Get notes
Spaces method and path for this operation:
<div><span class="operation-verb get">get</span> <span class="operation-path">/s/{space_id}/api/note</span></div>Refer to Spaces for more information.
Returns Security Timeline notes as saved objects.
Query modes (mutually exclusive branches on the server):
-
documentIds is set — Returns notes whose eventId matches the given Elasticsearch document _id (single string or array). Pagination query parameters (page, perPage, etc.) are not applied; the server uses a fixed page size (up to 10000 notes).
-
savedObjectIds is set — Returns notes linked to the given Timeline saved object id(s). Same fixed cap as above; list-mode query parameters are not applied.
-
Neither documentIds nor savedObjectIds — Lists notes using saved-objects find semantics: page (default 1), perPage (default 10), optional search, sortField, sortOrder, filter, createdByFilter, and associatedFilter.
Requires the Timeline and Notes read privilege (notes_read).
Query parameters
Event document _id values to match against each note's eventId. When this parameter is present, the response is all matching notes (up to the server's hard limit), not a paged list using page/perPage.
Timeline savedObjectId value(s). Returns notes that reference those timelines. When present, list-mode pagination parameters are not used; up to the server's hard limit of notes may be returned.
Page number for list mode (when documentIds and savedObjectIds are omitted). Passed as a string; default 1.
Page size for list mode (when documentIds and savedObjectIds are omitted). Passed as a string; default 10.
Search string for saved-objects find (list mode only).
Field to sort by for saved-objects find (list mode only).
Sort order (asc or desc) for saved-objects find (list mode only).
Kuery filter string combined with other list-mode filters (for example createdByFilter or associatedFilter). Typed as a string for API compatibility; interpreted by the saved-objects layer (list mode only).
Kibana user profile UID (UUID). The server resolves the user's display identifiers and returns notes whose createdBy matches any of them (list mode only).
How the note is associated with a Timeline saved object and/or an event (eventId). all: no association-based restriction from this parameter. document_only: document-linked notes (non-empty eventId) without timeline association in the API's internal sense; post-filtering drops notes without a usable eventId. saved_object_only: timeline notes with no linked event (eventId empty or absent); post-filtering keeps timeline-only notes. document_and_saved_object: notes on a timeline and linked to an event; post-filtering enforces a real eventId. orphan: not on a timeline and eventId is empty (stricter than missing eventId in some cases).
Restricts notes by how they relate to a Timeline and/or an event document (list mode only). Some values apply extra filtering after the query. Ignored when documentIds or savedObjectIds is used.
Response
Notes and total count for the requested mode.
Example response
{
"notes": [
{
"created": 1587468588922,
"createdBy": "casetester",
"updated": 1741344876825,
"updatedBy": "casetester",
"eventId": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc",
"note": "This is an example text",
"timelineId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e",
"noteId": "709f99c6-89b6-4953-9160-35945c8e174e",
"version": "WzQ2LDFd"
}
]
}