Find case activity

Base URL: https://{kibana_url}

GET /api/cases/{caseId}/user_actions/_find

Retrieves a paginated list of user activity for a case. You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're seeking.

Authentication

Api key

Authorization: <value>

These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64AccessApiKey

Basic

Authorization: Basic <credentials>

Path parameters

Query parameters

Responses

Indicates a successful call.

application/json

page integer
perPage integer
total integer
userActions object[] · max items: 10000

Authorization information is missing or invalid.

application/json

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

GET kbn:/api/cases/9c235210-6834-11ea-a78c-6ffb38a34414/user_actions/_find

Generated from the API spec

curl Shell

curl -X GET "${KIBANA_URL}/api/cases/9c235210-6834-11ea-a78c-6ffb38a34414/user_actions/_find" \
  -H "Authorization: ApiKey ${API_KEY}"

Generated from the API spec

Response

{
  "page": 1,
  "perPage": 20,
  "total": 3,
  "userActions": [
    {
      "action": "create",
      "comment_id": "null",
      "created_at": "2023-10-20T01:17:22.150Z",
      "created_by": {
        "email": "null",
        "full_name": "null",
        "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
        "username": "elastic"
      },
      "id": "b4cd0770-07c9-11ed-a5fd-47154cb8767e",
      "owner": "cases",
      "payload": {
        "assignees": [],
        "category": "null",
        "connector": {
          "fields": "null",
          "id": "none",
          "name": "none",
          "type": ".none"
        },
        "customFields": [
          {
            "key": "d312efda-ec2b-42ec-9e2c-84981795c581",
            "type": "text",
            "value": "My field value"
          },
          {
            "key": "fcc6840d-eb14-42df-8aaf-232201a705ec",
            "type": "toggle",
            "value": "null"
          }
        ],
        "description": "A case description.",
        "owner": "cases",
        "settings": {
          "syncAlerts": false
        },
        "severity": "low",
        "status": "open",
        "tags": [
          "tag 1"
        ],
        "title": "Case title 1"
      },
      "type": "create_case",
      "version": "WzM1ODg4LDFd"
    },
    {
      "action": "create",
      "comment_id": "578608d0-03b1-11ed-920c-974bfa104448",
      "created_at": "2023-10-14T20:12:53.354Z",
      "created_by": {
        "email": "null",
        "full_name": "null",
        "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
        "username": "elastic"
      },
      "id": "57af14a0-03b1-11ed-920c-974bfa104448",
      "owner": "cases",
      "payload": {
        "comment": {
          "comment": "A new comment",
          "owner": "cases",
          "type": "user"
        }
      },
      "type": "comment",
      "version": "WzM1ODg4LDFa"
    },
    {
      "action": "add",
      "comment_id": "null",
      "created_at": "2023-10-20T01:10:28.238Z",
      "created_by": {
        "email": "null",
        "full_name": "null",
        "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
        "username": "elastic"
      },
      "id": "573c6980-6123-11ed-aa41-81a0a61fe447",
      "owner": "cases",
      "payload": {
        "assignees": [
          {
            "uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0"
          }
        ]
      },
      "type": "assignees",
      "version": "WzM1ODg4LDFb"
    }
  ]
}

{
  "error": "Unauthorized",
  "message": "Unable to authenticate with the provided credentials.",
  "statusCode": 401
}