---
type: api
title: Create a clean draft Timeline or Timeline template
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v9/operation/operation-cleandrafttimelines
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v9/operation/operation-cleandrafttimelines
products:
  - Kibana
---

# Create a clean draft Timeline or Timeline template

- Server: `https://{kibana_url}`

## Paths

- `POST` `/api/timeline/_draft`
- `POST` `/s/{space_id}/api/timeline/_draft`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v9/authentication#apikeyauth)
- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v9/authentication#basicauth)

## Description

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Create a clean draft Timeline or Timeline template for the current user.
> info
> If the user already has a draft Timeline, the existing draft Timeline is cleared and returned.

## Request Body

`application/json`

The type of Timeline to create. Valid values are `default` and `template`.

- `timelineType` (enum) — required
  The type of Timeline.
  Values: `default`, `template`

## Responses

#### `200`

Indicates a successful call.

`application/json`

- `columns` ([] object) — nullable
  The Timeline's columns
  - `aggregatable` (boolean) — nullable
  - `category` (string) — nullable
  - `columnHeaderType` (string) — nullable
  - `description` (string) — nullable
  - `example` (string) — nullable
  - `id` (string) — nullable
  - `indexes` ([] string) — nullable
  - `name` (string) — nullable
  - `placeholder` (string) — nullable
  - `searchable` (boolean) — nullable
  - `type` (string) — nullable
- `created` (number) — nullable
  The time the Timeline was created, using a 13-digit Epoch timestamp.
- `createdBy` (string) — nullable
  The user who created the Timeline.
- `dataProviders` ([] object) — nullable
  Object containing query clauses
  - `and` ([] object) — nullable
    - `enabled` (boolean) — nullable
    - `excluded` (boolean) — nullable
    - `id` (string) — nullable
    - `kqlQuery` (string) — nullable
    - `name` (string) — nullable
    - `queryMatch` ({})
      - `displayField` (string) — nullable
      - `displayValue` (string) — nullable
      - `field` (string) — nullable
      - `operator` (string) — nullable
      - `value` (union string | [] string) — nullable
    - `type` (enum)
      The type of data provider.
      Values: `default`, `template`
  - `enabled` (boolean) — nullable
  - `excluded` (boolean) — nullable
  - `id` (string) — nullable
  - `kqlQuery` (string) — nullable
  - `name` (string) — nullable
  - `queryMatch` ({})
    - `displayField` (string) — nullable
    - `displayValue` (string) — nullable
    - `field` (string) — nullable
    - `operator` (string) — nullable
    - `value` (union string | [] string) — nullable
  - `type` (enum)
    The type of data provider.
    Values: `default`, `template`
- `dataViewId` (string) — nullable
  ID of the Timeline's Data View
- `dateRange` (object) — nullable
  The Timeline's search period.
  - `end` (union string | number) — nullable
  - `start` (union string | number) — nullable
- `description` (string) — nullable
  The Timeline's description
- `eqlOptions` (object) — nullable
  EQL query that is used in the correlation tab
  - `eventCategoryField` (string) — nullable
  - `query` (string) — nullable
  - `size` (union string | number) — nullable
  - `tiebreakerField` (string) — nullable
  - `timestampField` (string) — nullable
- `eventType` (string) — nullable — deprecated
  Event types displayed in the Timeline
- `excludedRowRendererIds` ([] enum) — nullable
  A list of row renderers that should not be used when in `Event renderers` mode
  Values: `alert`, `alerts`, `auditd`, `auditd_file`, `library`, `netflow`, `plain`, `registry`, `suricata`, `system`, `system_dns`, `system_endgame_process`, `system_file`, `system_fim`, `system_security_event`, `system_socket`, `threat_match`, `zeek`
- `favorite` ([] object) — nullable
  - `favoriteDate` (number) — nullable
  - `fullName` (string) — nullable
  - `userName` (string) — nullable
- `filters` ([] object) — nullable
  A list of filters that should be applied to the query
  - `exists` (string) — nullable
  - `match_all` (string) — nullable
  - `meta` (object) — nullable
    - `alias` (string) — nullable
    - `controlledBy` (string) — nullable
    - `disabled` (boolean) — nullable
    - `field` (string) — nullable
    - `formattedValue` (string) — nullable
    - `index` (string) — nullable
    - `key` (string) — nullable
    - `negate` (boolean) — nullable
    - `params` (string) — nullable
    - `type` (string) — nullable
    - `value` (string) — nullable
  - `missing` (string) — nullable
  - `query` (string) — nullable
  - `range` (string) — nullable
  - `script` (string) — nullable
- `indexNames` ([] string) — nullable
  A list of index names to use in the query (e.g. when the default data view has been modified)
- `kqlMode` (string) — nullable
  Indicates whether the KQL bar filters the query results or searches for additional results, where:
  * `filter`: filters query results
  * `search`: displays additional search results
- `kqlQuery` ({})
  KQL bar query.
  - `filterQuery` (object) — nullable
    - `kuery` (object) — nullable
      - `expression` (string) — nullable
      - `kind` (string) — nullable
    - `serializedQuery` (string) — nullable
- `savedQueryId` (string) — nullable
  The ID of the saved query that might be used in the Query tab
- `savedSearchId` (string) — nullable
  The ID of the saved search that is used in the ES|QL tab
- `sort` (union)
  `SortObject` or `SortObject[]`
  - `columnId` (string) — nullable
  - `columnType` (string) — nullable
  - `sortDirection` (string) — nullable
- `status` (enum)
  The status of the Timeline.
  Values: `active`, `draft`, `immutable`
- `templateTimelineId` (string) — nullable
  A unique ID (UUID) for Timeline templates. For Timelines, the value is `null`.
- `templateTimelineVersion` (number) — nullable
  Timeline template version number. For Timelines, the value is `null`.
- `timelineType` (enum)
  The type of Timeline.
  Values: `default`, `template`
- `title` (string) — nullable
  The Timeline's title.
- `updated` (number) — nullable
  The last time the Timeline was updated, using a 13-digit Epoch timestamp
- `updatedBy` (string) — nullable
  The user who last updated the Timeline
- `savedObjectId` (string)
  The `savedObjectId` of the Timeline or Timeline template
- `version` (string)
  The version of the Timeline or Timeline template
- `eventIdToNoteIds` ([] object) — nullable
  A list of all the notes that are associated to this Timeline.
  - `created` (number) — nullable
    The time the note was created, using a 13-digit Epoch timestamp.
  - `createdBy` (string) — nullable
    The user who created the note.
  - `updated` (number) — nullable
    The last time the note was updated, using a 13-digit Epoch timestamp
  - `updatedBy` (string) — nullable
    The user who last updated the note
  - `eventId` (string) — nullable
    Elasticsearch document `_id` for the event or alert this note refers to. Same value as the `documentIds` query parameter when fetching notes via GET /api/note.
  - `note` (string) — nullable
    The text of the note
  - `timelineId` (string)
    The `savedObjectId` of the Timeline this note belongs to (not the note's own ID).
  - `noteId` (string)
    The `savedObjectId` of the note
  - `version` (string)
    The version of the note
- `noteIds` ([] string) — nullable
  A list of all the ids of notes that are associated to this Timeline.
- `notes` ([] object) — nullable
  A list of all the notes that are associated to this Timeline.
  - `created` (number) — nullable
    The time the note was created, using a 13-digit Epoch timestamp.
  - `createdBy` (string) — nullable
    The user who created the note.
  - `updated` (number) — nullable
    The last time the note was updated, using a 13-digit Epoch timestamp
  - `updatedBy` (string) — nullable
    The user who last updated the note
  - `eventId` (string) — nullable
    Elasticsearch document `_id` for the event or alert this note refers to. Same value as the `documentIds` query parameter when fetching notes via GET /api/note.
  - `note` (string) — nullable
    The text of the note
  - `timelineId` (string)
    The `savedObjectId` of the Timeline this note belongs to (not the note's own ID).
  - `noteId` (string)
    The `savedObjectId` of the note
  - `version` (string)
    The version of the note
- `pinnedEventIds` ([] string) — nullable
  A list of all the ids of pinned events that are associated to this Timeline.
- `pinnedEventsSaveObject` ([] object) — nullable
  A list of all the pinned events that are associated to this Timeline.
  - `created` (number) — nullable
    The time the pinned event was created, using a 13-digit Epoch timestamp.
  - `createdBy` (string) — nullable
    The user who created the pinned event.
  - `updated` (number) — nullable
    The last time the pinned event was updated, using a 13-digit Epoch timestamp
  - `updatedBy` (string) — nullable
    The user who last updated the pinned event
  - `eventId` (string)
    The `_id` of the associated event for this pinned event.
  - `timelineId` (string)
    The `savedObjectId` of the timeline that this pinned event is associated with
  - `pinnedEventId` (string)
    The `savedObjectId` of this pinned event
  - `version` (string)
    The version of this pinned event
#### `403`

Indicates that the user does not have the required permissions to create a draft Timeline.

`application/json`

- `message` (string)
- `status_code` (number)
#### `409`

Indicates that there is already a draft Timeline with the given `timelineId`.

`application/json`

- `message` (string)
- `status_code` (number)
## Code Examples

#### Console

```console
POST /api/timeline/_draft
{
  "timelineType": "default"
}
```

#### curl

```curl
curl -X POST "https://{kibana_url}/api/timeline/_draft" \
  -H "Content-Type: application/json" \
  -d '{
  "timelineType": "default"
}'
```

## Response Examples

#### Draft after reset or creation

```json
{
  "savedObjectId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e",
  "status": "draft",
  "templateTimelineId": "null",
  "templateTimelineVersion": "null",
  "timelineType": "default",
  "title": "",
  "version": "WzE0LDFd"
}
```

#### Permission denied

```json
{
  "message": "Forbidden",
  "status_code": 403
}
```

#### Draft conflict

```json
{
  "message": "Conflict",
  "status_code": 409
}
```