GET /api/cases/{caseId}/comments/_find
Api key auth Basic auth

Spaces method and path for this operation:

get /s/{space_id}/api/cases/{caseId}/comments/_find

Refer to Spaces for more information.

Retrieves a paginated list of comments for a case. You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases with the comments you're seeking.

Path parameters

  • caseId string Required

    The identifier for the case. To retrieve case IDs, use the search cases (_find) API. All non-ASCII characters must be URL encoded.

Query parameters

  • page integer

    The page number to return.

    Default value is 1.

  • perPage integer

    The number of items to return. Limited to 100 items.

    Maximum value is 100. Default value is 20.

  • sortOrder string

    Determines the sort order.

    Values are asc or desc. Default value is desc.

Responses

  • 200 application/json

    Indicates a successful call.

    Hide response attributes Show response attributes object
    • comments array[object] Required

      Paginated list of user comments for the case.

      Hide comments attributes Show comments attributes object
      • comment string
      • created_at string(date-time)
      • created_by object
        Hide created_by attributes Show created_by attributes object
        • email string | null Required
        • full_name string | null Required
        • profile_uid string
        • username string | null Required
      • id string
      • owner string

        The application that owns the cases: Stack Management, Observability, or Elastic Security.

        Values are cases, observability, or securitySolution.

      • pushed_at string(date-time) | null
      • pushed_by object | null
        Hide pushed_by attributes Show pushed_by attributes object | null
        • email string | null Required
        • full_name string | null Required
        • profile_uid string
        • username string | null Required
      • type string Required

        Value is user.

      • updated_at string(date-time) | null
      • updated_by object | null
        Hide updated_by attributes Show updated_by attributes object | null
        • email string | null Required
        • full_name string | null Required
        • profile_uid string
        • username string | null Required
      • version string
    • page integer Required

      The current page index.

    • per_page integer Required

      The number of items per page.

    • total integer Required

      The total number of comments.
  • 401 application/json

    Authorization information is missing or invalid.

    Hide response attributes Show response attributes object
    • error string
    • message string
    • statusCode integer
GET /api/cases/{caseId}/comments/_find 
curl \
 --request GET 'https://localhost:5601/api/cases/9c235210-6834-11ea-a78c-6ffb38a34414/comments/_find' \
 --header "Authorization: $API_KEY"
Response examples (200) 
{
  "page": 1,
  "total": 1,
  "comments": [
    {
      "id": "8048b460-fe2b-11ec-b15d-779a7c8bbcc3",
      "type": "user",
      "owner": "cases",
      "comment": "A new comment",
      "version": "WzIzLDFd",
      "pushed_at": null,
      "pushed_by": null,
      "created_at": "2023-10-07T19:32:13.104Z",
      "created_by": {
        "email": null,
        "username": "elastic",
        "full_name": null,
        "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0"
      },
      "updated_at": null,
      "updated_by": null
    }
  ],
  "per_page": 20
}