---
type: api
title: Find case activity
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/operation/operation-findcaseactivitydefaultspace
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/operation/operation-findcaseactivitydefaultspace
products:
  - Kibana
---

# Find case activity

- Server: `https://{kibana_url}`

## Paths

- `GET` `/api/cases/{caseId}/user_actions/_find`
- `GET` `/s/{space_id}/api/cases/{caseId}/user_actions/_find`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana/authentication#apikeyauth)
- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/kibana/authentication#basicauth)

#### Path Parameters

- `caseId` (string)
  The identifier for the case. To retrieve case IDs, use the search cases (`_find)` API. All non-ASCII characters must be URL encoded.

## Description

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Retrieves a paginated list of user activity for a case. You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you're seeking.

## Query String Parameters

- `page` (integer · default: 1)
  The page number to return.
- `perPage` (integer · max: 100 · default: 20)
  The number of items to return. Limited to 100 items.
- `sortOrder` (enum  · default: desc)
  Determines the sort order.
  Values: `asc`, `desc`
- `types` ([] enum)
  Determines the types of user actions to return.
  Values: `action`, `alert`, `assignees`, `attachment`, `comment`, `connector`, `create_case`, `description`, `pushed`, `settings`, `severity`, `status`, `tags`, `title`, `user`, `workflow`

## Responses

#### `200`

Indicates a successful call.

`application/json`

- `page` (integer)
- `perPage` (integer)
- `total` (integer)
- `userActions` ([] object · max: 10000)
  - `action` (enum)
    Values: `add`, `create`, `delete`, `push_to_service`, `update`
  - `comment_id` (string) — nullable
  - `created_at` (string)
  - `created_by` (object)
    - `email` (string) — nullable
    - `full_name` (string) — nullable
    - `profile_uid` (string)
    - `username` (string) — nullable
  - `id` (string)
  - `owner` (enum)
    The application that owns the cases: Stack Management, Observability, or Elastic Security.
    Values: `cases`, `observability`, `securitySolution`
  - `payload` (union oneOf) — nullable
    - **Cases_payload_alert_comment**
      - `comment` (object)
        - `alertId` (union string | [] string)
        - `index` (union string | [] string)
        - `owner` (enum)
          The application that owns the cases: Stack Management, Observability, or Elastic Security.
          Values: `cases`, `observability`, `securitySolution`
        - `rule` (object)
          - `id` (string) — nullable
            The rule identifier.
          - `name` (string) — nullable
            The rule name.
        - `type` (enum)
          Values: `alert`
    - **Cases_payload_assignees**
      - `assignees` ([] null · max: 10) — nullable
        An array containing users that are assigned to the case.
        - `uid` (string)
          A unique identifier for the user profile. These identifiers can be found by using the suggest user profile API.
    - **Cases_payload_connector**
      - `connector` (object)
        - `fields` (object) — nullable
          An object containing the connector fields. To create a case without a connector, specify null. If you want to omit any individual field, specify null as its value.
          - `caseId` (string)
            The case identifier for Swimlane connectors.
          - `category` (string)
            The category of the incident for ServiceNow ITSM and ServiceNow SecOps connectors.
          - `destIp` (boolean) — nullable
            Indicates whether cases will send a comma-separated list of destination IPs for ServiceNow SecOps connectors.
          - `impact` (string)
            The effect an incident had on business for ServiceNow ITSM connectors.
          - `issueType` (string)
            The type of issue for Jira connectors.
          - `issueTypes` ([] string)
            The type of incident for IBM Resilient connectors.
          - `malwareHash` (boolean) — nullable
            Indicates whether cases will send a comma-separated list of malware hashes for ServiceNow SecOps connectors.
          - `malwareUrl` (boolean) — nullable
            Indicates whether cases will send a comma-separated list of malware URLs for ServiceNow SecOps connectors.
          - `parent` (string)
            The key of the parent issue, when the issue type is sub-task for Jira connectors.
          - `priority` (string)
            The priority of the issue for Jira and ServiceNow SecOps connectors.
          - `severity` (string)
            The severity of the incident for ServiceNow ITSM connectors.
          - `severityCode` (string)
            The severity code of the incident for IBM Resilient connectors.
          - `sourceIp` (boolean) — nullable
            Indicates whether cases will send a comma-separated list of source IPs for ServiceNow SecOps connectors.
          - `subcategory` (string)
            The subcategory of the incident for ServiceNow ITSM connectors.
          - `urgency` (string)
            The extent to which the incident resolution can be delayed for ServiceNow ITSM connectors.
        - `id` (string)
          The identifier for the connector. To create a case without a connector, use `none`.
        - `name` (string)
          The name of the connector. To create a case without a connector, use `none`.
        - `type` (enum)
          The type of connector.
          Values: `.cases-webhook`, `.jira`, `.none`, `.resilient`, `.servicenow`, `.servicenow-sir`, `.swimlane`
    - **Cases_payload_create_case**
      - `assignees` ([] null · max: 10) — nullable
        An array containing users that are assigned to the case.
        - `uid` (string)
          A unique identifier for the user profile. These identifiers can be found by using the suggest user profile API.
      - `connector` (object)
        - `fields` (object) — nullable
          An object containing the connector fields. To create a case without a connector, specify null. If you want to omit any individual field, specify null as its value.
          - `caseId` (string)
            The case identifier for Swimlane connectors.
          - `category` (string)
            The category of the incident for ServiceNow ITSM and ServiceNow SecOps connectors.
          - `destIp` (boolean) — nullable
            Indicates whether cases will send a comma-separated list of destination IPs for ServiceNow SecOps connectors.
          - `impact` (string)
            The effect an incident had on business for ServiceNow ITSM connectors.
          - `issueType` (string)
            The type of issue for Jira connectors.
          - `issueTypes` ([] string)
            The type of incident for IBM Resilient connectors.
          - `malwareHash` (boolean) — nullable
            Indicates whether cases will send a comma-separated list of malware hashes for ServiceNow SecOps connectors.
          - `malwareUrl` (boolean) — nullable
            Indicates whether cases will send a comma-separated list of malware URLs for ServiceNow SecOps connectors.
          - `parent` (string)
            The key of the parent issue, when the issue type is sub-task for Jira connectors.
          - `priority` (string)
            The priority of the issue for Jira and ServiceNow SecOps connectors.
          - `severity` (string)
            The severity of the incident for ServiceNow ITSM connectors.
          - `severityCode` (string)
            The severity code of the incident for IBM Resilient connectors.
          - `sourceIp` (boolean) — nullable
            Indicates whether cases will send a comma-separated list of source IPs for ServiceNow SecOps connectors.
          - `subcategory` (string)
            The subcategory of the incident for ServiceNow ITSM connectors.
          - `urgency` (string)
            The extent to which the incident resolution can be delayed for ServiceNow ITSM connectors.
        - `id` (string)
          The identifier for the connector. To create a case without a connector, use `none`.
        - `name` (string)
          The name of the connector. To create a case without a connector, use `none`.
        - `type` (enum)
          The type of connector.
          Values: `.cases-webhook`, `.jira`, `.none`, `.resilient`, `.servicenow`, `.servicenow-sir`, `.swimlane`
      - `description` (string)
      - `owner` (enum)
        The application that owns the cases: Stack Management, Observability, or Elastic Security.
        Values: `cases`, `observability`, `securitySolution`
      - `settings` ({})
        An object that contains the case settings.
        - `extractObservables` (boolean)
          When true, observables (for example, IPs, hashes, and URLs) are automatically extracted from case comments. When omitted on create, the space configuration default is used. Falls back to the owner's default when no space configuration exists: `true` for Security, `false` for Stack and Observability. Precedence: explicit value > template setting > space config > owner default. For owners that do not support observable extraction (currently Observability), an omitted value resolves to `false` regardless of the space configuration.
        - `syncAlerts` (boolean)
          Turns alert syncing on or off.
      - `severity` (enum)
        The severity of the case.
        Values: `critical`, `high`, `low`, `medium`
      - `status` (enum)
        The status of the case.
        Values: `closed`, `in-progress`, `open`
      - `tags` ([] string)
      - `title` (string)
    - **Cases_payload_delete**
      If the `action` is `delete` and the `type` is `delete_case`, the payload is nullable.
    - **Cases_payload_description**
      - `description` (string)
    - **Cases_payload_pushed**
      - `externalService` ({}) — nullable
        - `connector_id` (string)
        - `connector_name` (string)
        - `external_id` (string)
        - `external_title` (string)
        - `external_url` (string)
        - `pushed_at` (string)
        - `pushed_by` (object) — nullable
          - `email` (string) — nullable
          - `full_name` (string) — nullable
          - `profile_uid` (string)
          - `username` (string) — nullable
    - **Cases_payload_settings**
      - `settings` ({})
        An object that contains the case settings.
        - `extractObservables` (boolean)
          When true, observables (for example, IPs, hashes, and URLs) are automatically extracted from case comments. When omitted on create, the space configuration default is used. Falls back to the owner's default when no space configuration exists: `true` for Security, `false` for Stack and Observability. Precedence: explicit value > template setting > space config > owner default. For owners that do not support observable extraction (currently Observability), an omitted value resolves to `false` regardless of the space configuration.
        - `syncAlerts` (boolean)
          Turns alert syncing on or off.
    - **Cases_payload_severity**
      - `severity` (enum)
        The severity of the case.
        Values: `critical`, `high`, `low`, `medium`
    - **Cases_payload_status**
      - `status` (enum)
        The status of the case.
        Values: `closed`, `in-progress`, `open`
    - **Cases_payload_tags**
      - `tags` ([] string)
    - **Cases_payload_title**
      - `title` (string)
    - **Cases_payload_user_comment**
      - `comment` (object)
        - `comment` (string)
        - `owner` (enum)
          The application that owns the cases: Stack Management, Observability, or Elastic Security.
          Values: `cases`, `observability`, `securitySolution`
        - `type` (enum)
          Values: `user`
    - **Cases_payload_workflow**
      The payload for a workflow user action, recorded when a user runs a workflow from a case.
      - `origin` (union oneOf)
        The context from which the workflow was triggered.
        - **type: cases.case**
          - `id` (string)
            The case ID.
          - `type` (enum)
            Values: `cases.case`
        - **type: cases.observable**
          - `id` (string)
            The observable ID.
          - `type` (enum)
            Values: `cases.observable`
          - `typeKey` (string)
            The observable type key.
          - `value` (string)
            The observable value.
        - **type: cases.observables**
          - `count` (number)
            The number of selected observables.
          - `id` (string)
            The case ID.
          - `type` (enum)
            Values: `cases.observables`
        - **type: cases.attachment**
          - `attachmentType` (string)
            The normalized registered attachment type.
          - `id` (string)
            The attachment target ID.
          - `index` (string)
            The Elasticsearch index the target document lives in.
          - `type` (enum)
            Values: `cases.attachment`
        - **type: cases.attachments**
          - `attachmentType` (string)
            The normalized registered attachment type.
          - `count` (number)
            The number of selected attachment targets.
          - `id` (string)
            The case ID.
          - `type` (enum)
            Values: `cases.attachments`
      - `workflow` (object)
        Identifies the workflow that was run.
        - `executionId` (string)
          The execution ID returned by the Workflows engine.
        - `id` (string)
          The workflow ID.
        - `name` (string)
          The workflow name at the time the run was triggered.
  - `type` (enum)
    The type of action.
    Values: `assignees`, `category`, `comment`, `connector`, `create_case`, `customFields`, `delete_case`, `description`, `extended_fields`, `observables`, `pushed`, `settings`, `severity`, `status`, `tags`, `title`, `workflow`
  - `version` (string)
#### `401`

Authorization information is missing or invalid.

`application/json`

- `error` (string)
- `message` (string)
- `statusCode` (integer)
## Code Examples

#### Console

```console
GET /api/cases/{caseId}/user_actions/_find
```

#### curl

```curl
curl -X GET "https://{kibana_url}/api/cases/{caseId}/user_actions/_find"
```

## Response Examples

#### Retrieves all activity for a case

```json
{
  "page": 1,
  "perPage": 20,
  "total": 3,
  "userActions": [
    {
      "action": "create",
      "comment_id": "null",
      "created_at": "2023-10-20T01:17:22.150Z",
      "created_by": {
        "email": "null",
        "full_name": "null",
        "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
        "username": "elastic"
      },
      "id": "b4cd0770-07c9-11ed-a5fd-47154cb8767e",
      "owner": "cases",
      "payload": {
        "assignees": [],
        "category": "null",
        "connector": {
          "fields": "null",
          "id": "none",
          "name": "none",
          "type": ".none"
        },
        "customFields": [
          {
            "key": "d312efda-ec2b-42ec-9e2c-84981795c581",
            "type": "text",
            "value": "My field value"
          },
          {
            "key": "fcc6840d-eb14-42df-8aaf-232201a705ec",
            "type": "toggle",
            "value": "null"
          }
        ],
        "description": "A case description.",
        "owner": "cases",
        "settings": {
          "syncAlerts": false
        },
        "severity": "low",
        "status": "open",
        "tags": [
          "tag 1"
        ],
        "title": "Case title 1"
      },
      "type": "create_case",
      "version": "WzM1ODg4LDFd"
    },
    {
      "action": "create",
      "comment_id": "578608d0-03b1-11ed-920c-974bfa104448",
      "created_at": "2023-10-14T20:12:53.354Z",
      "created_by": {
        "email": "null",
        "full_name": "null",
        "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
        "username": "elastic"
      },
      "id": "57af14a0-03b1-11ed-920c-974bfa104448",
      "owner": "cases",
      "payload": {
        "comment": {
          "comment": "A new comment",
          "owner": "cases",
          "type": "user"
        }
      },
      "type": "comment",
      "version": "WzM1ODg4LDFa"
    },
    {
      "action": "add",
      "comment_id": "null",
      "created_at": "2023-10-20T01:10:28.238Z",
      "created_by": {
        "email": "null",
        "full_name": "null",
        "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
        "username": "elastic"
      },
      "id": "573c6980-6123-11ed-aa41-81a0a61fe447",
      "owner": "cases",
      "payload": {
        "assignees": [
          {
            "uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0"
          }
        ]
      },
      "type": "assignees",
      "version": "WzM1ODg4LDFb"
    }
  ]
}
```

#### Authorization information is missing or invalid.

```json
{
  "error": "Unauthorized",
  "message": "Unable to authenticate with the provided credentials.",
  "statusCode": 401
}
```