Get case activity Deprecated

GET /api/cases/{caseId}/user_actions

Returns all user activity for a case. Deprecated in 8.1.0. This API is deprecated and will be removed in a future release; use the find user actions API instead. You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're seeking.

Path parameters

  • caseId string Required

    The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded.

Responses

  • 200 application/json; Elastic-Api-Version=2023-10-31

    Indicates a successful call.

    Hide response attributes Show response attributes object
    • action string Required

      Values are add, create, delete, push_to_service, or update.

    • action_id string Required
    • case_id string Required
    • comment_id string | null Required
    • created_at string(date-time) Required
    • created_by object Required

      Additional properties are allowed.

      Hide created_by attributes Show created_by attributes object
    • owner string Required

      The application that owns the cases: Stack Management, Observability, or Elastic Security.

      Values are cases, observability, or securitySolution.

    • payload object | null Required

      One of:
      Cases_payload_alert_comment object Cases_payload_assignees object Cases_payload_connector object Cases_payload_create_case object Cases_payload_delete object | null Cases_payload_description object Cases_payload_pushed object Cases_payload_settings object Cases_payload_severity object Cases_payload_status object Cases_payload_tags object Cases_payload_title object Cases_payload_user_comment object

      If the action is delete and the type is delete_case, the payload is nullable.

      Additional properties are allowed.

    • type string Required

      The type of action.

      Values are assignees, create_case, comment, connector, delete_case, description, pushed, tags, title, status, settings, or severity.
  • 401 application/json; Elastic-Api-Version=2023-10-31

    Authorization information is missing or invalid.

    Hide response attributes Show response attributes object
GET /api/cases/{caseId}/user_actions 
curl \
 -X GET https://localhost:5601/api/cases/9c235210-6834-11ea-a78c-6ffb38a34414/user_actions
Response examples (200) 
[
  {
    "action": "create",
    "action_id": "22fd3e30-03b1-11ed-920c-974bfa104448",
    "case_id": "22df07d0-03b1-11ed-920c-974bfa104448",
    "comment_id": "578608d0-03b1-11ed-920c-974bfa104448",
    "created_at": "2022-05-13T09:16:17.416Z",
    "created_by": {
      "email": "string",
      "full_name": "string",
      "profile_uid": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
      "username": "elastic"
    },
    "owner": "cases",
    "payload": {
      "comment": {
        "alertId": "1c0b056b-cc9f-4b61-b5c9-cb801abd5e1d",
        "index": ".alerts-observability.logs.alerts-default",
        "owner": "cases",
        "rule": {
          "id": "94d80550-aaf4-11ec-985f-97e55adae8b9",
          "name": "security_rule"
        },
        "type": "alert"
      }
    },
    "type": "create_case"
  }
]
Response examples (401) 
{
  "error": "Unauthorized",
  "message": "string",
  "statusCode": 401
}