Get case activity Deprecated

GET /api/cases/{caseId}/user_actions
Api key auth Basic auth

Returns all user activity for a case. Deprecated in 8.1.0. This API is deprecated and will be removed in a future release; use the find user actions API instead. You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're seeking.

Path parameters

  • caseId string Required

    The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded.

Responses

  • 200 application/json

    Indicates a successful call.

    Hide response attributes Show response attributes object
    • action string Required

      Values are add, create, delete, push_to_service, or update.

    • action_id string Required
    • case_id string Required
    • comment_id string | null Required
    • created_at string(date-time) Required
    • created_by object Required
      Hide created_by attributes Show created_by attributes object
      • email string | null Required
      • full_name string | null Required
      • profile_uid string
      • username string | null Required
    • owner string Required

      The application that owns the cases: Stack Management, Observability, or Elastic Security.

      Values are cases, observability, or securitySolution.

    • payload object | null Required

      One of:
      Cases_payload_alert_comment object Cases_payload_assignees object Cases_payload_connector object Cases_payload_create_case object Cases_payload_delete object | null Cases_payload_description object Cases_payload_pushed object Cases_payload_settings object Cases_payload_severity object Cases_payload_status object Cases_payload_tags object Cases_payload_title object Cases_payload_user_comment object

      If the action is delete and the type is delete_case, the payload is nullable.

    • type string Required

      The type of action.

      Values are assignees, create_case, comment, connector, delete_case, description, pushed, tags, title, status, settings, or severity.
  • 401 application/json

    Authorization information is missing or invalid.

    Hide response attributes Show response attributes object
    • error string
    • message string
    • statusCode integer
GET /api/cases/{caseId}/user_actions 
curl \
 --request GET 'https://localhost:5601/api/cases/9c235210-6834-11ea-a78c-6ffb38a34414/user_actions' \
 --header "Authorization: $API_KEY"