PATCH /api/note
Api key auth

Spaces method and path for this operation:

patch /s/{space_id}/api/note

Refer to Spaces for more information.

Creates a new note or updates an existing one.

Create: Send note and omit noteId to create a new saved object.

Update: Send note with the changed fields and set noteId to the note's saved object ID. Optionally include version for optimistic concurrency when the client has it from a prior read.

Requires the Timeline and Notes write privilege (notes_write).

Add or update a note on a Time...
application/json

Body Required

Body must include the note object. For updates, include noteId (and optionally version). To attach a note to a specific event, set note.eventId to that event's document _id; for a timeline-wide note, omit or clear eventId per product rules.

  • note object Required
    Hide note attributes Show note attributes object
    • created number | null

      The time the note was created, using a 13-digit Epoch timestamp.

    • createdBy string | null

      The user who created the note.

    • updated number | null

      The last time the note was updated, using a 13-digit Epoch timestamp

    • updatedBy string | null

      The user who last updated the note

    • eventId string | null

      Elasticsearch document _id for the event or alert this note refers to. Same value as the documentIds query parameter when fetching notes via GET /api/note.

    • note string | null

      The text of the note

    • timelineId string Required

      The savedObjectId of the Timeline this note belongs to (not the note's own ID).

  • noteId string | null

    The savedObjectId of the note to update. Omit when creating a new note.

  • version string | null

    Saved object version string from a previous read; optional on update.

Responses

  • 200 application/json

    The persisted note, including noteId and version.

    Hide response attribute Show response attribute object
    • note object Required
      Hide note attributes Show note attributes object
      • created number | null

        The time the note was created, using a 13-digit Epoch timestamp.

      • createdBy string | null

        The user who created the note.

      • updated number | null

        The last time the note was updated, using a 13-digit Epoch timestamp

      • updatedBy string | null

        The user who last updated the note

      • eventId string | null

        Elasticsearch document _id for the event or alert this note refers to. Same value as the documentIds query parameter when fetching notes via GET /api/note.

      • note string | null

        The text of the note

      • timelineId string Required

        The savedObjectId of the Timeline this note belongs to (not the note's own ID).

      • noteId string Required

        The savedObjectId of the note

      • version string Required

        The version of the note
PATCH /api/note 
curl \
 --request PATCH 'https://<KIBANA_URL>/api/note' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --data '{"note":{"eventId":"d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc","note":"Escalated to tier-2 analyst","timelineId":"15c1929b-0af7-42bd-85a8-56e234cc7c4e"}}'
Request example 
{
  "note": {
    "eventId": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc",
    "note": "Escalated to tier-2 analyst",
    "timelineId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e"
  }
}
Response examples (200) 
{
  "note": {
    "eventId": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc",
    "note": "Escalated to tier-2 analyst",
    "noteId": "709f99c6-89b6-4953-9160-35945c8e174e",
    "timelineId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e",
    "version": "WzQ2LDFd"
  }
}