Find case comments and alerts

Base URL: https://{kibana_url}

GET /api/cases/{caseId}/comments/_find
GET /s/{space_id}/api/cases/{caseId}/comments/_find

Refer to Spaces for more information.

Retrieves a paginated list of comments for a case. You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases with the comments you're seeking.

Authentication

Api key

Authorization: <value>

These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64AccessApiKey

Basic

Authorization: Basic <credentials>

Path parameters

Query parameters

Responses

Indicates a successful call.

application/json

assignees object[] · max items: 10 nullable: An array containing users that are assigned to the case.
category string nullable: The case category.
closed_at string · format: date-time required nullable
closed_by object required nullable
comments union oneOf[] · max items: 10000 required: An array of comment objects for the case.; One of:
connector union oneOf required: One of: (determined by type)
created_at string · format: date-time required
created_by object required
customFields object[]: Custom field values for the case.
description string required
duration integer required nullable: The elapsed time from the creation of the case to its closure (in seconds). If the case has not been closed, the duration is set to null. If the case was closed after less than half a second, the duration is rounded down to zero.
external_service object required nullable
id string required
owner enum required: The application that owns the cases: Stack Management, Observability, or Elastic Security.; Values: cases observability securitySolution
settings object required: An object that contains the case settings.
severity enum · default: low required: The severity of the case.; Values: critical high low medium
status enum required: The status of the case.; Values: closed in-progress open
tags string[] required
title string required
totalAlerts integer required
totalComment integer required
updated_at string · format: date-time required nullable
updated_by object required nullable
version string required

Authorization information is missing or invalid.

application/json