Kibana Security Timeline API API is one of 60 APIs that Kibana publishes on the APIs.io network, described by a machine-readable OpenAPI specification.
Tagged areas include Security Timeline API. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, and authentication docs.
This API exposes
17 operations
across 11 paths,
and defines 36 schemas.
It is described by OpenAPI 3.0.3.
Requests are made against a single base URL, https://{kibana_url}.
17 operations11 paths36 schemas2 DELETE5 GET4 PATCH6 POST
Metadata
The identity and technical contract details declared by the specification.
Specification
OpenAPI 3.0.3
Base URL
https://localhost:5601/api
Authentication
API Key, HTTP Basic
Contact
Kibana Team
Resource Areas
1
Authentication & Security 2
Kibana Security Timeline API API declares
2 security schemes
for authenticating requests.
An API key is passed in the header as Authorization (apiKeyAuth).
It accepts HTTP basic authentication (basicAuth).
By default, every request must be authenticated.
apiKeyAuth — These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64A…
Paths & Operations 17
Across 11 paths, the API surfaces 17 operations — 2 DELETE, 5 GET, 4 PATCH, 6 POST. Each is listed below with its method, path, parameters, and response codes.
Security Timeline API 17
You can create Timelines and Timeline templates via the API, as well as import new Timelines from an ndjson file.
DELETE
/api/note
Delete one or more notes
DeleteNotebody→ 200
GET
/api/note
Get notes
GetNotes10 params→ 200
PATCH
/api/note
Add or update a note
PersistNoteRoutebody→ 200
PATCH
/api/pinned_event
Pin/unpin an event
PersistPinnedEventRoutebody→ 200
DELETE
/api/timeline
Delete Timelines or Timeline templates
DeleteTimelinesbody→ 200
GET
/api/timeline
Get Timeline or Timeline template details
GetTimeline2 params→ 200
PATCH
/api/timeline
Update a Timeline
PatchTimelinebody→ 200405
POST
/api/timeline
Create a Timeline or Timeline template
CreateTimelinesbody→ 200405
POST
/api/timeline/_copy
Copies timeline or timeline template
CopyTimelinebody→ 200
GET
/api/timeline/_draft
Get draft Timeline or Timeline template details
GetDraftTimelines1 param→ 200403409
POST
/api/timeline/_draft
Create a clean draft Timeline or Timeline template
CleanDraftTimelinesbody→ 200403409
POST
/api/timeline/_export
Export Timelines
ExportTimelines1 parambody→ 200400
PATCH
/api/timeline/_favorite
Favorite a Timeline or Timeline template
PersistFavoriteRoutebody→ 200403
POST
/api/timeline/_import
Import Timelines
ImportTimelinesbody→ 200400404409
POST
/api/timeline/_prepackaged
Install prepackaged Timelines
InstallPrepackedTimelinesbody→ 200500
GET
/api/timeline/resolve
Resolve a Timeline or Timeline template
ResolveTimeline2 params→ 200400404
GET
/api/timelines
Get Timelines or Timeline templates
GetTimelines8 params→ 200400
Schemas 36
The contract defines 36 schemas that model the data the API accepts and returns. The most detailed are Security_Timeline_API_SavedTimeline (25 properties), Security_Timeline_API_ColumnHeaderResult (11 properties), Security_Timeline_API_DataProviderResult (8 properties), Security_Timeline_API_DataProviderQueryMatch (7 properties). Each schema is shown below with its type and property counts.
Indicates when and who marked a Timeline as a favorite.
3 properties
Security_Timeline_API_AssociatedFilterType
string
How the note is associated with a Timeline saved object and/or an event (eventId). all: no association-based restriction from this parameter. documentonly: doc…
Security_Timeline_API_SortObject
object
Object indicating how rows are sorted in the Timeline's grid
3 properties
Security_Timeline_API_DataProviderResult
object
8 properties
Security_Timeline_API_ColumnHeaderResult
object
11 properties
Security_Timeline_API_DocumentIds
One document ID or an array of IDs (Elasticsearch id of the event).
