` string, nullable - `indexNames` string[], nullable — A list of index names to use in the query (e.g. when the default data view has been modified) - `kqlMode` string, nullable — Indicates whether the KQL bar filters the query results or searches for additional results, where: * `filter`: filters query results * `search`: displays additional search results - `kqlQuery` SecurityTimelineAPISerializedFilterQueryResult — KQL bar query. - `filterQuery` object, nullable - `kuery` object, nullable - `expression` string, nullable - `kind` string, nullable - `serializedQuery` string, nullable - `savedQueryId` string, nullable — The ID of the saved query that might be used in the Query tab - `savedSearchId` string, nullable — The ID of the saved search that is used in the ES|QL tab - `sort` union - SecurityTimelineAPISortObject — Object indicating how rows are sorted in the Timeline's grid - `columnId` string, nullable - `columnType` string, nullable - `sortDirection` string, nullable - SecurityTimelineAPISortObject[] - `columnId` string, nullable - `columnType` string, nullable - `sortDirection` string, nullable - `status` 'active' | 'draft' | 'immutable' — The status of the Timeline. - `templateTimelineId` string, nullable — A unique ID (UUID) for Timeline templates. For Timelines, the value is `null`. - `templateTimelineVersion` number, nullable — Timeline template version number. For Timelines, the value is `null`. - `timelineType` 'default' | 'template' — The type of Timeline. - `title` string, nullable — The Timeline's title. - `updated` number, nullable — The last time the Timeline was updated, using a 13-digit Epoch timestamp - `updatedBy` string, nullable — The user who last updated the Timeline - `savedObjectId` string, required — The `savedObjectId` of the Timeline or Timeline template - `version` string, required — The version of the Timeline or Timeline template - `eventIdToNoteIds` SecurityTimelineAPINote[], nullable — A list of all the notes that are associated to this Timeline. - `created` number, nullable — The time the note was created, using a 13-digit Epoch timestamp. - `createdBy` string, nullable — The user who created the note. - `updated` number, nullable — The last time the note was updated, using a 13-digit Epoch timestamp - `updatedBy` string, nullable — The user who last updated the note - `eventId` string, nullable — Elasticsearch document `_id` for the event or alert this note refers to. Same value as the `documentIds` query parameter when fetching notes via GET /api/note. - `note` string, nullable — The text of the note - `timelineId` string, required — The `savedObjectId` of the Timeline this note belongs to (not the note's own ID). - `noteId` string, required — The `savedObjectId` of the note - `version` string, required — The version of the note - `noteIds` string[], nullable — A list of all the ids of notes that are associated to this Timeline. - `notes` SecurityTimelineAPINote[], nullable — A list of all the notes that are associated to this Timeline. - `created` number, nullable — The time the note was created, using a 13-digit Epoch timestamp. - `createdBy` string, nullable — The user who created the note. - `updated` number, nullable — The last time the note was updated, using a 13-digit Epoch timestamp - `updatedBy` string, nullable — The user who last updated the note - `eventId` string, nullable — Elasticsearch document `_id` for the event or alert this note refers to. Same value as the `documentIds` query parameter when fetching notes via GET /api/note. - `note` string, nullable — The text of the note - `timelineId` string, required — The `savedObjectId` of the Timeline this note belongs to (not the note's own ID). - `noteId` string, required — The `savedObjectId` of the note - `version` string, required — The version of the note - `pinnedEventIds` string[], nullable — A list of all the ids of pinned events that are associated to this Timeline. - `pinnedEventsSaveObject` SecurityTimelineAPIPinnedEvent[], nullable — A list of all the pinned events that are associated to this Timeline. - `created` number, nullable — The time the pinned event was created, using a 13-digit Epoch timestamp. - `createdBy` string, nullable — The user who created the pinned event. - `updated` number, nullable — The last time the pinned event was updated, using a 13-digit Epoch timestamp - `updatedBy` string, nullable — The user who last updated the pinned event - `eventId` string, required — The `_id` of the associated event for this pinned event. - `timelineId` string, required — The `savedObjectId` of the timeline that this pinned event is associated with - `pinnedEventId` string, required — The `savedObjectId` of this pinned event - `version` string, required — The version of this pinned event ## Other responses - `403` — If a draft Timeline was not found and we attempted to create one, it indicates that the user does not have the required permissions to create a draft Timeline. - `409` — This should never happen, but if a draft Timeline was not found and we attempted to create one, it indicates that there is already a draft Timeline with the given `timelineId`. --- [API](https://skmtc.net/elastic/apis/kibana-apis.md) · [All operations](https://skmtc.net/elastic/apis/kibana-apis/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/elastic/kibana-apis/versions/531c9e2a7d23/schema)