How AI is applied across API Evangelist and APIs.io. Read my AI disclosure →
API Evangelist API Evangelist
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC

Elastic Stack (ELK Stack) Security Timeline API

You can create Timelines and Timeline templates via the API, as well as import new Timelines from an ndjson file.

Elastic Stack (ELK Stack) Security Timeline API is one of 132 APIs that Elastic Stack (ELK Stack) publishes on the APIs.io network, described by a machine-readable OpenAPI specification.

Tagged areas include Security Timeline API. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, and an API reference.

This API exposes 17 operations across 11 paths, and defines 36 schemas. It is described by OpenAPI 3.2.0.

Requests are made against a single base URL, https://{kibana_url}.

17 operations 11 paths 36 schemas 2 DELETE5 GET4 PATCH6 POST

Metadata

The identity and technical contract details declared by the specification.

Specification
OpenAPI 3.2.0
Base URL
https://{elasticsearch_endpoint}
Authentication
API Key, HTTP Basic
Contact
Kibana Team
Resource Areas
1

Authentication & Security 2

Elastic Stack (ELK Stack) Security Timeline API declares 2 security schemes for authenticating requests. An API key is passed in the header as Authorization (apiKeyAuth). It accepts HTTP basic authentication (basicAuth). By default, every request must be authenticated.

  • apiKeyAuth — These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64A…

Paths & Operations 17

Across 11 paths, the API surfaces 17 operations — 2 DELETE, 5 GET, 4 PATCH, 6 POST. Each is listed below with its method, path, parameters, and response codes.

Security Timeline API 17

You can create Timelines and Timeline templates via the API, as well as import new Timelines from an ndjson file.

DELETE
/api/note
Delete one or more notes
DeleteNote body → 200
GET
/api/note
Get notes
GetNotes 10 params → 200
PATCH
/api/note
Add or update a note
PersistNoteRoute body → 200
PATCH
/api/pinned_event
Pin/unpin an event
PersistPinnedEventRoute body → 200
DELETE
/api/timeline
Delete Timelines or Timeline templates
DeleteTimelines body → 200
GET
/api/timeline
Get Timeline or Timeline template details
GetTimeline 2 params → 200
PATCH
/api/timeline
Update a Timeline
PatchTimeline body → 200405
POST
/api/timeline
Create a Timeline or Timeline template
CreateTimelines body → 200405
POST
/api/timeline/_copy
Copies timeline or timeline template
CopyTimeline body → 200
GET
/api/timeline/_draft
Get draft Timeline or Timeline template details
GetDraftTimelines 1 param → 200403409
POST
/api/timeline/_draft
Create a clean draft Timeline or Timeline template
CleanDraftTimelines body → 200403409
POST
/api/timeline/_export
Export Timelines
ExportTimelines 1 param body → 200400
PATCH
/api/timeline/_favorite
Favorite a Timeline or Timeline template
PersistFavoriteRoute body → 200403
POST
/api/timeline/_import
Import Timelines
ImportTimelines body → 200400404409
POST
/api/timeline/_prepackaged
Install prepackaged Timelines
InstallPrepackedTimelines body → 200500
GET
/api/timeline/resolve
Resolve a Timeline or Timeline template
ResolveTimeline 2 params → 200400404
GET
/api/timelines
Get Timelines or Timeline templates
GetTimelines 8 params → 200400

Schemas 36

The contract defines 36 schemas that model the data the API accepts and returns. The most detailed are Security_Timeline_API_SavedTimeline (25 properties), Security_Timeline_API_ColumnHeaderResult (11 properties), Security_Timeline_API_DataProviderResult (8 properties), Security_Timeline_API_DataProviderQueryMatch (7 properties). Each schema is shown below with its type and property counts.

Security_Timeline_API_DocumentIds
One document ID or an array of IDs (Elasticsearch id of the event).
Security_Timeline_API_ResolvedTimeline
object
4 properties 2 required
Security_Timeline_API_BareNote
Security_Timeline_API_FavoriteTimelineResult
object
Indicates when and who marked a Timeline as a favorite.
3 properties
Security_Timeline_API_DataProviderType
string
The type of data provider.
Security_Timeline_API_TimelineSavedToReturnObject
Security_Timeline_API_TimelineType
string
The type of Timeline.
Security_Timeline_API_PinnedEventCreatedAndUpdatedMetadata
object
4 properties
Security_Timeline_API_FavoriteTimelineResponse
object
6 properties 2 required
Security_Timeline_API_TimelineResponse
Security_Timeline_API_SortObject
object
Object indicating how rows are sorted in the Timeline's grid
3 properties
Security_Timeline_API_Sort
Security_Timeline_API_QueryMatchResult
object
5 properties
Security_Timeline_API_GetNotesResult
object
2 properties 2 required
Security_Timeline_API_ImportTimelineResult
object
5 properties
Security_Timeline_API_RowRendererId
string
Identifies the available row renderers
Security_Timeline_API_SavedObjectResolveAliasPurpose
string
Security_Timeline_API_Note
Security_Timeline_API_ResponseNote
object
1 property 1 required
Security_Timeline_API_FilterTimelineResult
object
7 properties
Security_Timeline_API_SortFieldTimeline
string
The field to sort the timelines by.
Security_Timeline_API_SerializedFilterQueryResult
object
KQL bar query.
1 property
Security_Timeline_API_SavedObjectResolveOutcome
string
Security_Timeline_API_SavedTimelineWithSavedObjectId
Security_Timeline_API_AssociatedFilterType
string
How the note is associated with a Timeline saved object and/or an event (eventId). all: no association-based restriction from this parameter. documentonly: doc…
Security_Timeline_API_PinnedEvent
Security_Timeline_API_SavedObjectIds
One Timeline saved object ID or an array of IDs.
Security_Timeline_API_NoteCreatedAndUpdatedMetadata
object
4 properties
Security_Timeline_API_ColumnHeaderResult
object
11 properties
Security_Timeline_API_ImportTimelines
Security_Timeline_API_DataProviderResult
object
8 properties
Security_Timeline_API_PersistPinnedEventResponse
Security_Timeline_API_BarePinnedEvent
Security_Timeline_API_TimelineStatus
string
The status of the Timeline.
Security_Timeline_API_DataProviderQueryMatch
object
7 properties
Security_Timeline_API_SavedTimeline
object
25 properties

Specification

The full machine-readable OpenAPI contract behind this narrative.

Source

elk-stack-security-timeline-api-api-openapi.yml Raw ↑

Other APIs Elastic Stack (ELK Stack) publishes across the network.

Elastic Cloud API
Elastic Stack (ELK Stack) Accounts API
Elastic Stack (ELK Stack) Actions API
Elastic Stack (ELK Stack) agent builder API
Elastic Stack (ELK Stack) Alerting API
Elastic Stack (ELK Stack) Alerting V2 API
Elastic Stack (ELK Stack) Analytics API
Elastic Stack (ELK Stack) APM agent configuration API
Elastic Stack (ELK Stack) APM agent keys API
Elastic Stack (ELK Stack) APM annotations API
Elastic Stack (ELK Stack) APM server schema API
Elastic Stack (ELK Stack) APM sourcemaps API
Where this information came from

This is an independent, third-party profile of Elastic Stack (ELK Stack) Security Timeline API, published by API Evangelist. We do not operate, host, resell, or support these APIs, and we are not affiliated with or endorsed by the company unless stated above. Everything here is built from publicly available information — the company's own site, developer portal, documentation, public repositories, and the specifications it publishes for public use. Nothing is obtained by breaching a system, defeating an access control, or using credentials.

The Kin Score and Agent Readiness rating are independently calculated assessments of a company's public API artifacts, scored against a published rubric. They are not certifications, endorsements, security assessments, or audits.

Corrections, re-scores, and removal are free — no partnership or purchase required, and you do not need to justify the request. A removed company is recorded as unrated, never scored zero for having asked. Acknowledgement within one business day; removal within two.

info@apievangelist.com · Read the full data-sourcing policy →
On a security or compliance team? Put security in the subject line and you will get a person, not a form — we will tell you exactly which public URLs this profile was built from.