Add or update a note
https://{kibana_url}
- PATCH /api/note
Creates a new note or updates an existing one.
Create: Send note and omit noteId to create a new saved object.
Update: Send note with the changed fields and set noteId to the note's saved object ID. Optionally include version for optimistic concurrency when the client has it from a prior read.
Requires the Timeline and Notes write privilege (notes_write).
Request
Body must include the note object. For updates, include noteId (and optionally version).
To attach a note to a specific event, set note.eventId to that event's document _id; for a timeline-wide note, omit or clear eventId per product rules.
-
note -
creatednumbernullable -
The time the note was created, using a 13-digit Epoch timestamp.
-
createdBystringnullable -
The user who created the note.
-
updatednumbernullable -
The last time the note was updated, using a 13-digit Epoch timestamp
-
updatedBystringnullable -
The user who last updated the note
-
eventIdstringnullable -
Elasticsearch document
_idfor the event or alert this note refers to. Same value as thedocumentIdsquery parameter when fetching notes via GET /api/note. -
notestringnullable -
The text of the note
-
timelineIdstringrequired -
The
savedObjectIdof the Timeline this note belongs to (not the note's own ID). -
noteIdstringnullable -
The
savedObjectIdof the note to update. Omit when creating a new note. -
versionstringnullable -
Saved object version string from a previous read; optional on update.
Response
The persisted note, including noteId and version.
-
note -
creatednumbernullable -
The time the note was created, using a 13-digit Epoch timestamp.
-
createdBystringnullable -
The user who created the note.
-
updatednumbernullable -
The last time the note was updated, using a 13-digit Epoch timestamp
-
updatedBystringnullable -
The user who last updated the note
-
eventIdstringnullable -
Elasticsearch document
_idfor the event or alert this note refers to. Same value as thedocumentIdsquery parameter when fetching notes via GET /api/note. -
notestringnullable -
The text of the note
-
timelineIdstringrequired -
The
savedObjectIdof the Timeline this note belongs to (not the note's own ID). -
noteIdstringrequired -
The
savedObjectIdof the note -
versionstringrequired -
The version of the note