# Get notes

**GET /api/note**

**Spaces method and path for this operation:**

<div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/note</span></div>

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Returns Security Timeline notes as saved objects.

**Query modes (mutually exclusive branches on the server):**

1. **`documentIds` is set** — Returns notes whose `eventId` matches the given Elasticsearch document `_id` (single string or array). Pagination query parameters (`page`, `perPage`, etc.) are **not** applied; the server uses a fixed page size (up to 10000 notes).

2. **`savedObjectIds` is set** — Returns notes linked to the given Timeline saved object id(s). Same fixed cap as above; list-mode query parameters are **not** applied.

3. **Neither `documentIds` nor `savedObjectIds`** — Lists notes using saved-objects find semantics: `page` (default 1), `perPage` (default 10), optional `search`, `sortField`, `sortOrder`, `filter`, `createdByFilter`, and `associatedFilter`.

Requires the **Timeline and Notes** read privilege (`notes_read`).



## Servers
- https://localhost:5601: https://localhost:5601 ()


## Authentication methods
- Api key auth
- Basic auth


## Parameters


### Query parameters
- **documentIds** (array[string] | string)
  Event document `_id` values to match against each note's `eventId`. When this parameter is present, the response is all matching notes (up to the server's hard limit), not a paged list using `page`/`perPage`.
- **savedObjectIds** (array[string] | string)
  Timeline `savedObjectId` value(s). Returns notes that reference those timelines. When present, list-mode pagination parameters are not used; up to the server's hard limit of notes may be returned.
- **page** (string | null)
  Page number for list mode (when `documentIds` and `savedObjectIds` are omitted). Passed as a string; default 1.
- **perPage** (string | null)
  Page size for list mode (when `documentIds` and `savedObjectIds` are omitted). Passed as a string; default 10.
- **search** (string | null)
  Search string for saved-objects find (list mode only).
- **sortField** (string | null)
  Field to sort by for saved-objects find (list mode only).
- **sortOrder** (string | null)
  Sort order (`asc` or `desc`) for saved-objects find (list mode only).
- **filter** (string | null)
  Kuery filter string combined with other list-mode filters (for example `createdByFilter` or `associatedFilter`). Typed as a string for API compatibility; interpreted by the saved-objects layer (list mode only).
- **createdByFilter** (string | null)
  Kibana user profile **UID** (UUID). The server resolves the user's display identifiers and returns notes whose `createdBy` matches any of them (list mode only).
- **associatedFilter** (string)
  Restricts notes by how they relate to a Timeline and/or an event document (list mode only). Some values apply extra filtering after the query. Ignored when `documentIds` or `savedObjectIds` is used.


## Responses
### 200
Notes and total count for the requested mode.

#### Body: application/json (object)
- **notes** (array[object])

- **totalCount** (number)
  Number of notes returned (may be adjusted after the query when `associatedFilter` applies post-filtering).


[Powered by Bump.sh](https://bump.sh)