--- type: api title: Get case activity description: **Spaces method and path for this operation:** url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v8/operation/operation-getcaseactivitydefaultspace resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v8/operation/operation-getcaseactivitydefaultspace products: - Kibana --- # Get case activity deprecated - Server: `https://{kibana_url}` ## Paths - `GET` `/api/cases/{caseId}/user_actions` - `GET` `/s/{space_id}/api/cases/{caseId}/user_actions` - [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v8/authentication#apikeyauth) - [Basic auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v8/authentication#basicauth) #### Path Parameters - `caseId` (string) The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded. ## Description Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information. Returns all user activity for a case. Deprecated in 8.1.0. This API is deprecated and will be removed in a future release; use the find user actions API instead. You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you're seeking. ## Responses #### `200` Indicates a successful call. `application/json` Type: `[] object` - `action` (enum) Values: `add`, `create`, `delete`, `push_to_service`, `update` - `action_id` (string) - `case_id` (string) - `comment_id` (string) — nullable - `created_at` (string) - `created_by` (object) - `email` (string) — nullable - `full_name` (string) — nullable - `profile_uid` (string) - `username` (string) — nullable - `owner` (enum) The application that owns the cases: Stack Management, Observability, or Elastic Security. Values: `cases`, `observability`, `securitySolution` - `payload` (union oneOf) — nullable - **Cases_payload_alert_comment** - `comment` (object) - `alertId` (union string | [] string) - `index` (union string | [] string) - `owner` (enum) The application that owns the cases: Stack Management, Observability, or Elastic Security. Values: `cases`, `observability`, `securitySolution` - `rule` (object) - `id` (string) The rule identifier. - `name` (string) The rule name. - `type` (enum) Values: `alert` - **Cases_payload_assignees** - `assignees` ([] null · max: 10) — nullable An array containing users that are assigned to the case. - `uid` (string) A unique identifier for the user profile. These identifiers can be found by using the suggest user profile API. - **Cases_payload_connector** - `connector` (object) - `fields` (object) — nullable An object containing the connector fields. To create a case without a connector, specify null. If you want to omit any individual field, specify null as its value. - `caseId` (string) The case identifier for Swimlane connectors. - `category` (string) The category of the incident for ServiceNow ITSM and ServiceNow SecOps connectors. - `destIp` (boolean) — nullable Indicates whether cases will send a comma-separated list of destination IPs for ServiceNow SecOps connectors. - `impact` (string) The effect an incident had on business for ServiceNow ITSM connectors. - `issueType` (string) The type of issue for Jira connectors. - `issueTypes` ([] string) The type of incident for IBM Resilient connectors. - `malwareHash` (boolean) — nullable Indicates whether cases will send a comma-separated list of malware hashes for ServiceNow SecOps connectors. - `malwareUrl` (boolean) — nullable Indicates whether cases will send a comma-separated list of malware URLs for ServiceNow SecOps connectors. - `parent` (string) The key of the parent issue, when the issue type is sub-task for Jira connectors. - `priority` (string) The priority of the issue for Jira and ServiceNow SecOps connectors. - `severity` (string) The severity of the incident for ServiceNow ITSM connectors. - `severityCode` (string) The severity code of the incident for IBM Resilient connectors. - `sourceIp` (boolean) — nullable Indicates whether cases will send a comma-separated list of source IPs for ServiceNow SecOps connectors. - `subcategory` (string) The subcategory of the incident for ServiceNow ITSM connectors. - `urgency` (string) The extent to which the incident resolution can be delayed for ServiceNow ITSM connectors. - `id` (string) The identifier for the connector. To create a case without a connector, use `none`. - `name` (string) The name of the connector. To create a case without a connector, use `none`. - `type` (enum) The type of connector. Values: `.cases-webhook`, `.jira`, `.none`, `.resilient`, `.servicenow`, `.servicenow-sir`, `.swimlane` - **Cases_payload_create_case** - `assignees` ([] null · max: 10) — nullable An array containing users that are assigned to the case. - `uid` (string) A unique identifier for the user profile. These identifiers can be found by using the suggest user profile API. - `connector` (object) - `fields` (object) — nullable An object containing the connector fields. To create a case without a connector, specify null. If you want to omit any individual field, specify null as its value. - `caseId` (string) The case identifier for Swimlane connectors. - `category` (string) The category of the incident for ServiceNow ITSM and ServiceNow SecOps connectors. - `destIp` (boolean) — nullable Indicates whether cases will send a comma-separated list of destination IPs for ServiceNow SecOps connectors. - `impact` (string) The effect an incident had on business for ServiceNow ITSM connectors. - `issueType` (string) The type of issue for Jira connectors. - `issueTypes` ([] string) The type of incident for IBM Resilient connectors. - `malwareHash` (boolean) — nullable Indicates whether cases will send a comma-separated list of malware hashes for ServiceNow SecOps connectors. - `malwareUrl` (boolean) — nullable Indicates whether cases will send a comma-separated list of malware URLs for ServiceNow SecOps connectors. - `parent` (string) The key of the parent issue, when the issue type is sub-task for Jira connectors. - `priority` (string) The priority of the issue for Jira and ServiceNow SecOps connectors. - `severity` (string) The severity of the incident for ServiceNow ITSM connectors. - `severityCode` (string) The severity code of the incident for IBM Resilient connectors. - `sourceIp` (boolean) — nullable Indicates whether cases will send a comma-separated list of source IPs for ServiceNow SecOps connectors. - `subcategory` (string) The subcategory of the incident for ServiceNow ITSM connectors. - `urgency` (string) The extent to which the incident resolution can be delayed for ServiceNow ITSM connectors. - `id` (string) The identifier for the connector. To create a case without a connector, use `none`. - `name` (string) The name of the connector. To create a case without a connector, use `none`. - `type` (enum) The type of connector. Values: `.cases-webhook`, `.jira`, `.none`, `.resilient`, `.servicenow`, `.servicenow-sir`, `.swimlane` - `description` (string) - `owner` (enum) The application that owns the cases: Stack Management, Observability, or Elastic Security. Values: `cases`, `observability`, `securitySolution` - `settings` ({}) An object that contains the case settings. - `syncAlerts` (boolean) Turns alert syncing on or off. - `severity` (enum · default: low) The severity of the case. Values: `critical`, `high`, `low`, `medium` - `status` (enum) The status of the case. Values: `closed`, `in-progress`, `open` - `tags` ([] string) - `title` (string) - **Cases_payload_delete** If the `action` is `delete` and the `type` is `delete_case`, the payload is nullable. - **Cases_payload_description** - `description` (string) - **Cases_payload_pushed** - `externalService` ({}) — nullable - `connector_id` (string) - `connector_name` (string) - `external_id` (string) - `external_title` (string) - `external_url` (string) - `pushed_at` (string) - `pushed_by` (object) — nullable - `email` (string) — nullable - `full_name` (string) — nullable - `profile_uid` (string) - `username` (string) — nullable - **Cases_payload_settings** - `settings` ({}) An object that contains the case settings. - `syncAlerts` (boolean) Turns alert syncing on or off. - **Cases_payload_severity** - `severity` (enum · default: low) The severity of the case. Values: `critical`, `high`, `low`, `medium` - **Cases_payload_status** - `status` (enum) The status of the case. Values: `closed`, `in-progress`, `open` - **Cases_payload_tags** - `tags` ([] string) - **Cases_payload_title** - `title` (string) - **Cases_payload_user_comment** - `comment` (object) - `comment` (string) - `owner` (enum) The application that owns the cases: Stack Management, Observability, or Elastic Security. Values: `cases`, `observability`, `securitySolution` - `type` (enum) Values: `user` - `type` (enum) The type of action. Values: `assignees`, `create_case`, `comment`, `connector`, `delete_case`, `description`, `pushed`, `tags`, `title`, `status`, `settings`, `severity` #### `401` Authorization information is missing or invalid. `application/json` - `error` (string) - `message` (string) - `statusCode` (integer) ## Code Examples #### Console ```console GET /api/cases/{caseId}/user_actions ``` #### curl ```curl curl -X GET "https://{kibana_url}/api/cases/{caseId}/user_actions" ```