Delete a case attachment Technical preview; added in 9.6.0

DELETE /api/cases/{caseId}/attachments/{attachmentId}
Api key auth Basic auth

Spaces method and path for this operation:

delete /s/{space_id}/api/cases/{caseId}/attachments/{attachmentId}

Refer to Spaces for more information.

Deletes a single attachment from a case. If it's a file, the file is also deleted. If it's an attack (security.attack), the alerts it added are also removed from the case, unless they're attached separately or by another attack. You must have all privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case.

Headers

  • kbn-xsrf string Required

    Cross-site request forgery protection

Path parameters

  • caseId string Required

    The identifier for the case. To retrieve case IDs, use the search cases (_find) API. All non-ASCII characters must be URL encoded.

  • attachmentId string Required

    The ID of the attachment, which is its id field, not attachmentId. To get it, use the find case attachments API.

    Maximum length is 512.

Responses

  • 204

    Indicates a successful call.

  • 401 application/json

    Authorization information is missing or invalid.

    Hide response attributes Show response attributes object
    • error string
    • message string
    • statusCode integer
  • 403 application/json

    You don't have the required privileges for this case.

    Hide response attributes Show response attributes object
    • error string
    • message string
    • statusCode integer
  • 404 application/json

    The attachment was not found in the case.

    Hide response attributes Show response attributes object
    • error string
    • message string
    • statusCode integer
DELETE /api/cases/{caseId}/attachments/{attachmentId} 
curl \
 --request DELETE 'https://localhost:5601/api/cases/9c235210-6834-11ea-a78c-6ffb38a34414/attachments/71ec1870-725b-11ea-a0b2-c51ea50a58e2' \
 --header "Authorization: $API_KEY" \
 --header "kbn-xsrf: string"
Response examples (401) 
{
  "error": "Unauthorized",
  "message": "Unable to authenticate with the provided credentials.",
  "statusCode": 401
}
Response examples (403) 
{
  "error": "Forbidden",
  "message": "Unauthorized to access cases",
  "statusCode": 403
}
Response examples (404) 
{
  "error": "Not Found",
  "message": "Saved object [cases-template/9da1ea2a-09f8-4d0e-bf9d-09bf8c9d0f42] not found",
  "statusCode": 404
}