Get case activity

Base URL
https://{kibana_url}
Auth Deprecated

Returns all user activity for a case. Deprecated in 8.1.0. This API is deprecated and will be removed in a future release; use the find user actions API instead. You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're seeking.

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

caseId string required

The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded.

Example: 9c235210-6834-11ea-a78c-6ffb38a34414

Responses

Indicates a successful call.

application/json
<array> object[]
action enum required
Values: add create delete push_to_service update
action_id string required
case_id string required
comment_id string required nullable
created_at string · format: date-time required
created_by object required
email string required nullable
full_name string required nullable
profile_uid string
username string required nullable
owner enum required

The application that owns the cases: Stack Management, Observability, or Elastic Security.

Values: cases observability securitySolution
payload union oneOf required nullable
One of:
comment object
alertId union string | string[]
index union string | string[]
owner enum

The application that owns the cases: Stack Management, Observability, or Elastic Security.

Values: cases observability securitySolution
rule object
id string

The rule identifier.

name string

The rule name.

type enum
Values: alert
type enum required

The type of action.

Values: assignees create_case comment connector delete_case description pushed tags title status settings severity

Authorization information is missing or invalid.

application/json
error string
message string
statusCode integer
Base URL
https://{kibana_url}