Get case activity Deprecated

GET /api/cases/{caseId}/user_actions

Returns all user activity for a case. Deprecated in 8.1.0. This API is deprecated and will be removed in a future release; use the find user actions API instead. You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're seeking.

Path parameters

  • caseId string Required

    The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded.

Responses

  • 200 application/json; Elastic-Api-Version=2023-10-31

    Indicates a successful call.

    Hide response attributes Show response attributes object
    • action string Required

      Values are add, create, delete, push_to_service, or update.

    • action_id string Required
    • case_id string Required
    • comment_id string | null Required
    • created_at string(date-time) Required
    • created_by object Required
      Hide created_by attributes Show created_by attributes object
    • owner string Required

      The application that owns the cases: Stack Management, Observability, or Elastic Security.

      Values are cases, observability, or securitySolution.

    • payload object | null Required

      One of:

      If the action is delete and the type is delete_case, the payload is nullable.

    • type string Required

      The type of action.

      Values are assignees, create_case, comment, connector, delete_case, description, pushed, tags, title, status, settings, or severity.

  • 401 application/json; Elastic-Api-Version=2023-10-31

    Authorization information is missing or invalid.

    Hide response attributes Show response attributes object
GET /api/cases/{caseId}/user_actions
curl \
 -X GET https://localhost:5601/api/cases/9c235210-6834-11ea-a78c-6ffb38a34414/user_actions
Response examples (200)
[
  {
    "action": "create",
    "action_id": "22fd3e30-03b1-11ed-920c-974bfa104448",
    "case_id": "22df07d0-03b1-11ed-920c-974bfa104448",
    "comment_id": "578608d0-03b1-11ed-920c-974bfa104448",
    "created_at": "2022-05-13T09:16:17.416Z",
    "created_by": {
      "email": "string",
      "full_name": "string",
      "profile_uid": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
      "username": "elastic"
    },
    "owner": "cases",
    "payload": {
      "comment": {
        "alertId": "1c0b056b-cc9f-4b61-b5c9-cb801abd5e1d",
        "index": ".alerts-observability.logs.alerts-default",
        "owner": "cases",
        "rule": {
          "id": "94d80550-aaf4-11ec-985f-97e55adae8b9",
          "name": "security_rule"
        },
        "type": "alert"
      }
    },
    "type": "create_case"
  }
]
Response examples (401)
{
  "error": "Unauthorized",
  "message": "string",
  "statusCode": 401
}