v53

latestOpenAPI 3.0.3raw.githubusercontent.com2026-08-076771,7565.2 MB
Security Timeline API

Get notes

Spaces method and path for this operation:

<div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/note</span></div>

Refer to Spaces for more information.

Returns Security Timeline notes as saved objects.

Query modes (mutually exclusive branches on the server):

  1. documentIds is set — Returns notes whose eventId matches the given Elasticsearch document _id (single string or array). Pagination query parameters (page, perPage, etc.) are not applied; the server uses a fixed page size (up to 10000 notes).

  2. savedObjectIds is set — Returns notes linked to the given Timeline saved object id(s). Same fixed cap as above; list-mode query parameters are not applied.

  3. Neither documentIds nor savedObjectIds — Lists notes using saved-objects find semantics: page (default 1), perPage (default 10), optional search, sortField, sortOrder, filter, createdByFilter, and associatedFilter.

Requires the Timeline and Notes read privilege (notes_read).

get/api/note

Query parameters

string[]
OR
string

Event document _id values to match against each note's eventId. When this parameter is present, the response is all matching notes (up to the server's hard limit), not a paged list using page/perPage.

string[]
OR
string

Timeline savedObjectId value(s). Returns notes that reference those timelines. When present, list-mode pagination parameters are not used; up to the server's hard limit of notes may be returned.

pagestring nullable

Page number for list mode (when documentIds and savedObjectIds are omitted). Passed as a string; default 1.

perPagestring nullable

Page size for list mode (when documentIds and savedObjectIds are omitted). Passed as a string; default 10.

searchstring nullable

Search string for saved-objects find (list mode only).

sortFieldstring nullable

Field to sort by for saved-objects find (list mode only).

sortOrderstring nullable

Sort order (asc or desc) for saved-objects find (list mode only).

filterstring nullable

Kuery filter string combined with other list-mode filters (for example createdByFilter or associatedFilter). Typed as a string for API compatibility; interpreted by the saved-objects layer (list mode only).

createdByFilterstring nullable

Kibana user profile UID (UUID). The server resolves the user's display identifiers and returns notes whose createdBy matches any of them (list mode only).

associatedFilter'all' | 'document_only' | 'saved_object_only' | 'document_and_saved_object' | 'orphan'

How the note is associated with a Timeline saved object and/or an event (eventId). all: no association-based restriction from this parameter. document_only: document-linked notes (non-empty eventId) without timeline association in the API's internal sense; post-filtering drops notes without a usable eventId. saved_object_only: timeline notes with no linked event (eventId empty or absent); post-filtering keeps timeline-only notes. document_and_saved_object: notes on a timeline and linked to an event; post-filtering enforces a real eventId. orphan: not on a timeline and eventId is empty (stricter than missing eventId in some cases).

Restricts notes by how they relate to a Timeline and/or an event document (list mode only). Some values apply extra filtering after the query. Ignored when documentIds or savedObjectIds is used.

Response

Notes and total count for the requested mode.

totalCountnumber required

Number of notes returned (may be adjusted after the query when associatedFilter applies post-filtering).

Example response

{
  "notes": [
    {
      "created": 1587468588922,
      "createdBy": "casetester",
      "updated": 1741344876825,
      "updatedBy": "casetester",
      "eventId": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc",
      "note": "This is an example text",
      "timelineId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e",
      "noteId": "709f99c6-89b6-4953-9160-35945c8e174e",
      "version": "WzQ2LDFd"
    }
  ]
}