Get notes

Base URL: https://{kibana_url}

GET /api/note
GET /s/{space_id}/api/note

Refer to Spaces for more information.

Returns Security Timeline notes as saved objects.

Query modes (mutually exclusive branches on the server):

documentIds is set — Returns notes whose eventId matches the given Elasticsearch document _id (single string or array). Pagination query parameters (page, perPage, etc.) are not applied; the server uses a fixed page size (up to 10000 notes).
savedObjectIds is set — Returns notes linked to the given Timeline saved object id(s). Same fixed cap as above; list-mode query parameters are not applied.
Neither documentIds nor savedObjectIds — Lists notes using saved-objects find semantics: page (default 1), perPage (default 10), optional search, sortField, sortOrder, filter, createdByFilter, and associatedFilter.

Requires the Timeline and Notes read privilege (notes_read).

Authentication

Query parameters

documentIds union oneOf: Event document _id values to match against each note's eventId. When this parameter is present, the response is all matching notes (up to the server's hard limit), not a paged list using page/perPage.; Example: ["id-one","id-two"]; One of: string[] or string
savedObjectIds union oneOf: Timeline savedObjectId value(s). Returns notes that reference those timelines. When present, list-mode pagination parameters are not used; up to the server's hard limit of notes may be returned.; Example: 15c1929b-0af7-42bd-85a8-56e234cc7c4e; One of: string[] or string
page string nullable: Page number for list mode (when documentIds and savedObjectIds are omitted). Passed as a string; default 1.; Example: 1
perPage string nullable: Page size for list mode (when documentIds and savedObjectIds are omitted). Passed as a string; default 10.; Example: 20
search string nullable: Search string for saved-objects find (list mode only).
sortField string nullable: Field to sort by for saved-objects find (list mode only).
sortOrder string nullable: Sort order (asc or desc) for saved-objects find (list mode only).; Example: desc
filter string nullable: Kuery filter string combined with other list-mode filters (for example createdByFilter or associatedFilter). Typed as a string for API compatibility; interpreted by the saved-objects layer (list mode only).
createdByFilter string nullable: Kibana user profile UID (UUID). The server resolves the user's display identifiers and returns notes whose createdBy matches any of them (list mode only).; Example: f1c2d3e4-5b6a-7890-abcd-ef1234567890
associatedFilter enum: Restricts notes by how they relate to a Timeline and/or an event document (list mode only). Some values apply extra filtering after the query. Ignored when documentIds or savedObjectIds is used.; Values: all document_only saved_object_only document_and_saved_object orphan

Response

Notes and total count for the requested mode.

application/json