Headers

• kbn-xsrf string Required

  Cross-site request forgery protection

Path parameters

• caseId string Required

  The identifier for the case. To retrieve case IDs, use the search cases (_find) API. All non-ASCII characters must be URL encoded.

Responses

• 201 application/json

  Indicates a successful call. Returns the new attachment, or the existing one if the alert or event was already attached.

  Hide response attributes Show response attributes object

  • attachmentId string | array[string]

    The ID of the attached item, such as an alert or a dashboard. To attach several alerts, use an array. This isn't the attachment's own ID (id).

    One of:

    string-1 string array-2 array[string]
  • created_at string(date-time) Required
  • created_by object Required
    Hide created_by attributes Show created_by attributes object

    • email string | null Required
    • full_name string | null Required
    • profile_uid string
    • username string | null Required
  • data object | null

    The attachment's content. Required for comments, where content is the comment text (up to 30,000 characters). In requests, it can be up to 524,288 characters when serialized as JSON and nest up to 30 levels deep.

    Additional properties are allowed.

  • id string Required

    The attachment identifier.

  • metadata object | null

    Extra details about the attachment. For alerts, this is the alert's index and rule. Required for some types, such as dashboard. In requests, it can be up to 524,288 characters when serialized as JSON and nest up to 30 levels deep.

    Additional properties are allowed.

  • owner string Required

    The application that owns the cases: Stack Management, Observability, or Elastic Security.

    Values are cases, observability, or securitySolution.

  • pushed_at string(date-time) | null Required

    When this attachment was last pushed to an external system, such as Jira. Is null if it hasn't been pushed.

  • pushed_by object | null Required
    Hide pushed_by attributes Show pushed_by attributes object | null

    • email string | null Required
    • full_name string | null Required
    • profile_uid string
    • username string | null Required
  • type string Required

    The attachment type, such as comment, security.alert, observability.alert, stack.alert, security.event, lens, dashboard, or file. security.* types only work on Security cases, observability.* on Observability cases, and stack.* on Stack Management cases. Use comment (not the legacy user type) and a *.alert type (not alert). You can't add or replace file attachments with this API. To add a file, use POST /api/cases/{caseId}/files.

  • updated_at string(date-time) | null Required
  • updated_by object | null Required
    Hide updated_by attributes Show updated_by attributes object | null

    • email string | null Required
    • full_name string | null Required
    • profile_uid string
    • username string | null Required
  • version string Required

    The attachment's current version. Include it when you replace the attachment.

• 400 application/json

  The request failed for one of these reasons:

  • The request body is invalid.
  • The attachment type isn't registered, or is file.
  • The owner doesn't match the case owner.
  • A case limit was exceeded.
  Hide response attributes Show response attributes object

  • error string
  • message string
  • statusCode integer
• 401 application/json

  Authorization information is missing or invalid.

  Hide response attributes Show response attributes object

  • error string
  • message string
  • statusCode integer
• 403 application/json

  You don't have the required privileges for this case.

  Hide response attributes Show response attributes object

  • error string
  • message string
  • statusCode integer
• 404 application/json

  The case was not found.

  Hide response attributes Show response attributes object

  • error string
  • message string
  • statusCode integer