Get case activity APIedit
Returns all user activity for a case.
Deprecated in 8.1.0.
Use Find case activity instead.
For the most up-to-date API details, refer to the open API specification. For a preview, check out Case APIs.
Requestedit
GET <kibana host>:<port>/api/cases/<case ID>/user_actions
GET <kibana host>:<port>/s/<space_id>/api/cases/<case ID>/user_actions
Prerequisitesedit
You must have read privileges for the Cases feature in the Management,
Observability, or Security section of the
Kibana feature privileges, depending on the
owner of the case you’re seeking.
Path parametersedit
-
<case_id> - (Required, string) An identifier for the case to retrieve. Use Find cases to retrieve case IDs.
-
<space_id> - (Optional, string) An identifier for the space. If it is not specified, the default space is used.
Response codesedit
-
200 - Indicates a successful call.
Examplesedit
Gets all activity for case ID 22df07d0-03b1-11ed-920c-974bfa104448:
GET api/cases/22df07d0-03b1-11ed-920c-974bfa104448/user_actions
The API returns a JSON object with all the activity for the case. For example:
[
{
"created_at":"2022-07-14T20:11:24.947Z",
"created_by":{
"username":"elastic",
"email":null,
"full_name":null
},
"owner":"cases",
"action":"create",
"payload":{
"description":"A case description",
"title":"Case title 1",
"tags":["tag 1"],
"connector":{
"name":"none",
"type":".none",
"fields":null,
"id":"none"
},
"settings":{"syncAlerts":true},
"owner":"cases",
"severity":"low",
"status":"open"
},
"type":"create_case",
"action_id":"22fd3e30-03b1-11ed-920c-974bfa104448",
"case_id":"22df07d0-03b1-11ed-920c-974bfa104448",
"comment_id":null
},
{
"created_at":"2022-07-14T20:12:53.354Z",
"created_by":{
"username":"elastic",
"email":null,
"full_name":null
},
"owner":"cases",
"action":"create",
"payload":{
"comment":{
"type":"user",
"owner":"cases",
"comment":"A new comment"
}
},
"type":"comment",
"action_id":"57af14a0-03b1-11ed-920c-974bfa104448",
"case_id":"22df07d0-03b1-11ed-920c-974bfa104448",
"comment_id":"578608d0-03b1-11ed-920c-974bfa104448"
}
]