---
type: api
title: Get notes
description: Returns Security Timeline notes as saved objects.
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v0/operation/operation-getnotes
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v0/operation/operation-getnotes
products:
  - Kibana
---

# Get notes

- Server: `https://{kibana_url}`

## Paths

- `GET` `/api/note`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v0/authentication#apikeyauth)
- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v0/authentication#basicauth)

## Description

Returns Security Timeline notes as saved objects.

**Query modes (mutually exclusive branches on the server):**

1. **`documentIds` is set** — Returns notes whose `eventId` matches the given Elasticsearch document `_id` (single string or array). Pagination query parameters (`page`, `perPage`, etc.) are **not** applied; the server uses a fixed page size (up to 10000 notes).

2. **`savedObjectIds` is set** — Returns notes linked to the given Timeline saved object id(s). Same fixed cap as above; list-mode query parameters are **not** applied.

3. **Neither `documentIds` nor `savedObjectIds`** — Lists notes using saved-objects find semantics: `page` (default 1), `perPage` (default 10), optional `search`, `sortField`, `sortOrder`, `filter`, `createdByFilter`, and `associatedFilter`.

Requires the **Timeline and Notes** read privilege (`notes_read`).

## Query String Parameters

- `documentIds` (union)
  Event document `_id` values to match against each note's `eventId`. When this parameter is present, the response is all matching notes (up to the server's hard limit), not a paged list using `page`/`perPage`.
  One of: `string[]` or `string`
- `savedObjectIds` (union)
  Timeline `savedObjectId` value(s). Returns notes that reference those timelines. When present, list-mode pagination parameters are not used; up to the server's hard limit of notes may be returned.
  One of: `string[]` or `string`
- `page` (string)
  Page number for list mode (when `documentIds` and `savedObjectIds` are omitted). Passed as a string; default 1.
- `perPage` (string)
  Page size for list mode (when `documentIds` and `savedObjectIds` are omitted). Passed as a string; default 10.
- `search` (string)
  Search string for saved-objects find (list mode only).
- `sortField` (string)
  Field to sort by for saved-objects find (list mode only).
- `sortOrder` (string)
  Sort order (`asc` or `desc`) for saved-objects find (list mode only).
- `filter` (string)
  Kuery filter string combined with other list-mode filters (for example `createdByFilter` or `associatedFilter`). Typed as a string for API compatibility; interpreted by the saved-objects layer (list mode only).
- `createdByFilter` (string)
  Kibana user profile **UID** (UUID). The server resolves the user's display identifiers and returns notes whose `createdBy` matches any of them (list mode only).
- `associatedFilter` (enum)
  Restricts notes by how they relate to a Timeline and/or an event document (list mode only). Some values apply extra filtering after the query. Ignored when `documentIds` or `savedObjectIds` is used.
  Values: `all`, `document_only`, `saved_object_only`, `document_and_saved_object`, `orphan`

## Response

Notes and total count for the requested mode.

`application/json`

- `notes` ([] object)
  - `created` (number) — nullable
    The time the note was created, using a 13-digit Epoch timestamp.
  - `createdBy` (string) — nullable
    The user who created the note.
  - `updated` (number) — nullable
    The last time the note was updated, using a 13-digit Epoch timestamp
  - `updatedBy` (string) — nullable
    The user who last updated the note
  - `eventId` (string) — nullable
    Elasticsearch document `_id` for the event or alert this note refers to. Same value as the `documentIds` query parameter when fetching notes via GET /api/note.
  - `note` (string) — nullable
    The text of the note
  - `timelineId` (string)
    The `savedObjectId` of the Timeline this note belongs to (not the note's own ID).
  - `noteId` (string)
    The `savedObjectId` of the note
  - `version` (string)
    The version of the note
- `totalCount` (number)
  Number of notes returned (may be adjusted after the query when `associatedFilter` applies post-filtering).
## Code Examples

#### Console

```console
GET /api/note
```

#### curl

```curl
curl -X GET "https://{kibana_url}/api/note"
```

## Response Examples

#### Paged notes for a timeline

```json
{
  "notes": [
    {
      "eventId": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc",
      "note": "Escalated to tier-2 analyst",
      "noteId": "709f99c6-89b6-4953-9160-35945c8e174e",
      "timelineId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e",
      "version": "WzQ2LDFd"
    }
  ],
  "totalCount": 1
}
```