--- title: "Resolve a Timeline or Timeline template" method: GET path: "/api/timeline/resolve" tags: ["Security Timeline API"] --- # Resolve a Timeline or Timeline template `GET /api/timeline/resolve` **Spaces method and path for this operation:**
get /s/{space_id}/api/timeline/resolve
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information. Resolve a Timeline or Timeline template, surfacing outcomes such as `exactMatch`, `aliasMatch`, or `conflict` when object IDs have been remapped during upgrades or imports. Provide **either** `id` for default Timelines or `template_timeline_id` for templates. ## Query parameters - `template_timeline_id` string - `id` string ## Response `200` Indicates a successful call. - SecurityTimelineAPIResolvedTimeline - `alias_purpose` 'savedObjectConversion' | 'savedObjectImport' - `alias_target_id` string - `outcome` 'exactMatch' | 'aliasMatch' | 'conflict', required - `timeline` SecurityTimelineAPITimelineSavedToReturnObject, required - `columns` SecurityTimelineAPIColumnHeaderResult[], nullable — The Timeline's columns - `aggregatable` boolean, nullable - `category` string, nullable - `columnHeaderType` string, nullable - `description` string, nullable - `example` string, nullable - `id` string, nullable - `indexes` string[], nullable - `name` string, nullable - `placeholder` string, nullable - `searchable` boolean, nullable - `type` string, nullable - `created` number, nullable — The time the Timeline was created, using a 13-digit Epoch timestamp. - `createdBy` string, nullable — The user who created the Timeline. - `dataProviders` SecurityTimelineAPIDataProviderResult[], nullable — Object containing query clauses - `and` SecurityTimelineAPIDataProviderQueryMatch[], nullable - `enabled` boolean, nullable - `excluded` boolean, nullable - `id` string, nullable - `kqlQuery` string, nullable - `name` string, nullable - `queryMatch` SecurityTimelineAPIQueryMatchResult - `displayField` string, nullable - `displayValue` string, nullable - `field` string, nullable - `operator` string, nullable - `value` union - string, nullable - string[], nullable - `type` 'default' | 'template' — The type of data provider. - `enabled` boolean, nullable - `excluded` boolean, nullable - `id` string, nullable - `kqlQuery` string, nullable - `name` string, nullable - `queryMatch` SecurityTimelineAPIQueryMatchResult - `displayField` string, nullable - `displayValue` string, nullable - `field` string, nullable - `operator` string, nullable - `value` union - string, nullable - string[], nullable - `type` 'default' | 'template' — The type of data provider. - `dataViewId` string, nullable — ID of the Timeline's Data View - `dateRange` object, nullable — The Timeline's search period. - `end` union - string, nullable - number, nullable - `start` union - string, nullable - number, nullable - `description` string, nullable — The Timeline's description - `eqlOptions` object, nullable — EQL query that is used in the correlation tab - `eventCategoryField` string, nullable - `query` string, nullable - `size` union - string, nullable - number, nullable - `tiebreakerField` string, nullable - `timestampField` string, nullable - `eventType` string, nullable — Event types displayed in the Timeline - `excludedRowRendererIds` SecurityTimelineAPIRowRendererId[], nullable — A list of row renderers that should not be used when in `Event renderers` mode - `favorite` SecurityTimelineAPIFavoriteTimelineResult[], nullable - `favoriteDate` number, nullable - `fullName` string, nullable - `userName` string, nullable - `filters` SecurityTimelineAPIFilterTimelineResult[], nullable — A list of filters that should be applied to the query - `exists` string, nullable - `match_all` string, nullable - `meta` object, nullable - `alias` string, nullable - `controlledBy` string, nullable - `disabled` boolean, nullable - `field` string, nullable - `formattedValue` string, nullable - `index` string, nullable - `key` string, nullable - `negate` boolean, nullable - `params` string, nullable - `type` string, nullable - `value` string, nullable - `missing` string, nullable - `query` string, nullable - `range` string, nullable - `script` string, nullable - `indexNames` string[], nullable — A list of index names to use in the query (e.g. when the default data view has been modified) - `kqlMode` string, nullable — Indicates whether the KQL bar filters the query results or searches for additional results, where: * `filter`: filters query results * `search`: displays additional search results - `kqlQuery` SecurityTimelineAPISerializedFilterQueryResult — KQL bar query. - `filterQuery` object, nullable - `kuery` object, nullable - `expression` string, nullable - `kind` string, nullable - `serializedQuery` string, nullable - `savedQueryId` string, nullable — The ID of the saved query that might be used in the Query tab - `savedSearchId` string, nullable — The ID of the saved search that is used in the ES|QL tab - `sort` union - SecurityTimelineAPISortObject — Object indicating how rows are sorted in the Timeline's grid - `columnId` string, nullable - `columnType` string, nullable - `sortDirection` string, nullable - SecurityTimelineAPISortObject[] - `columnId` string, nullable - `columnType` string, nullable - `sortDirection` string, nullable - `status` 'active' | 'draft' | 'immutable' — The status of the Timeline. - `templateTimelineId` string, nullable — A unique ID (UUID) for Timeline templates. For Timelines, the value is `null`. - `templateTimelineVersion` number, nullable — Timeline template version number. For Timelines, the value is `null`. - `timelineType` 'default' | 'template' — The type of Timeline. - `title` string, nullable — The Timeline's title. - `updated` number, nullable — The last time the Timeline was updated, using a 13-digit Epoch timestamp - `updatedBy` string, nullable — The user who last updated the Timeline - `eventIdToNoteIds` SecurityTimelineAPINote[], nullable - `created` number, nullable — The time the note was created, using a 13-digit Epoch timestamp. - `createdBy` string, nullable — The user who created the note. - `updated` number, nullable — The last time the note was updated, using a 13-digit Epoch timestamp - `updatedBy` string, nullable — The user who last updated the note - `eventId` string, nullable — Elasticsearch document `_id` for the event or alert this note refers to. Same value as the `documentIds` query parameter when fetching notes via GET /api/note. - `note` string, nullable — The text of the note - `timelineId` string, required — The `savedObjectId` of the Timeline this note belongs to (not the note's own ID). - `noteId` string, required — The `savedObjectId` of the note - `version` string, required — The version of the note - `noteIds` string[], nullable - `notes` SecurityTimelineAPINote[], nullable - `created` number, nullable — The time the note was created, using a 13-digit Epoch timestamp. - `createdBy` string, nullable — The user who created the note. - `updated` number, nullable — The last time the note was updated, using a 13-digit Epoch timestamp - `updatedBy` string, nullable — The user who last updated the note - `eventId` string, nullable — Elasticsearch document `_id` for the event or alert this note refers to. Same value as the `documentIds` query parameter when fetching notes via GET /api/note. - `note` string, nullable — The text of the note - `timelineId` string, required — The `savedObjectId` of the Timeline this note belongs to (not the note's own ID). - `noteId` string, required — The `savedObjectId` of the note - `version` string, required — The version of the note - `pinnedEventIds` string[], nullable - `pinnedEventsSaveObject` SecurityTimelineAPIPinnedEvent[], nullable - `created` number, nullable — The time the pinned event was created, using a 13-digit Epoch timestamp. - `createdBy` string, nullable — The user who created the pinned event. - `updated` number, nullable — The last time the pinned event was updated, using a 13-digit Epoch timestamp - `updatedBy` string, nullable — The user who last updated the pinned event - `eventId` string, required — The `_id` of the associated event for this pinned event. - `timelineId` string, required — The `savedObjectId` of the timeline that this pinned event is associated with - `pinnedEventId` string, required — The `savedObjectId` of this pinned event - `version` string, required — The version of this pinned event - `savedObjectId` string, required - `version` string, required ## Other responses - `400` — Bad Request response. - `404` — The (template) Timeline was not found --- [API](https://skmtc.net/elastic/apis/kibana-apis.md) · [All operations](https://skmtc.net/elastic/apis/kibana-apis/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/elastic/kibana-apis/versions/531c9e2a7d23/schema)