openapi: 3.0.3
info:
  contact:
    name: Kibana Team
  description: 'The Kibana REST APIs enable you to manage resources such as connectors, data views, and saved objects.

    The API calls are stateless.

    Each request that you make happens in isolation from other calls and must include all of the necessary information for Kibana to fulfill the

    request.

    API requests return JSON output, which is a format that is machine-readable and works well for automation.


    To interact with Kibana APIs, use the following operations:


    - GET: Fetches the information.

    - PATCH: Applies partial modifications to the existing information.

    - POST: Adds new information.

    - PUT: Updates the existing information.

    - DELETE: Removes the information.


    You can prepend any Kibana API endpoint with `kbn:` and run the request in **Dev Tools → Console**.

    For example:


    ```

    GET kbn:/api/data_views

    ```


    For more information about the console, refer to [Run API requests](https://www.elastic.co/docs/explore-analyze/query-filter/tools/console).


    NOTE: Access to internal Kibana API endpoints will be restricted in Kibana version 9.0. Please move any integrations to publicly documented APIs.


    ## Documentation source and versions


    This documentation is derived from the `main` branch of the [kibana](https://github.com/elastic/kibana) repository.

    It is provided under license [Attribution-NonCommercial-NoDerivatives 4.0 International](https://creativecommons.org/licenses/by-nc-nd/4.0/).


    This documentation contains work-in-progress information for future Elastic Stack releases.

    '
  title: Kibana APIs Actions Security Timeline API API
  version: ''
  x-doc-license:
    name: Attribution-NonCommercial-NoDerivatives 4.0 International
    url: https://creativecommons.org/licenses/by-nc-nd/4.0/
  x-feedbackLink:
    label: Feedback
    url: https://github.com/elastic/docs-content/issues/new?assignees=&labels=feedback%2Ccommunity&projects=&template=api-feedback.yaml&title=%5BFeedback%5D%3A+
servers:
- url: https://{kibana_url}
  variables:
    kibana_url:
      default: localhost:5601
security:
- apiKeyAuth: []
- basicAuth: []
tags:
- description: You can create Timelines and Timeline templates via the API, as well as import new Timelines from an ndjson file.
  name: Security Timeline API
  x-displayName: Security timeline
paths:
  /api/note:
    delete:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/note</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Deletes notes by saved object ID. Send either `noteId` (single ID) or `noteIds` (array of IDs) in the JSON body.


        The response has HTTP 200 with an empty body on success.


        Requires the **Timeline and Notes** write privilege (`notes_write`).

        '
      operationId: DeleteNote
      requestBody:
        content:
          application/json:
            examples:
              deleteOne:
                summary: Delete a single note by id
                value:
                  noteId: 709f99c6-89b6-4953-9160-35945c8e174e
            schema:
              oneOf:
              - nullable: true
                type: object
                properties:
                  noteId:
                    description: Saved object ID of the note to delete.
                    type: string
                required:
                - noteId
              - nullable: true
                type: object
                properties:
                  noteIds:
                    description: Saved object IDs of the notes to delete.
                    items:
                      type: string
                    nullable: true
                    type: array
                required:
                - noteIds
        description: 'Exactly one shape: `{ "noteId": "<id>" }` for a single delete, or `{ "noteIds": ["<id>", ...] }` for bulk delete.

          `noteIds` may be null in some clients; prefer an empty array or omit unused fields when possible.

          '
        required: true
      responses:
        '200':
          description: The notes were deleted successfully. Response body is empty.
      summary: Delete one or more notes
      tags:
      - Security Timeline API
      x-metaTags:
      - content: Kibana
        name: product_name
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/note</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Returns Security Timeline notes as saved objects.


        **Query modes (mutually exclusive branches on the server):**


        1. **`documentIds` is set** — Returns notes whose `eventId` matches the given Elasticsearch document `_id` (single string or array). Pagination query parameters (`page`, `perPage`, etc.) are **not** applied; the server uses a fixed page size (up to 10000 notes).


        2. **`savedObjectIds` is set** — Returns notes linked to the given Timeline saved object id(s). Same fixed cap as above; list-mode query parameters are **not** applied.


        3. **Neither `documentIds` nor `savedObjectIds`** — Lists notes using saved-objects find semantics: `page` (default 1), `perPage` (default 10), optional `search`, `sortField`, `sortOrder`, `filter`, `createdByFilter`, and `associatedFilter`.


        Requires the **Timeline and Notes** read privilege (`notes_read`).

        '
      operationId: GetNotes
      parameters:
      - description: 'Event document `_id` values to match against each note''s `eventId`. When this parameter is present, the response is all matching notes (up to the server''s hard limit), not a paged list using `page`/`perPage`.

          '
        examples:
          multiple:
            summary: Multiple document ids (array)
            value:
            - id-one
            - id-two
          single:
            summary: Single document id
            value: d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bcbf66f57d124dcc739c98e6b
        in: query
        name: documentIds
        schema:
          $ref: '#/components/schemas/Security_Timeline_API_DocumentIds'
      - description: 'Timeline `savedObjectId` value(s). Returns notes that reference those timelines. When present, list-mode pagination parameters are not used; up to the server''s hard limit of notes may be returned.

          '
        examples:
          singleTimeline:
            summary: Single timeline id
            value: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
        in: query
        name: savedObjectIds
        schema:
          $ref: '#/components/schemas/Security_Timeline_API_SavedObjectIds'
      - description: 'Page number for list mode (when `documentIds` and `savedObjectIds` are omitted). Passed as a string; default 1.

          '
        example: '1'
        in: query
        name: page
        schema:
          nullable: true
          type: string
      - description: 'Page size for list mode (when `documentIds` and `savedObjectIds` are omitted). Passed as a string; default 10.

          '
        example: '20'
        in: query
        name: perPage
        schema:
          nullable: true
          type: string
      - description: Search string for saved-objects find (list mode only).
        in: query
        name: search
        schema:
          nullable: true
          type: string
      - description: Field to sort by for saved-objects find (list mode only).
        in: query
        name: sortField
        schema:
          nullable: true
          type: string
      - description: Sort order (`asc` or `desc`) for saved-objects find (list mode only).
        example: desc
        in: query
        name: sortOrder
        schema:
          nullable: true
          type: string
      - description: 'Kuery filter string combined with other list-mode filters (for example `createdByFilter` or `associatedFilter`). Typed as a string for API compatibility; interpreted by the saved-objects layer (list mode only).

          '
        in: query
        name: filter
        schema:
          nullable: true
          type: string
      - description: 'Kibana user profile **UID** (UUID). The server resolves the user''s display identifiers and returns notes whose `createdBy` matches any of them (list mode only).

          '
        example: f1c2d3e4-5b6a-7890-abcd-ef1234567890
        in: query
        name: createdByFilter
        schema:
          nullable: true
          type: string
      - description: 'Restricts notes by how they relate to a Timeline and/or an event document (list mode only). Some values apply extra filtering after the query. Ignored when `documentIds` or `savedObjectIds` is used.

          '
        in: query
        name: associatedFilter
        schema:
          $ref: '#/components/schemas/Security_Timeline_API_AssociatedFilterType'
      responses:
        '200':
          content:
            application/json:
              examples:
                notesPage:
                  summary: Paged notes for a timeline
                  value:
                    notes:
                    - eventId: d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc
                      note: Escalated to tier-2 analyst
                      noteId: 709f99c6-89b6-4953-9160-35945c8e174e
                      timelineId: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
                      version: WzQ2LDFd
                    totalCount: 1
              schema:
                $ref: '#/components/schemas/Security_Timeline_API_GetNotesResult'
          description: Notes and total count for the requested mode.
      summary: Get notes
      tags:
      - Security Timeline API
      x-metaTags:
      - content: Kibana
        name: product_name
    patch:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb patch">patch</span>&nbsp;<span class="operation-path">/s/{space_id}/api/note</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Creates a new note or updates an existing one.


        **Create:** Send `note` and omit `noteId` to create a new saved object.


        **Update:** Send `note` with the changed fields and set `noteId` to the note''s saved object ID. Optionally include `version` for optimistic concurrency when the client has it from a prior read.


        Requires the **Timeline and Notes** write privilege (`notes_write`).

        '
      externalDocs:
        description: Add or update a note on a Timeline
        url: https://www.elastic.co/guide/en/security/current/timeline-api-update.html
      operationId: PersistNoteRoute
      requestBody:
        content:
          application/json:
            examples:
              addNote:
                summary: Add a note on an event
                value:
                  note:
                    eventId: d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc
                    note: Escalated to tier-2 analyst
                    timelineId: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
            schema:
              type: object
              properties:
                note:
                  $ref: '#/components/schemas/Security_Timeline_API_BareNote'
                  description: Note payload (timeline, text, optional event linkage, metadata).
                noteId:
                  description: The `savedObjectId` of the note to update. Omit when creating a new note.
                  example: 709f99c6-89b6-4953-9160-35945c8e174e
                  nullable: true
                  type: string
                version:
                  description: Saved object version string from a previous read; optional on update.
                  example: WzQ2LDFd
                  nullable: true
                  type: string
              required:
              - note
        description: 'Body must include the `note` object. For updates, include `noteId` (and optionally `version`).

          To attach a note to a specific event, set `note.eventId` to that event''s document `_id`; for a timeline-wide note, omit or clear `eventId` per product rules.

          '
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                persisted:
                  summary: Persisted note wrapper
                  value:
                    note:
                      eventId: d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc
                      note: Escalated to tier-2 analyst
                      noteId: 709f99c6-89b6-4953-9160-35945c8e174e
                      timelineId: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
                      version: WzQ2LDFd
              schema:
                $ref: '#/components/schemas/Security_Timeline_API_ResponseNote'
          description: The persisted note, including `noteId` and `version`.
      summary: Add or update a note
      tags:
      - Security Timeline API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/pinned_event:
    patch:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb patch">patch</span>&nbsp;<span class="operation-path">/s/{space_id}/api/pinned_event</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Pin/unpin an event to/from an existing Timeline.'
      operationId: PersistPinnedEventRoute
      requestBody:
        content:
          application/json:
            examples:
              pinEvent:
                summary: Pin an event
                value:
                  eventId: d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc
                  timelineId: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
            schema:
              type: object
              properties:
                eventId:
                  description: The `_id` of the associated event for this pinned event.
                  example: d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc
                  type: string
                pinnedEventId:
                  description: The `savedObjectId` of the pinned event you want to unpin.
                  example: 10r1929b-0af7-42bd-85a8-56e234f98h2f3
                  nullable: true
                  type: string
                timelineId:
                  description: The `savedObjectId` of the timeline that you want this pinned event unpinned from.
                  example: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
                  type: string
              required:
              - eventId
              - timelineId
        description: The pinned event to add or unpin, along with additional metadata.
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                pinnedSaved:
                  summary: Pinned event saved object
                  value:
                    eventId: d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc
                    pinnedEventId: 10r1929b-0af7-42bd-85a8-56e234f98h2f3
                    timelineId: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
                    version: WzQ2LDFe
                unpinned:
                  summary: Unpin response
                  value:
                    unpinned: true
              schema:
                $ref: '#/components/schemas/Security_Timeline_API_PersistPinnedEventResponse'
          description: Indicates a successful call.
      summary: Pin/unpin an event
      tags:
      - Security Timeline API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/timeline:
    delete:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/timeline</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Delete one or more Timelines or Timeline templates.'
      operationId: DeleteTimelines
      requestBody:
        content:
          application/json:
            examples:
              deleteByIds:
                summary: Delete timelines by saved object id
                value:
                  savedObjectIds:
                  - 15c1929b-0af7-42bd-85a8-56e234cc7c4e
              deleteWithSearches:
                summary: Delete Timelines and their linked saved searches
                value:
                  savedObjectIds:
                  - 15c1929b-0af7-42bd-85a8-56e234cc7c4e
                  - 6ce1b592-84e3-4b4a-9552-f189d4b82075
                  searchIds:
                  - 2c1b8f02-9ad6-4e33-8f6a-2c6b7d0a1f11
            schema:
              type: object
              properties:
                savedObjectIds:
                  description: The list of IDs of the Timelines or Timeline templates to delete
                  items:
                    type: string
                  maxItems: 100
                  type: array
                searchIds:
                  description: Saved search IDs that should be deleted alongside the timelines
                  items:
                    type: string
                  maxItems: 100
                  type: array
              required:
              - savedObjectIds
        description: The IDs of the Timelines or Timeline templates to delete.
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                success:
                  summary: Success
                  value: {}
              schema:
                additionalProperties: true
                type: object
          description: Indicates a successful call.
      summary: Delete Timelines or Timeline templates
      tags:
      - Security Timeline API
      x-metaTags:
      - content: Kibana
        name: product_name
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/timeline</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get the details of an existing saved Timeline or Timeline template.'
      operationId: GetTimeline
      parameters:
      - description: The `savedObjectId` of the Timeline template to retrieve.
        in: query
        name: template_timeline_id
        schema:
          type: string
      - description: The `savedObjectId` of the Timeline to retrieve.
        in: query
        name: id
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                timelineDetail:
                  summary: Timeline detail
                  value:
                    description: User-reported suspicious email
                    noteIds: []
                    pinnedEventIds: []
                    savedObjectId: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
                    status: active
                    timelineType: default
                    title: Phishing investigation
                    version: WzE0LDFd
              schema:
                $ref: '#/components/schemas/Security_Timeline_API_TimelineResponse'
          description: Indicates a successful call.
      summary: Get Timeline or Timeline template details
      tags:
      - Security Timeline API
      x-metaTags:
      - content: Kibana
        name: product_name
    patch:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb patch">patch</span>&nbsp;<span class="operation-path">/s/{space_id}/api/timeline</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Update an existing Timeline. You can update the title, description, date range, pinned events, pinned queries, and/or pinned saved queries of an existing Timeline.'
      operationId: PatchTimeline
      requestBody:
        content:
          application/json:
            examples:
              patchTitle:
                summary: Update title
                value:
                  timeline:
                    title: Escalated case review
                  timelineId: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
                  version: WzE0LDFd
            schema:
              type: object
              properties:
                timeline:
                  $ref: '#/components/schemas/Security_Timeline_API_SavedTimeline'
                  description: The timeline object of the Timeline or Timeline template that you’re updating.
                timelineId:
                  description: The `savedObjectId` of the Timeline or Timeline template that you’re updating.
                  example: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
                  nullable: true
                  type: string
                version:
                  description: The version of the Timeline or Timeline template that you’re updating.
                  example: WzE0LDFd
                  nullable: true
                  type: string
              required:
              - timelineId
              - version
              - timeline
        description: The Timeline updates, along with the Timeline ID and version.
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                patched:
                  summary: Updated timeline
                  value:
                    savedObjectId: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
                    status: active
                    timelineType: default
                    title: Escalated case review
                    version: WzE1LDFd
              schema:
                $ref: '#/components/schemas/Security_Timeline_API_TimelineResponse'
          description: Indicates a successful call.
        '405':
          content:
            application/json:
              examples:
                error:
                  summary: Error body
                  value:
                    body: update timeline error
                    statusCode: 405
              schema:
                type: object
                properties:
                  body:
                    description: The error message.
                    example: update timeline error
                    type: string
                  statusCode:
                    example: 405
                    type: number
          description: Indicates that the user does not have the required access to create a Timeline.
      summary: Update a Timeline
      tags:
      - Security Timeline API
      x-metaTags:
      - content: Kibana
        name: product_name
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/timeline</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Create a new Timeline or Timeline template.'
      operationId: CreateTimelines
      requestBody:
        content:
          application/json:
            examples:
              createDefault:
                summary: Create a default timeline
                value:
                  timeline:
                    status: active
                    timelineType: default
                    title: Malware containment
            schema:
              type: object
              properties:
                status:
                  $ref: '#/components/schemas/Security_Timeline_API_TimelineStatus'
                  nullable: true
                templateTimelineId:
                  description: A unique identifier for the Timeline template.
                  example: 6ce1b592-84e3-4b4a-9552-f189d4b82075
                  nullable: true
                  type: string
                templateTimelineVersion:
                  description: Timeline template version number.
                  example: 12
                  nullable: true
                  type: number
                timeline:
                  $ref: '#/components/schemas/Security_Timeline_API_SavedTimeline'
                timelineId:
                  description: A unique identifier for the Timeline.
                  example: 6ce1b592-84e3-4b4a-9552-f189d4b82075
                  nullable: true
                  type: string
                timelineType:
                  $ref: '#/components/schemas/Security_Timeline_API_TimelineType'
                  nullable: true
                version:
                  nullable: true
                  type: string
              required:
              - timeline
        description: The required Timeline fields used to create a new Timeline, along with optional fields that will be created if not provided.
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                created:
                  summary: Created timeline
                  value:
                    savedObjectId: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
                    status: active
                    timelineType: default
                    title: Malware containment
                    version: WzE0LDFd
              schema:
                $ref: '#/components/schemas/Security_Timeline_API_TimelineResponse'
          description: Indicates a successful call.
        '405':
          content:
            application/json:
              examples:
                error:
                  summary: Error body
                  value:
                    body: update timeline error
                    statusCode: 405
              schema:
                type: object
                properties:
                  body:
                    description: The error message
                    example: update timeline error
                    type: string
                  statusCode:
                    example: 405
                    type: number
          description: Indicates that there was an error in the Timeline creation.
      summary: Create a Timeline or Timeline template
      tags:
      - Security Timeline API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/timeline/_copy:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/timeline/_copy</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Copies and returns a timeline or timeline template.

        '
      operationId: CopyTimeline
      requestBody:
        content:
          application/json:
            examples:
              copyWithTitle:
                summary: Copy with a new title
                value:
                  timeline:
                    timelineType: default
                    title: Copy of investigation
                  timelineIdToCopy: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
            schema:
              type: object
              properties:
                timeline:
                  $ref: '#/components/schemas/Security_Timeline_API_SavedTimeline'
                timelineIdToCopy:
                  description: The `savedObjectId` of the timeline or template to duplicate.
                  type: string
              required:
              - timeline
              - timelineIdToCopy
        description: Source timeline id to copy plus timeline fields for the new saved object.
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                copied:
                  summary: Newly saved timeline
                  value:
                    savedObjectId: 6ce1b592-84e3-4b4a-9552-f189d4b82075
                    status: active
                    timelineType: default
                    title: Copy of investigation
                    version: WzE1LDFd
              schema:
                $ref: '#/components/schemas/Security_Timeline_API_TimelineResponse'
          description: Indicates a successful call.
      summary: Copies timeline or timeline template
      tags:
      - Security Timeline API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/timeline/_draft:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/timeline/_draft</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get the details of the draft Timeline  or Timeline template for the current user. If the user doesn''t have a draft Timeline, an empty Timeline is returned.'
      operationId: GetDraftTimelines
      parameters:
      - description: Which draft to load (`default` investigation timeline or `template` timeline template).
        in: query
        name: timelineType
        required: true
        schema:
          $ref: '#/components/schemas/Security_Timeline_API_TimelineType'
      responses:
        '200':
          content:
            application/json:
              examples:
                draftPayload:
                  summary: Draft timeline payload
                  value:
                    savedObjectId: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
                    status: draft
                    timelineType: default
                    title: ''
                    version: WzE0LDFd
              schema:
                $ref: '#/components/schemas/Security_Timeline_API_TimelineResponse'
          description: Indicates a successful call.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Permission denied
                  value:
                    message: Forbidden
                    status_code: 403
              schema:
                type: object
                properties:
                  message:
                    type: string
                  status_code:
                    type: number
          description: If a draft Timeline was not found and we attempted to create one, it indicates that the user does not have the required permissions to create a draft Timeline.
        '409':
          content:
            application/json:
              examples:
                conflict:
                  summary: Draft conflict
                  value:
                    message: Conflict
                    status_code: 409
              schema:
                type: object
                properties:
                  message:
                    type: string
                  status_code:
                    type: number
          description: This should never happen, but if a draft Timeline was not found and we attempted to create one, it indicates that there is already a draft Timeline with the given `timelineId`.
      summary: Get draft Timeline or Timeline template details
      tags:
      - Security Timeline API
      x-metaTags:
      - content: Kibana
        name: product_name
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/timeline/_draft</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Create a clean draft Timeline or Timeline template for the current user.

        > info

        > If the user already has a draft Timeline, the existing draft Timeline is cleared and returned.

        '
      operationId: CleanDraftTimelines
      requestBody:
        content:
          application/json:
            examples:
              defaultDraft:
                summary: Create a default draft timeline
                value:
                  timelineType: default
            schema:
              type: object
              properties:
                timelineType:
                  $ref: '#/components/schemas/Security_Timeline_API_TimelineType'
              required:
              - timelineType
        description: The type of Timeline to create. Valid values are `default` and `template`.
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                draftResponse:
                  summary: Draft after reset or creation
                  value:
                    savedObjectId: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
                    status: draft
                    templateTimelineId: null
                    templateTimelineVersion: null
                    timelineType: default
                    title: ''
                    version: WzE0LDFd
              schema:
                $ref: '#/components/schemas/Security_Timeline_API_TimelineResponse'
          description: Indicates a successful call.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Permission denied
                  value:
                    message: Forbidden
                    status_code: 403
              schema:
                type: object
                properties:
                  message:
                    type: string
                  status_code:
                    type: number
          description: Indicates that the user does not have the required permissions to create a draft Timeline.
        '409':
          content:
            application/json:
              examples:
                conflict:
                  summary: Draft conflict
                  value:
                    message: Conflict
                    status_code: 409
              schema:
                type: object
                properties:
                  message:
                    type: string
                  status_code:
                    type: number
          description: Indicates that there is already a draft Timeline with the given `timelineId`.
      summary: Create a clean draft Timeline or Timeline template
      tags:
      - Security Timeline API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/timeline/_export:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/timeline/_export</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Export Timelines as an NDJSON file.'
      operationId: ExportTimelines
      parameters:
      - description: The name of the file to export
        in: query
        name: file_name
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples:
              exportIds:
                summary: Export by timeline ids
                value:
                  ids:
                  - 15c1929b-0af7-42bd-85a8-56e234cc7c4e
            schema:
              type: object
              properties:
                ids:
                  items:
                    type: string
                  maxItems: 1000
                  minItems: 1
                  nullable: true
                  type: array
        description: The IDs of the Timelines to export.
        required: true
      responses:
        '200':
          content:
            application/ndjson:
              examples:
                ndjsonLine:
                  summary: Single NDJSON line
                  value: '{"savedObjectId":"15c1929b-0af7-42bd-85a8-56e234cc7c4e","version":"WzE0LDFd","title":"Investigation","timelineType":"default"}'
              schema:
                description: NDJSON of the exported Timelines
                type: string
          description: Indicates a successful call.
        '400':
          content:
            application/ndjson:
              examples:
                badRequest:
                  summary: Export error
                  value:
                    body: Export limit exceeded
                    statusCode: 400
              schema:
                type: object
                properties:
                  body:
                    type: string
                  statusCode:
                    type: number
          description: Bad Request response.
      summary: Export Timelines
      tags:
      - Security Timeline API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/timeline/_favorite:
    patch:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb patch">patch</span>&nbsp;<span class="operation-path">/s/{space_id}/api/timeline/_favorite</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Favorite a Timeline or Timeline template for the current user.'
      operationId: PersistFavoriteRoute
      requestBody:
        content:
          application/json:
            examples:
              favoriteDefault:
                summary: Favorite a default timeline
                value:
                  templateTimelineId: null
                  templateTimelineVersion: null
                  timelineId: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
                  timelineType: default
            schema:
              type: object
              properties:
                templateTimelineId:
                  nullable: true
                  type: string
                templateTimelineVersion:
                  nullable: true
                  type: number
                timelineId:
                  nullable: true
                  type: string
                timelineType:
                  $ref: '#/components/schemas/Security_Timeline_API_TimelineType'
                  nullable: true
              required:
              - timelineId
              - templateTimelineId
              - templateTimelineVersion
              - timelineType
        description: The required fields used to favorite a (template) Timeline.
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                favoriteResponse:
                  summary: Favorite metadata updated
                  value:
                    favorite:
                    - favoriteDate: 1741337636741
                      userName: elastic
                    savedObjectId: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
                    timelineType: default
                    version: WzE2LDFd
              schema:
                $ref: '#/components/schemas/Security_Timeline_API_FavoriteTimelineResponse'
          description: Indicates a successful call.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Forbidden
                  value:
                    body: Forbidden
                    statusCode: 403
              schema:
                type: object
                properties:
                  body:
                    type: string
                  statusCode:
                    type: number
          description: Indicates the user does not have the required permissions to persist the favorite status.
      summary: Favorite a Timeline or Timeline template
      tags:
      - Security Timeline API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/timeline/_import:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/timeline/_import</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Import Timelines.'
      operationId: ImportTimelines
      requestBody:
        content:
          application/json:
            examples:
              multipartPlaceholder:
                summary: Request shape (file is a stream of NDJSON lines at runtime)
                value:
                  file: '{"savedObjectId":"15c1929b-0af7-42bd-85a8-56e234cc7c4e","version":"WzE0LDFd"}\n'
                  isImmutable: 'false'
            schema:
              type: object
              properties:
                file: {}
                isImmutable:
                  description: Whether the Timeline should be immutable
                  enum:
                  - 'true'
                  - 'false'
                  type: string
              required:
              - file
        description: The Timelines to import as a readable stream.
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                importSummary:
                  summary: Import summary
                  value:
                    errors: []
                    success: true
                    success_count: 5
                    timelines_installed: 3
                    timelines_updated: 2
              schema:
                $ref: '#/components/schemas/Security_Timeline_API_ImportTimelineResult'
          description: Indicates a successful call.
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  summary: Invalid import
                  value:
                    body: Invalid file extension
                    statusCode: 400
              schema:
                type: object
                properties:
                  body:
                    description: The error message
                    example: Invalid file extension
                    type: string
                  statusCode:
                    example: 400
                    type: number
          description: Bad Request response.
        '404':
          content:
            application/json:
              examples:
                notFound:
                  summary: Saved objects client missing
                  value:
                    body: Unable to find saved object client
                    statusCode: 404
              schema:
                type: object
                properties:
                  body:
                    description: The error message
                    example: Unable to find saved object client
                    type: string
                  statusCode:
                    example: 404
                    type: number
          description: Not found response.
        '409':
          content:
            application/json:
              examples:
                conflict:
                  summary: Import conflict
                  value:
                    body: Could not import timelines
                    statusCode: 409
              schema:
                type: object
                properties:
                  body:
                    description: The error message
                    example: Could not import timelines
                    type: string
                  statusCode:
                    example: 409
                    type: number
          description: Indicates the import of Timelines was unsuccessful.
      summary: Import Timelines
      tags:
      - Security Timeline API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/timeline/_prepackaged:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/timeline/_prepackaged</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Install or update prepackaged Timelines.'
      operationId: InstallPrepackedTimelines
      requestBody:
        content:
          application/json:
            examples:
              emptyArrays:
                summary: Installer payload shape
                value:
                  prepackagedTimelines: []
                  timelinesToInstall: []
                  timelinesToUpdate: []
            schema:
              type: object
              properties:
                prepackagedTimelines:
                  items:
                    $ref: '#/components/schemas/Security_Timeline_API_TimelineSavedToReturnObject'
                    nullable: true
                  type: array
                timelinesToInstall:
                  items:
                    $ref: '#/components/schemas/Security_Timeline_API_ImportTimelines'
                    nullable: true
                  type: array
                timelinesToUpdate:
                  items:
                    $ref: '#/components/schemas/Security_Timeline_API_ImportTimelines'
                    nullable: true
                  type: array
              required:
              - timelinesToInstall
              - timelinesToUpdate
              - prepackagedTimelines
        description: The Timelines to install or update.
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                installResult:
                  summary: Install result counts
                  value:
                    errors: []
                    success: true
                    success_count: 10
                    timelines_installed: 8
                    timelines_updated: 2
              schema:
                $ref: '#/components/schemas/Security_Timeline_API_ImportTimelineResult'
          description: Indicates a successful call.
        '500':
          content:
            application/json:
              examples:
                serverError:
                  summary: Server error
                  value:
                    body: Internal error
                    statusCode: 500
              schema:
                type: object
                properties:
                  body:
                    type: string
                  statusCode:
                    type: number
          description: Indicates the installation of prepackaged Timelines was unsuccessful.
      summary: Install prepackaged Timelines
      tags:
      - Security Timeline API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/timeline/resolve:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/timeline/resolve</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Resolve a Timeline or Timeline template, surfacing outcomes such as `exactMatch`, `aliasMatch`, or `conflict` when object IDs have been remapped during upgrades or imports. Provide **either** `id` for default Timelines or `template_timeline_id` for templates.'
      operationId: ResolveTimeline
      parameters:
      - description: The ID of the template timeline to resolve
        in: query
        name: template_timeline_id
        schema:
          type: string
      - description: The ID of the timeline to resolve
        in: query
        name: id
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                exactMatch:
                  description: Timeline resolved without alias or conflict
                  summary: Exact match outcome
                  value:
                    outcome: exactMatch
                    timeline:
                      savedObjectId: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
                      timelineType: default
                      title: Investigation
              schema:
                $ref: '#/components/schemas/Security_Timeline_API_ResolvedTimeline'
          description: Indicates a successful call.
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  summary: Bad request
                  value: {}
              schema:
                additionalProperties: true
                type: object
          description: Bad Request response.
        '404':
          content:
            application/json:
              examples:
                notFound:
                  summary: Not found
                  value: {}
              schema:
                additionalProperties: true
                type: object
          description: The (template) Timeline was not found
      summary: Resolve a Timeline or Timeline template
      tags:
      - Security Timeline API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/timelines:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/timelines</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get a list of all saved Timelines or Timeline templates.'
      operationId: GetTimelines
      parameters:
      - description: If `true`, only Timelines that the current user has marked as favorite are returned.
        in: query
        name: only_user_favorite
        schema:
          enum:
          - 'true'
          - 'false'
          nullable: true
          type: string
      - description: Restrict results to `default` investigation timelines or `template` timeline templates.
        in: query
        name: timeline_type
        schema:
          $ref: '#/components/schemas/Security_Timeline_API_TimelineType'
          nullable: true
      - description: Field used to sort the list (`title`, `description`, `updated`, or `created`).
        in: query
        name: sort_field
        schema:
          $ref: '#/components/schemas/Security_Timeline_API_SortFieldTimeline'
      - description: Whether to sort the results `ascending` or `descending`
        in: query
        name: sort_order
        schema:
          enum:
          - asc
          - desc
          type: string
      - description: How many results should returned at once
        in: query
        name: page_size
        schema:
          nullable: true
          type: string
      - description: How many pages should be skipped
        in: query
        name: page_index
        schema:
          nullable: true
          type: string
      - description: Allows to search for timelines by their title
        in: query
        name: search
        schema:
          nullable: true
          type: string
      - description: Filter by timeline lifecycle state (`active`, `draft`, or `immutable`).
        in: query
        name: status
        schema:
          $ref: '#/components/schemas/Security_Timeline_API_TimelineStatus'
          nullable: true
      responses:
        '200':
          content:
            application/json:
              examples:
                timelineList:
                  summary: Example list response
                  value:
                    customTemplateTimelineCount: 0
                    defaultTimelineCount: 1
                    elasticTemplateTimelineCount: 0
                    favoriteCount: 0
                    templateTimelineCount: 0
                    timeline:
                    - savedObjectId: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
                      status: active
                      timelineType: default
                      title: Phishing investigation
                      updated: 1741344876825
                      version: WzE0LDFd
                    totalCount: 1
              schema:
                type: object
                properties:
                  customTemplateTimelineCount:
                    description: The amount of custom Timeline templates in the results
                    example: 2
                    type: number
                  defaultTimelineCount:
                    description: The amount of `default` type Timelines in the results
                    example: 90
                    type: number
                  elasticTemplateTimelineCount:
                    description: The amount of Elastic's Timeline templates in the results
                    example: 8
                    type: number
                  favoriteCount:
                    description: The amount of favorited Timelines
                    example: 5
                    type: number
                  templateTimelineCount:
                    description: The amount of Timeline templates in the results
                    example: 10
                    type: number
                  timeline:
                    items:
                      $ref: '#/components/schemas/Security_Timeline_API_TimelineResponse'
                    type: array
                  totalCount:
                    description: The total amount of results
                    example: 100
                    type: number
                required:
                - timeline
                - totalCount
          description: Indicates a successful call.
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  summary: Error response body
                  value:
                    body: get timeline error
                    statusCode: 400
              schema:
                type: object
                properties:
                  body:
                    description: The error message.
                    example: get timeline error
                    type: string
                  statusCode:
                    example: 400
                    type: number
          description: Bad Request response.
      summary: Get Timelines or Timeline templates
      tags:
      - Security Timeline API
      x-metaTags:
      - content: Kibana
        name: product_name
components:
  schemas:
    Security_Timeline_API_NoteCreatedAndUpdatedMetadata:
      type: object
      properties:
        created:
          description: The time the note was created, using a 13-digit Epoch timestamp.
          example: 1587468588922
          nullable: true
          type: number
        createdBy:
          description: The user who created the note.
          example: casetester
          nullable: true
          type: string
        updated:
          description: The last time the note was updated, using a 13-digit Epoch timestamp
          example: 1741344876825
          nullable: true
          type: number
        updatedBy:
          description: The user who last updated the note
          example: casetester
          nullable: true
          type: string
    Security_Timeline_API_SavedObjectResolveOutcome:
      enum:
      - exactMatch
      - aliasMatch
      - conflict
      type: string
    Security_Timeline_API_QueryMatchResult:
      type: object
      properties:
        displayField:
          nullable: true
          type: string
        displayValue:
          nullable: true
          type: string
        field:
          nullable: true
          type: string
        operator:
          nullable: true
          type: string
        value:
          oneOf:
          - nullable: true
            type: string
          - items:
              type: string
            nullable: true
            type: array
    Security_Timeline_API_TimelineType:
      description: The type of Timeline.
      enum:
      - default
      - template
      type: string
    Security_Timeline_API_GetNotesResult:
      type: object
      properties:
        notes:
          items:
            $ref: '#/components/schemas/Security_Timeline_API_Note'
          type: array
        totalCount:
          description: Number of notes returned (may be adjusted after the query when `associatedFilter` applies post-filtering).
          type: number
      required:
      - totalCount
      - notes
    Security_Timeline_API_SerializedFilterQueryResult:
      description: KQL bar query.
      example:
        filterQuery: null
        kuery:
          expression: '_id : *'
          kind: kuery
        serializedQuery: '{"bool":{"should":[{"exists":{"field":"_id"}}],"minimum_should_match":1}}'
      type: object
      properties:
        filterQuery:
          nullable: true
          type: object
          properties:
            kuery:
              nullable: true
              type: object
              properties:
                expression:
                  nullable: true
                  type: string
                kind:
                  nullable: true
                  type: string
            serializedQuery:
              nullable: true
              type: string
    Security_Timeline_API_TimelineResponse:
      allOf:
      - $ref: '#/components/schemas/Security_Timeline_API_SavedTimeline'
      - $ref: '#/components/schemas/Security_Timeline_API_SavedTimelineWithSavedObjectId'
      - type: object
        properties:
          eventIdToNoteIds:
            description: A list of all the notes that are associated to this Timeline.
            items:
              $ref: '#/components/schemas/Security_Timeline_API_Note'
            nullable: true
            type: array
          noteIds:
            description: A list of all the ids of notes that are associated to this Timeline.
            example:
            - 709f99c6-89b6-4953-9160-35945c8e174e
            items:
              type: string
            nullable: true
            type: array
          notes:
            description: A list of all the notes that are associated to this Timeline.
            items:
              $ref: '#/components/schemas/Security_Timeline_API_Note'
            nullable: true
            type: array
          pinnedEventIds:
            description: A list of all the ids of pinned events that are associated to this Timeline.
            example:
            - 983f99c6-89b6-4953-9160-35945c8a194f
            items:
              type: string
            nullable: true
            type: array
          pinnedEventsSaveObject:
            description: A list of all the pinned events that are associated to this Timeline.
            items:
              $ref: '#/components/schemas/Security_Timeline_API_PinnedEvent'
            nullable: true
            type: array
    Security_Timeline_API_SavedObjectIds:
      description: One Timeline saved object ID or an array of IDs.
      oneOf:
      - items:
          type: string
        type: array
      - type: string
    Security_Timeline_API_SavedTimelineWithSavedObjectId:
      allOf:
      - $ref: '#/components/schemas/Security_Timeline_API_SavedTimeline'
      - type: object
        properties:
          savedObjectId:
            description: The `savedObjectId` of the Timeline or Timeline template
            example: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
            type: string
          version:
            description: The version of the Timeline or Timeline template
            example: WzE0LDFd
            type: string
        required:
        - savedObjectId
        - version
    Security_Timeline_API_Sort:
      oneOf:
      - $ref: '#/components/schemas/Security_Timeline_API_SortObject'
      - items:
          $ref: '#/components/schemas/Security_Timeline_API_SortObject'
        type: array
    Security_Timeline_API_ImportTimelines:
      allOf:
      - $ref: '#/components/schemas/Security_Timeline_API_SavedTimeline'
      - type: object
        properties:
          eventNotes:
            items:
              $ref: '#/components/schemas/Security_Timeline_API_BareNote'
            nullable: true
            type: array
          globalNotes:
            items:
              $ref: '#/components/schemas/Security_Timeline_API_BareNote'
            nullable: true
            type: array
          pinnedEventIds:
            items:
              type: string
            nullable: true
            type: array
          savedObjectId:
            nullable: true
            type: string
          version:
            nullable: true
            type: string
        required:
        - savedObjectId
        - version
        - pinnedEventIds
        - eventNotes
        - globalNotes
    Security_Timeline_API_DataProviderType:
      description: The type of data provider.
      enum:
      - default
      - template
      type: string
    Security_Timeline_API_PinnedEvent:
      allOf:
      - $ref: '#/components/schemas/Security_Timeline_API_BarePinnedEvent'
      - type: object
        properties:
          pinnedEventId:
            description: The `savedObjectId` of this pinned event
            example: 10r1929b-0af7-42bd-85a8-56e234f98h2f3
            type: string
          version:
            description: The version of this pinned event
            example: WzQ2LDFe
            type: string
        required:
        - pinnedEventId
        - version
    Security_Timeline_API_BarePinnedEvent:
      allOf:
      - $ref: '#/components/schemas/Security_Timeline_API_PinnedEventCreatedAndUpdatedMetadata'
      - type: object
        properties:
          eventId:
            description: The `_id` of the associated event for this pinned event.
            example: d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc
            type: string
          timelineId:
            description: The `savedObjectId` of the timeline that this pinned event is associated with
            example: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
            type: string
        required:
        - eventId
        - timelineId
    Security_Timeline_API_PinnedEventCreatedAndUpdatedMetadata:
      type: object
      properties:
        created:
          description: The time the pinned event was created, using a 13-digit Epoch timestamp.
          example: 1587468588922
          nullable: true
          type: number
        createdBy:
          description: The user who created the pinned event.
          example: casetester
          nullable: true
          type: string
        updated:
          description: The last time the pinned event was updated, using a 13-digit Epoch timestamp
          example: 1741344876825
          nullable: true
          type: number
        updatedBy:
          description: The user who last updated the pinned event
          example: casetester
          nullable: true
          type: string
    Security_Timeline_API_FavoriteTimelineResult:
      description: Indicates when and who marked a Timeline as a favorite.
      example:
        favoriteDate: 1741337636741
        userName: elastic
      type: object
      properties:
        favoriteDate:
          nullable: true
          type: number
        fullName:
          nullable: true
          type: string
        userName:
          nullable: true
          type: string
    Security_Timeline_API_AssociatedFilterType:
      description: 'How the note is associated with a Timeline saved object and/or an event (`eventId`). `all`: no association-based restriction from this parameter. `document_only`: document-linked notes (non-empty `eventId`) without timeline association in the API''s internal sense; post-filtering drops notes without a usable `eventId`. `saved_object_only`: timeline notes with no linked event (`eventId` empty or absent); post-filtering keeps timeline-only notes. `document_and_saved_object`: notes on a timeline and linked to an event; post-filtering enforces a real `eventId`. `orphan`: not on a timeline and `eventId` is empty (stricter than missing `eventId` in some cases).

        '
      enum:
      - all
      - document_only
      - saved_object_only
      - document_and_saved_object
      - orphan
      type: string
    Security_Timeline_API_SortObject:
      description: Object indicating how rows are sorted in the Timeline's grid
      example:
        columnId: '@timestamp'
        sortDirection: desc
      type: object
      properties:
        columnId:
          nullable: true
          type: string
        columnType:
          nullable: true
          type: string
        sortDirection:
          nullable: true
          type: string
    Security_Timeline_API_DataProviderResult:
      type: object
      properties:
        and:
          items:
            $ref: '#/components/schemas/Security_Timeline_API_DataProviderQueryMatch'
          nullable: true
          type: array
        enabled:
          nullable: true
          type: boolean
        excluded:
          nullable: true
          type: boolean
        id:
          nullable: true
          type: string
        kqlQuery:
          nullable: true
          type: string
        name:
          nullable: true
          type: string
        queryMatch:
          $ref: '#/components/schemas/Security_Timeline_API_QueryMatchResult'
          nullable: true
        type:
          $ref: '#/components/schemas/Security_Timeline_API_DataProviderType'
          nullable: true
    Security_Timeline_API_ColumnHeaderResult:
      type: object
      properties:
        aggregatable:
          nullable: true
          type: boolean
        category:
          nullable: true
          type: string
        columnHeaderType:
          nullable: true
          type: string
        description:
          nullable: true
          type: string
        example:
          nullable: true
          type: string
        id:
          nullable: true
          type: string
        indexes:
          items:
            type: string
          nullable: true
          type: array
        name:
          nullable: true
          type: string
        placeholder:
          nullable: true
          type: string
        searchable:
          nullable: true
          type: boolean
        type:
          nullable: true
          type: string
    Security_Timeline_API_DocumentIds:
      description: One document ID or an array of IDs (Elasticsearch `_id` of the event).
      oneOf:
      - items:
          type: string
        type: array
      - type: string
    Security_Timeline_API_RowRendererId:
      description: Identifies the available row renderers
      enum:
      - alert
      - alerts
      - auditd
      - auditd_file
      - library
      - netflow
      - plain
      - registry
      - suricata
      - system
      - system_dns
      - system_endgame_process
      - system_file
      - system_fim
      - system_security_event
      - system_socket
      - threat_match
      - zeek
      type: string
    Security_Timeline_API_ImportTimelineResult:
      type: object
      properties:
        errors:
          description: The list of failed Timeline imports
          items:
            type: object
            properties:
              error:
                description: The error containing the reason why the timeline could not be imported
                type: object
                properties:
                  message:
                    description: The reason why the timeline could not be imported
                    example: Malformed JSON
                    type: string
                  status_code:
                    description: The HTTP status code of the error
                    example: 400
                    type: number
              id:
                description: The ID of the timeline that failed to import
                example: 6ce1b592-84e3-4b4a-9552-f189d4b82075
                type: string
          type: array
        success:
          description: Indicates whether any of the Timelines were successfully imports
          type: boolean
        success_count:
          description: The amount of successfully imported/updated Timelines
          example: 99
          type: number
        timelines_installed:
          description: The amount of successfully installed Timelines
          example: 80
          type: number
        timelines_updated:
          description: The amount of successfully updated Timelines
          example: 19
          type: number
    Security_Timeline_API_PersistPinnedEventResponse:
      oneOf:
      - $ref: '#/components/schemas/Security_Timeline_API_PinnedEvent'
      - type: object
        properties:
          unpinned:
            description: Indicates whether the event was successfully unpinned
            type: boolean
        required:
        - unpinned
    Security_Timeline_API_BareNote:
      allOf:
      - $ref: '#/components/schemas/Security_Timeline_API_NoteCreatedAndUpdatedMetadata'
      - type: object
        properties:
          eventId:
            description: 'Elasticsearch document `_id` for the event or alert this note refers to. Same value as the `documentIds` query parameter when fetching notes via GET /api/note.

              '
            example: d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc
            nullable: true
            type: string
          note:
            description: The text of the note
            example: This is an example text
            nullable: true
            type: string
          timelineId:
            description: The `savedObjectId` of the Timeline this note belongs to (not the note's own ID).
            example: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
            type: string
        required:
        - timelineId
    Security_Timeline_API_DataProviderQueryMatch:
      type: object
      properties:
        enabled:
          nullable: true
          type: boolean
        excluded:
          nullable: true
          type: boolean
        id:
          nullable: true
          type: string
        kqlQuery:
          nullable: true
          type: string
        name:
          nullable: true
          type: string
        queryMatch:
          $ref: '#/components/schemas/Security_Timeline_API_QueryMatchResult'
          nullable: true
        type:
          $ref: '#/components/schemas/Security_Timeline_API_DataProviderType'
          nullable: true
    Security_Timeline_API_FavoriteTimelineResponse:
      type: object
      properties:
        favorite:
          items:
            $ref: '#/components/schemas/Security_Timeline_API_FavoriteTimelineResult'
          type: array
        savedObjectId:
          type: string
        templateTimelineId:
          nullable: true
          type: string
        templateTimelineVersion:
          nullable: true
          type: number
        timelineType:
          $ref: '#/components/schemas/Security_Timeline_API_TimelineType'
        version:
          type: string
      required:
      - savedObjectId
      - version
    Security_Timeline_API_FilterTimelineResult:
      example:
        meta:
          alias: Custom filter name
          disabled: false
          index: .alerts-security.alerts-default,logs-*
          key: '@timestamp'
          negate: false,
          type: exists
          value: exists
        query: '{"exists":{"field":"@timestamp"}}'
      type: object
      properties:
        exists:
          nullable: true
          type: string
        match_all:
          nullable: true
          type: string
        meta:
          nullable: true
          type: object
          properties:
            alias:
              nullable: true
              type: string
            controlledBy:
              nullable: true
              type: string
            disabled:
              nullable: true
              type: boolean
            field:
              nullable: true
              type: string
            formattedValue:
              nullable: true
              type: string
            index:
              nullable: true
              type: string
            key:
              nullable: true
              type: string
            negate:
              nullable: true
              type: boolean
            params:
              nullable: true
              type: string
            type:
              nullable: true
              type: string
            value:
              nullable: true
              type: string
        missing:
          nullable: true
          type: string
        query:
          nullable: true
          type: string
        range:
          nullable: true
          type: string
        script:
          nullable: true
          type: string
    Security_Timeline_API_TimelineSavedToReturnObject:
      allOf:
      - $ref: '#/components/schemas/Security_Timeline_API_SavedTimeline'
      - type: object
        properties:
          eventIdToNoteIds:
            items:
              $ref: '#/components/schemas/Security_Timeline_API_Note'
            nullable: true
            type: array
          noteIds:
            items:
              type: string
            nullable: true
            type: array
          notes:
            items:
              $ref: '#/components/schemas/Security_Timeline_API_Note'
            nullable: true
            type: array
          pinnedEventIds:
            items:
              type: string
            nullable: true
            type: array
          pinnedEventsSaveObject:
            items:
              $ref: '#/components/schemas/Security_Timeline_API_PinnedEvent'
            nullable: true
            type: array
          savedObjectId:
            type: string
          version:
            type: string
        required:
        - savedObjectId
        - version
    Security_Timeline_API_SortFieldTimeline:
      description: The field to sort the timelines by.
      enum:
      - title
      - description
      - updated
      - created
      type: string
    Security_Timeline_API_SavedTimeline:
      type: object
      properties:
        columns:
          description: The Timeline's columns
          example:
          - columnHeaderType: not-filtered
            id: '@timestamp'
          - columnHeaderType: not-filtered
            id: event.category
          items:
            $ref: '#/components/schemas/Security_Timeline_API_ColumnHeaderResult'
          nullable: true
          type: array
        created:
          description: The time the Timeline was created, using a 13-digit Epoch timestamp.
          example: 1587468588922
          nullable: true
          type: number
        createdBy:
          description: The user who created the Timeline.
          example: casetester
          nullable: true
          type: string
        dataProviders:
          description: Object containing query clauses
          example:
          - enabled: true
            excluded: false
            id: id-d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bcbf66f57d124dcc739c98e6b
            name: d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bcbf66f57d124dcc739c98e6b
            queryMatch:
              field: _id,
              operator: ':'
              value: d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bcbf66f57d124dcc739c98e6b,
          items:
            $ref: '#/components/schemas/Security_Timeline_API_DataProviderResult'
          nullable: true
          type: array
        dataViewId:
          description: ID of the Timeline's Data View
          example: security-solution-default
          nullable: true
          type: string
        dateRange:
          description: The Timeline's search period.
          example:
            end: 1587456479201
            start: 1587370079200
          nullable: true
          type: object
          properties:
            end:
              oneOf:
              - nullable: true
                type: string
              - nullable: true
                type: number
            start:
              oneOf:
              - nullable: true
                type: string
              - nullable: true
                type: number
        description:
          description: The Timeline's description
          example: Investigating exposure of CVE XYZ
          nullable: true
          type: string
        eqlOptions:
          description: EQL query that is used in the correlation tab
          example:
            eventCategoryField: event.category
            query: sequence\n[process where process.name == "sudo"]\n[any where true]
            size: 100
            timestampField: '@timestamp'
          nullable: true
          type: object
          properties:
            eventCategoryField:
              nullable: true
              type: string
            query:
              nullable: true
              type: string
            size:
              oneOf:
              - nullable: true
                type: string
              - nullable: true
                type: number
            tiebreakerField:
              nullable: true
              type: string
            timestampField:
              nullable: true
              type: string
        eventType:
          deprecated: true
          description: Event types displayed in the Timeline
          example: all
          nullable: true
          type: string
        excludedRowRendererIds:
          description: A list of row renderers that should not be used when in `Event renderers` mode
          items:
            $ref: '#/components/schemas/Security_Timeline_API_RowRendererId'
          nullable: true
          type: array
        favorite:
          items:
            $ref: '#/components/schemas/Security_Timeline_API_FavoriteTimelineResult'
          nullable: true
          type: array
        filters:
          description: A list of filters that should be applied to the query
          items:
            $ref: '#/components/schemas/Security_Timeline_API_FilterTimelineResult'
          nullable: true
          type: array
        indexNames:
          description: A list of index names to use in the query (e.g. when the default data view has been modified)
          example:
          - .logs*
          items:
            type: string
          nullable: true
          type: array
        kqlMode:
          description: "Indicates whether the KQL bar filters the query results or searches for additional results, where:\n  * `filter`: filters query results\n  * `search`: displays additional search results"
          example: search
          nullable: true
          type: string
        kqlQuery:
          $ref: '#/components/schemas/Security_Timeline_API_SerializedFilterQueryResult'
          nullable: true
        savedQueryId:
          description: The ID of the saved query that might be used in the Query tab
          example: c7b16904-02d7-4f32-b8f2-cc20f9625d6e
          nullable: true
          type: string
        savedSearchId:
          description: The ID of the saved search that is used in the ES|QL tab
          example: 6ce1b592-84e3-4b4a-9552-f189d4b82075
          nullable: true
          type: string
        sort:
          $ref: '#/components/schemas/Security_Timeline_API_Sort'
          nullable: true
        status:
          $ref: '#/components/schemas/Security_Timeline_API_TimelineStatus'
          nullable: true
        templateTimelineId:
          description: A unique ID (UUID) for Timeline templates. For Timelines, the value is `null`.
          example: 6ce1b592-84e3-4b4a-9552-f189d4b82075
          nullable: true
          type: string
        templateTimelineVersion:
          description: Timeline template version number. For Timelines, the value is `null`.
          example: 12
          nullable: true
          type: number
        timelineType:
          $ref: '#/components/schemas/Security_Timeline_API_TimelineType'
          nullable: true
        title:
          description: The Timeline's title.
          example: CVE XYZ investigation
          nullable: true
          type: string
        updated:
          description: The last time the Timeline was updated, using a 13-digit Epoch timestamp
          example: 1741344876825
          nullable: true
          type: number
        updatedBy:
          description: The user who last updated the Timeline
          example: casetester
          nullable: true
          type: string
    Security_Timeline_API_TimelineStatus:
      description: The status of the Timeline.
      enum:
      - active
      - draft
      - immutable
      type: string
    Security_Timeline_API_ResponseNote:
      type: object
      properties:
        note:
          $ref: '#/components/schemas/Security_Timeline_API_Note'
      required:
      - note
    Security_Timeline_API_SavedObjectResolveAliasPurpose:
      enum:
      - savedObjectConversion
      - savedObjectImport
      type: string
    Security_Timeline_API_ResolvedTimeline:
      type: object
      properties:
        alias_purpose:
          $ref: '#/components/schemas/Security_Timeline_API_SavedObjectResolveAliasPurpose'
        alias_target_id:
          type: string
        outcome:
          $ref: '#/components/schemas/Security_Timeline_API_SavedObjectResolveOutcome'
        timeline:
          $ref: '#/components/schemas/Security_Timeline_API_TimelineSavedToReturnObject'
      required:
      - timeline
      - outcome
    Security_Timeline_API_Note:
      allOf:
      - $ref: '#/components/schemas/Security_Timeline_API_BareNote'
      - type: object
        properties:
          noteId:
            description: The `savedObjectId` of the note
            example: 709f99c6-89b6-4953-9160-35945c8e174e
            type: string
          version:
            description: The version of the note
            example: WzQ2LDFd
            type: string
        required:
        - noteId
        - version
  securitySchemes:
    apiKeyAuth:
      description: 'These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: `Authorization: ApiKey base64AccessApiKey`

        '
      in: header
      name: Authorization
      type: apiKey
    basicAuth:
      scheme: basic
      type: http
x-topics:
- title: Kibana spaces
  content: "Spaces enable you to organize your dashboards and other saved objects into meaningful categories.\nYou can use the default space or create your own spaces.\n\nTo run APIs in non-default spaces, you must add `s/{space_id}/` to the path.\nFor example:\n\n```bash\ncurl -X GET \"http://${KIBANA_URL}/s/marketing/api/data_views\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n```\n\nIf you use the Kibana console to send API requests, it automatically adds the appropriate space identifier.\n\nTo learn more, check out [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces).\n"