---
type: api
title: Get an existing saved Timeline or Timeline template
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v8/operation/operation-resolvetimeline
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v8/operation/operation-resolvetimeline
products:
  - Kibana
---

# Get an existing saved Timeline or Timeline template

- Server: `https://{kibana_url}`

## Paths

- `GET` `/api/timeline/resolve`
- `GET` `/s/{space_id}/api/timeline/resolve`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v8/authentication#apikeyauth)
- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v8/authentication#basicauth)

## Description

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

## Query String Parameters

- `template_timeline_id` (string)
  The ID of the template timeline to resolve
- `id` (string)
  The ID of the timeline to resolve

## Responses

#### `200`

The (template) Timeline has been found

`application/json`

One of:
- **{ data }**
  - `data` ({})
    - `alias_purpose` (enum)
      Values: `savedObjectConversion`, `savedObjectImport`
    - `alias_target_id` (string)
    - `outcome` (enum)
      Values: `exactMatch`, `aliasMatch`, `conflict`
    - `timeline` ({})
      - `columns` ([] object) — nullable
        The Timeline's columns
        - `aggregatable` (boolean) — nullable
        - `category` (string) — nullable
        - `columnHeaderType` (string) — nullable
        - `description` (string) — nullable
        - `example` (string) — nullable
        - `id` (string) — nullable
        - `indexes` ([] string) — nullable
        - `name` (string) — nullable
        - `placeholder` (string) — nullable
        - `searchable` (boolean) — nullable
        - `type` (string) — nullable
      - `created` (number) — nullable
        The time the Timeline was created, using a 13-digit Epoch timestamp.
      - `createdBy` (string) — nullable
        The user who created the Timeline.
      - `dataProviders` ([] object) — nullable
        Object containing query clauses
        - `and` ([] object) — nullable
          - `enabled` (boolean) — nullable
          - `excluded` (boolean) — nullable
          - `id` (string) — nullable
          - `kqlQuery` (string) — nullable
          - `name` (string) — nullable
          - `queryMatch` ({})
            - `displayField` (string) — nullable
            - `displayValue` (string) — nullable
            - `field` (string) — nullable
            - `operator` (string) — nullable
            - `value` (union string | [] string) — nullable
          - `type` (enum)
            The type of data provider.
            Values: `default`, `template`
        - `enabled` (boolean) — nullable
        - `excluded` (boolean) — nullable
        - `id` (string) — nullable
        - `kqlQuery` (string) — nullable
        - `name` (string) — nullable
        - `queryMatch` ({})
          - `displayField` (string) — nullable
          - `displayValue` (string) — nullable
          - `field` (string) — nullable
          - `operator` (string) — nullable
          - `value` (union string | [] string) — nullable
        - `type` (enum)
          The type of data provider.
          Values: `default`, `template`
      - `dataViewId` (string) — nullable
        ID of the Timeline's Data View
      - `dateRange` (object) — nullable
        The Timeline's search period.
        - `end` (union string | number) — nullable
        - `start` (union string | number) — nullable
      - `description` (string) — nullable
        The Timeline's description
      - `eqlOptions` (object) — nullable
        EQL query that is used in the correlation tab
        - `eventCategoryField` (string) — nullable
        - `query` (string) — nullable
        - `size` (union string | number) — nullable
        - `tiebreakerField` (string) — nullable
        - `timestampField` (string) — nullable
      - `eventType` (string) — nullable — deprecated
        Event types displayed in the Timeline
      - `excludedRowRendererIds` ([] enum) — nullable
        A list of row renderers that should not be used when in `Event renderers` mode
        Values: `alert`, `alerts`, `auditd`, `auditd_file`, `library`, `netflow`, `plain`, `registry`, `suricata`, `system`, `system_dns`, `system_endgame_process`, `system_file`, `system_fim`, `system_security_event`, `system_socket`, `threat_match`, `zeek`
      - `favorite` ([] object) — nullable
        - `favoriteDate` (number) — nullable
        - `fullName` (string) — nullable
        - `userName` (string) — nullable
      - `filters` ([] object) — nullable
        A list of filters that should be applied to the query
        - `exists` (string) — nullable
        - `match_all` (string) — nullable
        - `meta` (object) — nullable
          - `alias` (string) — nullable
          - `controlledBy` (string) — nullable
          - `disabled` (boolean) — nullable
          - `field` (string) — nullable
          - `formattedValue` (string) — nullable
          - `index` (string) — nullable
          - `key` (string) — nullable
          - `negate` (boolean) — nullable
          - `params` (string) — nullable
          - `type` (string) — nullable
          - `value` (string) — nullable
        - `missing` (string) — nullable
        - `query` (string) — nullable
        - `range` (string) — nullable
        - `script` (string) — nullable
      - `indexNames` ([] string) — nullable
        A list of index names to use in the query (e.g. when the default data view has been modified)
      - `kqlMode` (string) — nullable
        Indicates whether the KQL bar filters the query results or searches for additional results, where:
  * `filter`: filters query results
  * `search`: displays additional search results
      - `kqlQuery` ({})
        KQL bar query.
        - `filterQuery` (object) — nullable
          - `kuery` (object) — nullable
            - `expression` (string) — nullable
            - `kind` (string) — nullable
          - `serializedQuery` (string) — nullable
      - `savedQueryId` (string) — nullable
        The ID of the saved query that might be used in the Query tab
      - `savedSearchId` (string) — nullable
        The ID of the saved search that is used in the ES|QL tab
      - `sort` (union)
        `SortObject` or `SortObject[]`
        - `columnId` (string) — nullable
        - `columnType` (string) — nullable
        - `sortDirection` (string) — nullable
      - `status` (enum)
        The status of the Timeline.
        Values: `active`, `draft`, `immutable`
      - `templateTimelineId` (string) — nullable
        A unique ID (UUID) for Timeline templates. For Timelines, the value is `null`.
      - `templateTimelineVersion` (number) — nullable
        Timeline template version number. For Timelines, the value is `null`.
      - `timelineType` (enum)
        The type of Timeline.
        Values: `default`, `template`
      - `title` (string) — nullable
        The Timeline's title.
      - `updated` (number) — nullable
        The last time the Timeline was updated, using a 13-digit Epoch timestamp
      - `updatedBy` (string) — nullable
        The user who last updated the Timeline
      - `eventIdToNoteIds` ([] object) — nullable
        - `created` (number) — nullable
          The time the note was created, using a 13-digit Epoch timestamp.
        - `createdBy` (string) — nullable
          The user who created the note.
        - `updated` (number) — nullable
          The last time the note was updated, using a 13-digit Epoch timestamp
        - `updatedBy` (string) — nullable
          The user who last updated the note
        - `eventId` (string) — nullable
          The `_id` of the associated event for this note.
        - `note` (string) — nullable
          The text of the note
        - `timelineId` (string)
          The `savedObjectId` of the Timeline that this note is associated with
        - `noteId` (string)
          The `savedObjectId` of the note
        - `version` (string)
          The version of the note
      - `noteIds` ([] string) — nullable
      - `notes` ([] object) — nullable
        - `created` (number) — nullable
          The time the note was created, using a 13-digit Epoch timestamp.
        - `createdBy` (string) — nullable
          The user who created the note.
        - `updated` (number) — nullable
          The last time the note was updated, using a 13-digit Epoch timestamp
        - `updatedBy` (string) — nullable
          The user who last updated the note
        - `eventId` (string) — nullable
          The `_id` of the associated event for this note.
        - `note` (string) — nullable
          The text of the note
        - `timelineId` (string)
          The `savedObjectId` of the Timeline that this note is associated with
        - `noteId` (string)
          The `savedObjectId` of the note
        - `version` (string)
          The version of the note
      - `pinnedEventIds` ([] string) — nullable
      - `pinnedEventsSaveObject` ([] object) — nullable
        - `created` (number) — nullable
          The time the pinned event was created, using a 13-digit Epoch timestamp.
        - `createdBy` (string) — nullable
          The user who created the pinned event.
        - `updated` (number) — nullable
          The last time the pinned event was updated, using a 13-digit Epoch timestamp
        - `updatedBy` (string) — nullable
          The user who last updated the pinned event
        - `eventId` (string)
          The `_id` of the associated event for this pinned event.
        - `timelineId` (string)
          The `savedObjectId` of the timeline that this pinned event is associated with
        - `pinnedEventId` (string)
          The `savedObjectId` of this pinned event
        - `version` (string)
          The version of this pinned event
      - `savedObjectId` (string)
      - `version` (string)
- **object**
#### `400`

The request is missing parameters

#### `404`

The (template) Timeline was not found

## Code Examples

#### Console

```console
GET /api/timeline/resolve
```

#### curl

```curl
curl -X GET "https://{kibana_url}/api/timeline/resolve"
```