Get a case comment or alert

Base URL: https://{kibana_url}

GET /api/cases/{caseId}/comments/{commentId}
GET /s/{space_id}/api/cases/{caseId}/comments/{commentId}

Refer to Spaces for more information.

You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases with the comments you're seeking.

Authentication

Api key

Authorization: <value>

These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64AccessApiKey

Basic

Authorization: Basic <credentials>

Path parameters

Responses

Indicates a successful call.

application/json

One of:

type enum required: Values: alert
alertId string[]
created_at string · format: date-time
created_by object
id string
index string[]
owner enum: The application that owns the cases: Stack Management, Observability, or Elastic Security.; Values: cases observability securitySolution
pushed_at string · format: date-time nullable
pushed_by object nullable
rule object
updated_at string · format: date-time nullable
updated_by object nullable
version string

Authorization information is missing or invalid.

application/json

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

GET kbn:/api/cases/9c235210-6834-11ea-a78c-6ffb38a34414/comments/71ec1870-725b-11ea-a0b2-c51ea50a58e2

Generated from the API spec

curl Shell

curl -X GET "${KIBANA_URL}/api/cases/9c235210-6834-11ea-a78c-6ffb38a34414/comments/71ec1870-725b-11ea-a0b2-c51ea50a58e2" \
  -H "Authorization: ApiKey ${API_KEY}"

Generated from the API spec

Response

{
  "comment": "A new comment",
  "created_at": "2023-10-07T19:32:13.104Z",
  "created_by": {
    "email": "null",
    "full_name": "null",
    "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
    "username": "elastic"
  },
  "id": "8048b460-fe2b-11ec-b15d-779a7c8bbcc3",
  "owner": "cases",
  "pushed_at": "null",
  "pushed_by": "null",
  "type": "user",
  "updated_at": "null",
  "updated_by": "null",
  "version": "WzIzLDFd"
}

{
  "error": "Unauthorized",
  "message": "Unable to authenticate with the provided credentials.",
  "statusCode": 401
}