Create a clean draft Timeline or Timeline template

Base URL: https://{kibana_url}

POST /api/timeline/_draft

Create a clean draft Timeline or Timeline template for the current user.

Note

If the user already has a draft Timeline, the existing draft Timeline is cleared and returned.

Authentication

Api key

Authorization: <value>

These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64AccessApiKey

Basic

Authorization: Basic <credentials>

Request body

Responses

Indicates a successful call.

application/json

columns object[] nullable: The Timeline's columns
created number nullable: The time the Timeline was created, using a 13-digit Epoch timestamp.
createdBy string nullable: The user who created the Timeline.
dataProviders object[] nullable: Object containing query clauses
dataViewId string nullable: ID of the Timeline's Data View
dateRange object nullable: The Timeline's search period.
description string nullable: The Timeline's description
eqlOptions object nullable: EQL query that is used in the correlation tab
eventType string nullable deprecated: Event types displayed in the Timeline
excludedRowRendererIds enum[] nullable: A list of row renderers that should not be used when in Event renderers mode; Values: alert alerts auditd auditd_file library netflow plain registry suricata system system_dns system_endgame_process system_file system_fim system_security_event system_socket threat_match zeek
favorite object[] nullable
filters object[] nullable: A list of filters that should be applied to the query
indexNames string[] nullable: A list of index names to use in the query (e.g. when the default data view has been modified)
kqlMode string nullable: Indicates whether the KQL bar filters the query results or searches for additional results, where:

filter: filters query results

search: displays additional search results
kqlQuery object: KQL bar query.
savedQueryId string nullable: The ID of the saved query that might be used in the Query tab
savedSearchId string nullable: The ID of the saved search that is used in the ES|QL tab
sort union oneOf: object or object[]
status enum: The status of the Timeline.; Values: active draft immutable
templateTimelineId string nullable: A unique ID (UUID) for Timeline templates. For Timelines, the value is null.
templateTimelineVersion number nullable: Timeline template version number. For Timelines, the value is null.
timelineType enum: The type of Timeline.; Values: default template
title string nullable: The Timeline's title.
updated number nullable: The last time the Timeline was updated, using a 13-digit Epoch timestamp
updatedBy string nullable: The user who last updated the Timeline
savedObjectId string required: The savedObjectId of the Timeline or Timeline template
version string required: The version of the Timeline or Timeline template
eventIdToNoteIds object[] nullable: A list of all the notes that are associated to this Timeline.
noteIds string[] nullable: A list of all the ids of notes that are associated to this Timeline.
notes object[] nullable: A list of all the notes that are associated to this Timeline.
pinnedEventIds string[] nullable: A list of all the ids of pinned events that are associated to this Timeline.
pinnedEventsSaveObject object[] nullable: A list of all the pinned events that are associated to this Timeline.

Indicates that the user does not have the required permissions to create a draft Timeline.

application/json

Indicates that there is already a draft Timeline with the given timelineId.

application/json

Authentication

Request body { }

Responses

Request body