Get tags API

edit

Aggregates and returns a list of case tags.

Request

edit

GET <kibana host>:<port>/api/cases/tags

GET <kibana host>:<port>/s/<space_id>/api/cases/tags

Prerequisites

edit

You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases you’re seeking.

Path parameters

edit
<space_id>
(Optional, string) An identifier for the space. If it is not specified, the default space is used.

Query parameters

edit
owner
(Optional, string or array of strings) A filter to limit the retrieved tags to a specific set of applications. Valid values are: cases, observability, and securitySolution. If this parameter is omitted, the response contains tags from all cases that the user has access to read.

Response codes

edit
200
Indicates a successful call.

Examples

edit
GET api/cases/tags

The API returns a JSON object with tags from all the cases that the user has access to read. For example:

[
  "windows",
  "phishing",
  "social engineering",
  "bubblegum"
]