Elastic Stack

Elastic Stack (ELK Stack) Security Timeline API

You can create Timelines and Timeline templates via the API, as well as import new Timelines from an ndjson file.

GitHub OpenAPI
Business capability
Threat Detection & Response Management BC-620.30

Operations 17

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

DELETE /api/note Delete one or more Timeline notes · Delete one or more notes #
Ask an LLM
“How do I remove a note I left on a Timeline investigation?”
“Can I delete several investigation notes in one request?”
Tell an agent destructive · confirm first
Delete the note I added to the investigation.
Remove these Timeline notes permanently.
GET /api/note List investigation notes · Get notes #
Ask an LLM
“What notes have analysts left on a particular alert or event document?”
“Can I find only the notes I created myself?”
Tell an agent
Get the notes attached to documents {documentIds}.
List notes on Timeline {savedObjectIds}, sorted by {sortField}.
PATCH /api/note Add or edit a note on a Timeline or event · Add or update a note #
Ask an LLM
“How do I add a note to a Timeline or to an event in it?”
“Can I edit an existing investigation note if I know its ID?”
Tell an agent
Add note {note} to the Timeline.
Update note {noteId} at version {version} to read {note}.
PATCH /api/pinned_event Pin or unpin an event in a Timeline · Pin/unpin an event #
Ask an LLM
“How do I pin an important event so it stays at the top of a Timeline?”
“Can I unpin an event I pinned earlier?”
Tell an agent
Pin event {eventId} in Timeline {timelineId}.
Unpin event {eventId} from Timeline {timelineId} using pinned event {pinnedEventId}.
DELETE /api/timeline Delete Timelines or templates · Delete Timelines or Timeline templates #
Ask an LLM
“How do I delete old Timeline investigations I no longer need?”
“Can I delete several Timelines and templates in one request?”
Tell an agent destructive · confirm first
Delete Timelines {savedObjectIds}.
Remove the Timeline templates with saved object IDs {savedObjectIds}.
GET /api/timeline Get a saved Timeline or template · Get Timeline or Timeline template details #
Ask an LLM
“How do I load a saved Timeline investigation by its ID?”
“Can I fetch a Timeline template by its template ID?”
Tell an agent
Get the saved Timeline with ID {id}.
Fetch Timeline template {template_timeline_id}.
PATCH /api/timeline Update an existing Timeline · Update a Timeline #
Ask an LLM
“How do I change the title or query of a Timeline I already saved?”
“Why does updating a Timeline require its current version?”
Tell an agent
Update Timeline {timelineId} at version {version} with {timeline}.
Rename existing Timeline {timelineId} (version {version}) using changes {timeline}.
POST /api/timeline Create a Timeline or Timeline template · Create a Timeline or Timeline template #
Ask an LLM
“How do I create a new Timeline for a security investigation?”
“Can I save a new Timeline as a reusable template instead?”
Tell an agent
Create a new Timeline from {timeline}.
Create a {timelineType} Timeline with definition {timeline}.
POST /api/timeline/_copy Duplicate a Timeline or template · Copies timeline or timeline template #
Ask an LLM
“Can I make a copy of an existing Timeline to start a new investigation from it?”
“How do I duplicate a Timeline template?”
Tell an agent
Copy Timeline {timelineIdToCopy} with overrides {timeline}.
Duplicate Timeline {timelineIdToCopy} into a new one defined by {timeline}.
GET /api/timeline/_draft Get my current draft Timeline · Get draft Timeline or Timeline template details #
Ask an LLM
“Where is the unsaved draft Timeline I was working on?”
“Can I retrieve my draft Timeline template separately from a regular draft?”
Tell an agent
Get my draft Timeline of type {timelineType}.
Show the current {timelineType} draft details.
POST /api/timeline/_draft Start a clean draft Timeline · Create a clean draft Timeline or Timeline template #
Ask an LLM
“How do I reset my draft Timeline to a blank one?”
“Can I start a fresh draft Timeline template?”
Tell an agent
Create a clean {timelineType} draft Timeline.
Reset my draft to an empty {timelineType} Timeline.
POST /api/timeline/_export Export Timelines to a file · Export Timelines #
Ask an LLM
“How do I export saved Timelines to an ndjson file for backup?”
“Can I export just a few selected Timelines?”
Tell an agent
Export Timelines {ids} to file {file_name}.
Export all Timelines into {file_name}.
PATCH /api/timeline/_favorite Favorite or unfavorite a Timeline · Favorite a Timeline or Timeline template #
Ask an LLM
“How do I star a Timeline so it shows up in my favorites?”
“Can I favorite a Timeline template as well as a regular Timeline?”
Tell an agent
Favorite Timeline {timelineId} of type {timelineType}, template {templateTimelineId} version {templateTimelineVersion}.
Toggle favorite on {timelineType} {timelineId} (template {templateTimelineId}, v{templateTimelineVersion}).
POST /api/timeline/_import Import Timelines from a file · Import Timelines #
Ask an LLM
“How do I import Timelines exported from another Kibana?”
“Can imported Timelines be marked immutable?”
Tell an agent
Import Timelines from file {file}.
Import {file} as Timelines with immutable set to {isImmutable}.
POST /api/timeline/_prepackaged Install Elastic prebuilt Timeline templates · Install prepackaged Timelines #
Ask an LLM
“How do I install the prepackaged Timeline templates that ship with Elastic Security?”
“Can I update prebuilt Timelines that are already installed?”
Tell an agent
Install prepackaged Timelines {timelinesToInstall} and update {timelinesToUpdate} from {prepackagedTimelines}.
Load the prebuilt set {prepackagedTimelines}, installing {timelinesToInstall} and refreshing {timelinesToUpdate}.
GET /api/timeline/resolve Resolve a Timeline ID after space migration · Resolve a Timeline or Timeline template #
Ask an LLM
“How do I resolve a Timeline whose ID may have changed after a space migration?”
“Can I tell whether a Timeline link points to an alias or a conflicting object?”
Tell an agent
Resolve Timeline {id} and report its outcome.
Resolve template Timeline {template_timeline_id} to its current saved object.
GET /api/timelines List saved Timelines and templates · Get Timelines or Timeline templates #
Ask an LLM
“What saved Timelines exist in this space?”
“Can I list only my favorite Timelines?”
Tell an agent
List {timeline_type} Timelines sorted by {sort_field} {sort_order}.
Search saved Timelines for {search}.

Documentation

📖
Documentation
https://www.elastic.co/docs/reference/elasticsearch
📖
APIReference
https://www.elastic.co/docs/api/doc/elasticsearch/
📖
Documentation
https://www.elastic.co/docs/reference/kibana
📖
APIReference
https://www.elastic.co/docs/api/doc/kibana/

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/openapi/elk-stack-security-timeline-api-api-openapi.yml

Other Resources

🔗
SourceCode
https://github.com/elastic/elasticsearch-specification
🔗
SourceCode
https://github.com/elastic/kibana
🔗
ToolCrosswalk
https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/mcp/elk-stack-tool-crosswalk.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/elk-stack:elk-stack-security-timeline-api-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

elk-stack-security-timeline-api-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  contact:
    name: Kibana Team
  description: The Kibana REST APIs enable you to manage resources such as connectors, data views, and saved objects.
  title: Kibana Security Timeline API
  version: ''
  x-doc-license:
    name: Attribution-NonCommercial-NoDerivatives 4.0 International
    url: https://creativecommons.org/licenses/by-nc-nd/4.0/
  x-feedbackLink:
    label: Feedback
    url: https://github.com/elastic/docs-content/issues/new?assignees=&labels=feedback%2Ccommunity&projects=&template=api-feedback.yaml&title=%5BFeedback%5D%3A+
servers:
- url: https://{kibana_url}
  variables:
    kibana_url:
      default: localhost:5601
security:
- apiKeyAuth: []
- basicAuth: []
tags:


# --- truncated at 32 KB (78 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/openapi/elk-stack-security-timeline-api-api-openapi.yml