Add or update a note

Base URL
https://{kibana_url}
  • PATCH /api/note
Auth

Creates a new note or updates an existing one.

Create: Send note and omit noteId to create a new saved object.

Update: Send note with the changed fields and set noteId to the note's saved object ID. Optionally include version for optimistic concurrency when the client has it from a prior read.

Requires the Timeline and Notes write privilege (notes_write).

Add or update a note on a Timeline

Request body

Body must include the note object. For updates, include noteId (and optionally version). To attach a note to a specific event, set note.eventId to that event's document _id; for a timeline-wide note, omit or clear eventId per product rules.

note object required
created number nullable

The time the note was created, using a 13-digit Epoch timestamp.

createdBy string nullable

The user who created the note.

updated number nullable

The last time the note was updated, using a 13-digit Epoch timestamp

updatedBy string nullable

The user who last updated the note

eventId string nullable

Elasticsearch document _id for the event or alert this note refers to. Same value as the documentIds query parameter when fetching notes via GET /api/note.

note string nullable

The text of the note

timelineId string required

The savedObjectId of the Timeline this note belongs to (not the note's own ID).

noteId string nullable

The savedObjectId of the note to update. Omit when creating a new note.

version string nullable

Saved object version string from a previous read; optional on update.

Response

The persisted note, including noteId and version.

application/json
note object required
created number nullable

The time the note was created, using a 13-digit Epoch timestamp.

createdBy string nullable

The user who created the note.

updated number nullable

The last time the note was updated, using a 13-digit Epoch timestamp

updatedBy string nullable

The user who last updated the note

eventId string nullable

Elasticsearch document _id for the event or alert this note refers to. Same value as the documentIds query parameter when fetching notes via GET /api/note.

note string nullable

The text of the note

timelineId string required

The savedObjectId of the Timeline this note belongs to (not the note's own ID).

noteId string required

The savedObjectId of the note

version string required

The version of the note

Base URL
https://{kibana_url}