---
type: api
title: Find case activity
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v9/operation/operation-findcaseactivitydefaultspace
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v9/operation/operation-findcaseactivitydefaultspace
products:
  - Kibana
---

# Find case activity

- Server: `https://{kibana_url}`

## Paths

- `GET` `/api/cases/{caseId}/user_actions/_find`
- `GET` `/s/{space_id}/api/cases/{caseId}/user_actions/_find`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v9/authentication#apikeyauth)
- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v9/authentication#basicauth)

#### Path Parameters

- `caseId` (string)
  The identifier for the case. To retrieve case IDs, use the search cases (`_find)` API. All non-ASCII characters must be URL encoded.

## Description

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Retrieves a paginated list of user activity for a case. You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you're seeking.

## Query String Parameters

- `page` (integer · default: 1)
  The page number to return.
- `perPage` (integer · max: 100 · default: 20)
  The number of items to return. Limited to 100 items.
- `sortOrder` (enum  · default: desc)
  Determines the sort order.
  Values: `asc`, `desc`
- `types` ([] enum)
  Determines the types of user actions to return.
  Values: `action`, `alert`, `assignees`, `attachment`, `comment`, `connector`, `create_case`, `description`, `pushed`, `settings`, `severity`, `status`, `tags`, `title`, `user`

## Responses

#### `200`

Indicates a successful call.

`application/json`

- `page` (integer)
- `perPage` (integer)
- `total` (integer)
- `userActions` ([] object · max: 10000)
  - `action` (enum)
    Values: `add`, `create`, `delete`, `push_to_service`, `update`
  - `comment_id` (string) — nullable
  - `created_at` (string)
  - `created_by` (object)
    - `email` (string) — nullable
    - `full_name` (string) — nullable
    - `profile_uid` (string)
    - `username` (string) — nullable
  - `id` (string)
  - `owner` (enum)
    The application that owns the cases: Stack Management, Observability, or Elastic Security.
    Values: `cases`, `observability`, `securitySolution`
  - `payload` (union oneOf) — nullable
    - **Cases_payload_alert_comment**
      - `comment` (object)
        - `alertId` (union string | [] string)
        - `index` (union string | [] string)
        - `owner` (enum)
          The application that owns the cases: Stack Management, Observability, or Elastic Security.
          Values: `cases`, `observability`, `securitySolution`
        - `rule` (object)
          - `id` (string) — nullable
            The rule identifier.
          - `name` (string) — nullable
            The rule name.
        - `type` (enum)
          Values: `alert`
    - **Cases_payload_assignees**
      - `assignees` ([] null · max: 10) — nullable
        An array containing users that are assigned to the case.
        - `uid` (string)
          A unique identifier for the user profile. These identifiers can be found by using the suggest user profile API.
    - **Cases_payload_connector**
      - `connector` (object)
        - `fields` (object) — nullable
          An object containing the connector fields. To create a case without a connector, specify null. If you want to omit any individual field, specify null as its value.
          - `caseId` (string)
            The case identifier for Swimlane connectors.
          - `category` (string)
            The category of the incident for ServiceNow ITSM and ServiceNow SecOps connectors.
          - `destIp` (boolean) — nullable
            Indicates whether cases will send a comma-separated list of destination IPs for ServiceNow SecOps connectors.
          - `impact` (string)
            The effect an incident had on business for ServiceNow ITSM connectors.
          - `issueType` (string)
            The type of issue for Jira connectors.
          - `issueTypes` ([] string)
            The type of incident for IBM Resilient connectors.
          - `malwareHash` (boolean) — nullable
            Indicates whether cases will send a comma-separated list of malware hashes for ServiceNow SecOps connectors.
          - `malwareUrl` (boolean) — nullable
            Indicates whether cases will send a comma-separated list of malware URLs for ServiceNow SecOps connectors.
          - `parent` (string)
            The key of the parent issue, when the issue type is sub-task for Jira connectors.
          - `priority` (string)
            The priority of the issue for Jira and ServiceNow SecOps connectors.
          - `severity` (string)
            The severity of the incident for ServiceNow ITSM connectors.
          - `severityCode` (string)
            The severity code of the incident for IBM Resilient connectors.
          - `sourceIp` (boolean) — nullable
            Indicates whether cases will send a comma-separated list of source IPs for ServiceNow SecOps connectors.
          - `subcategory` (string)
            The subcategory of the incident for ServiceNow ITSM connectors.
          - `urgency` (string)
            The extent to which the incident resolution can be delayed for ServiceNow ITSM connectors.
        - `id` (string)
          The identifier for the connector. To create a case without a connector, use `none`.
        - `name` (string)
          The name of the connector. To create a case without a connector, use `none`.
        - `type` (enum)
          The type of connector.
          Values: `.cases-webhook`, `.jira`, `.none`, `.resilient`, `.servicenow`, `.servicenow-sir`, `.swimlane`
    - **Cases_payload_create_case**
      - `assignees` ([] null · max: 10) — nullable
        An array containing users that are assigned to the case.
        - `uid` (string)
          A unique identifier for the user profile. These identifiers can be found by using the suggest user profile API.
      - `connector` (object)
        - `fields` (object) — nullable
          An object containing the connector fields. To create a case without a connector, specify null. If you want to omit any individual field, specify null as its value.
          - `caseId` (string)
            The case identifier for Swimlane connectors.
          - `category` (string)
            The category of the incident for ServiceNow ITSM and ServiceNow SecOps connectors.
          - `destIp` (boolean) — nullable
            Indicates whether cases will send a comma-separated list of destination IPs for ServiceNow SecOps connectors.
          - `impact` (string)
            The effect an incident had on business for ServiceNow ITSM connectors.
          - `issueType` (string)
            The type of issue for Jira connectors.
          - `issueTypes` ([] string)
            The type of incident for IBM Resilient connectors.
          - `malwareHash` (boolean) — nullable
            Indicates whether cases will send a comma-separated list of malware hashes for ServiceNow SecOps connectors.
          - `malwareUrl` (boolean) — nullable
            Indicates whether cases will send a comma-separated list of malware URLs for ServiceNow SecOps connectors.
          - `parent` (string)
            The key of the parent issue, when the issue type is sub-task for Jira connectors.
          - `priority` (string)
            The priority of the issue for Jira and ServiceNow SecOps connectors.
          - `severity` (string)
            The severity of the incident for ServiceNow ITSM connectors.
          - `severityCode` (string)
            The severity code of the incident for IBM Resilient connectors.
          - `sourceIp` (boolean) — nullable
            Indicates whether cases will send a comma-separated list of source IPs for ServiceNow SecOps connectors.
          - `subcategory` (string)
            The subcategory of the incident for ServiceNow ITSM connectors.
          - `urgency` (string)
            The extent to which the incident resolution can be delayed for ServiceNow ITSM connectors.
        - `id` (string)
          The identifier for the connector. To create a case without a connector, use `none`.
        - `name` (string)
          The name of the connector. To create a case without a connector, use `none`.
        - `type` (enum)
          The type of connector.
          Values: `.cases-webhook`, `.jira`, `.none`, `.resilient`, `.servicenow`, `.servicenow-sir`, `.swimlane`
      - `description` (string)
      - `owner` (enum)
        The application that owns the cases: Stack Management, Observability, or Elastic Security.
        Values: `cases`, `observability`, `securitySolution`
      - `settings` ({})
        An object that contains the case settings.
        - `extractObservables` (boolean)
          When true, observables (e.g. IPs, hashes, URLs) are automatically extracted from case comments. Optional; defaults to false when omitted.
        - `syncAlerts` (boolean)
          Turns alert syncing on or off.
      - `severity` (enum)
        The severity of the case.
        Values: `critical`, `high`, `low`, `medium`
      - `status` (enum)
        The status of the case.
        Values: `closed`, `in-progress`, `open`
      - `tags` ([] string)
      - `title` (string)
    - **Cases_payload_delete**
      If the `action` is `delete` and the `type` is `delete_case`, the payload is nullable.
    - **Cases_payload_description**
      - `description` (string)
    - **Cases_payload_pushed**
      - `externalService` ({}) — nullable
        - `connector_id` (string)
        - `connector_name` (string)
        - `external_id` (string)
        - `external_title` (string)
        - `external_url` (string)
        - `pushed_at` (string)
        - `pushed_by` (object) — nullable
          - `email` (string) — nullable
          - `full_name` (string) — nullable
          - `profile_uid` (string)
          - `username` (string) — nullable
    - **Cases_payload_settings**
      - `settings` ({})
        An object that contains the case settings.
        - `extractObservables` (boolean)
          When true, observables (e.g. IPs, hashes, URLs) are automatically extracted from case comments. Optional; defaults to false when omitted.
        - `syncAlerts` (boolean)
          Turns alert syncing on or off.
    - **Cases_payload_severity**
      - `severity` (enum)
        The severity of the case.
        Values: `critical`, `high`, `low`, `medium`
    - **Cases_payload_status**
      - `status` (enum)
        The status of the case.
        Values: `closed`, `in-progress`, `open`
    - **Cases_payload_tags**
      - `tags` ([] string)
    - **Cases_payload_title**
      - `title` (string)
    - **Cases_payload_user_comment**
      - `comment` (object)
        - `comment` (string)
        - `owner` (enum)
          The application that owns the cases: Stack Management, Observability, or Elastic Security.
          Values: `cases`, `observability`, `securitySolution`
        - `type` (enum)
          Values: `user`
  - `type` (enum)
    The type of action.
    Values: `assignees`, `category`, `comment`, `connector`, `create_case`, `customFields`, `delete_case`, `description`, `extended_fields`, `observables`, `pushed`, `settings`, `severity`, `status`, `tags`, `title`
  - `version` (string)
#### `401`

Authorization information is missing or invalid.

`application/json`

- `error` (string)
- `message` (string)
- `statusCode` (integer)
## Code Examples

#### Console

```console
GET /api/cases/{caseId}/user_actions/_find
```

#### curl

```curl
curl -X GET "https://{kibana_url}/api/cases/{caseId}/user_actions/_find"
```

## Response Examples

#### Retrieves all activity for a case

```json
{
  "page": 1,
  "perPage": 20,
  "total": 3,
  "userActions": [
    {
      "action": "create",
      "comment_id": "null",
      "created_at": "2023-10-20T01:17:22.150Z",
      "created_by": {
        "email": "null",
        "full_name": "null",
        "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
        "username": "elastic"
      },
      "id": "b4cd0770-07c9-11ed-a5fd-47154cb8767e",
      "owner": "cases",
      "payload": {
        "assignees": [],
        "category": "null",
        "connector": {
          "fields": "null",
          "id": "none",
          "name": "none",
          "type": ".none"
        },
        "customFields": [
          {
            "key": "d312efda-ec2b-42ec-9e2c-84981795c581",
            "type": "text",
            "value": "My field value"
          },
          {
            "key": "fcc6840d-eb14-42df-8aaf-232201a705ec",
            "type": "toggle",
            "value": "null"
          }
        ],
        "description": "A case description.",
        "owner": "cases",
        "settings": {
          "syncAlerts": false
        },
        "severity": "low",
        "status": "open",
        "tags": [
          "tag 1"
        ],
        "title": "Case title 1"
      },
      "type": "create_case",
      "version": "WzM1ODg4LDFd"
    },
    {
      "action": "create",
      "comment_id": "578608d0-03b1-11ed-920c-974bfa104448",
      "created_at": "2023-10-14T20:12:53.354Z",
      "created_by": {
        "email": "null",
        "full_name": "null",
        "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
        "username": "elastic"
      },
      "id": "57af14a0-03b1-11ed-920c-974bfa104448",
      "owner": "cases",
      "payload": {
        "comment": {
          "comment": "A new comment",
          "owner": "cases",
          "type": "user"
        }
      },
      "type": "comment",
      "version": "WzM1ODg4LDFa"
    },
    {
      "action": "add",
      "comment_id": "null",
      "created_at": "2023-10-20T01:10:28.238Z",
      "created_by": {
        "email": "null",
        "full_name": "null",
        "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
        "username": "elastic"
      },
      "id": "573c6980-6123-11ed-aa41-81a0a61fe447",
      "owner": "cases",
      "payload": {
        "assignees": [
          {
            "uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0"
          }
        ]
      },
      "type": "assignees",
      "version": "WzM1ODg4LDFb"
    }
  ]
}
```

#### Authorization information is missing or invalid.

```json
{
  "error": "Unauthorized",
  "message": "Unable to authenticate with the provided credentials.",
  "statusCode": 401
}
```