Get notes

GET /api/note

Api key auth Basic auth

Get all notes for a given document.

Query parameters

documentIds array[string] | string
savedObjectIds array[string] | string
page string | null
perPage string | null
search string | null
sortField string | null
sortOrder string | null
filter string | null
createdByFilter string | null
associatedFilter string

Filter notes based on their association with a document or saved object.

Values are all, document_only, saved_object_only, document_and_saved_object, or orphan.

Responses

200 application/json

Indicates the requested notes were returned.
One of:
Security_Timeline_API_GetNotesResult object object-2 object
Hide attributes Show attributes

notes array[object] Required

Hide notes attributes Show notes attributes object

created number | null

The time the note was created, using a 13-digit Epoch timestamp.

createdBy string | null

The user who created the note.

updated number | null

The last time the note was updated, using a 13-digit Epoch timestamp

updatedBy string | null

The user who last updated the note

eventId string | null

The _id of the associated event for this note.

note string | null

The text of the note

timelineId string Required

The savedObjectId of the Timeline that this note is associated with

noteId string Required

The savedObjectId of the note

version string Required

The version of the note

totalCount number Required

GET /api/note

curl \
 --request GET 'https://localhost:5601/api/note' \
 --header "Authorization: $API_KEY"

Response examples (200)

{
  "notes": [
    {
      "created": 1587468588922,
      "createdBy": "casetester",
      "updated": 1741344876825,
      "updatedBy": "casetester",
      "eventId": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc",
      "note": "This is an example text",
      "timelineId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e",
      "noteId": "709f99c6-89b6-4953-9160-35945c8e174e",
      "version": "WzQ2LDFd"
    }
  ],
  "totalCount": 42.0
}

{}