Find list containers

edit

Retrieves a paginated subset of list containers. By default, the first page is returned with 20 results per page.

Request URL

edit

GET <kibana host>:<port>/api/lists/_find

URL query parameters

edit

All parameters are optional:

Name Type Description

page

Integer

The page number to return.

per_page

Integer

The number of list containers to return per page.

sort_field

String

Determines which field is used to sort the results.

sort_order

String

Determines the sort order, which can be desc or asc.

cursor

String

Returns the containers that come after the last container returned in the previous call (use the cursor value returned in the previous call). This parameter uses the tie_breaker_id field to ensure all containers are sorted and returned correctly. See Search After for more information.

filter

String

Filters the returned results according to the value of the specified field, using the <field name>:<field value> syntax, where <field name> can be:

  • name
  • type
  • created_by
  • updated_by

Example request

edit

Retrieves the first two keyword list containers, sorted by name in descending order:

GET api/lists/_find?filter=type:keyword&page=1&per_page=2&sort_field=name&sort_order=desc

Response code

edit
200
Indicates a successful call.

Response payload

edit
{
  "cursor": "WzIwLFsiMTk1ZjU0ZmItMjQ0ZC00ZjlhLTlhNWItZTcyODkwMTM0N2UwIl1d",
  "data": [
    {
      "_version": "WzcsMV0=",
      "id": "internal-ip-excludes",
      "created_at": "2020-08-11T10:38:51.087Z",
      "created_by": "elastic",
      "description": "Contains list items that exclude internal IP addresses from detection rule matches.",
      "immutable": false,
      "name": "Trusted internal IP addresses",
      "tie_breaker_id": "195f54fb-244d-4f9a-9a5b-e728901347e0",
      "type": "ip",
      "updated_at": "2020-08-11T10:42:30.205Z",
      "updated_by": "elastic",
      "version": 1
    }
  ],
  "page": 1,
  "per_page": 20,
  "total": 1
}