Path parameters

• caseId string Required

  The identifier for the case. To retrieve case IDs, use the search cases (_find) API. All non-ASCII characters must be URL encoded.

Query parameters

• type string | array[string]

  Filters the returned attachments by one or more attachment types, such as comment or security.alert. To filter by multiple types, repeat the parameter. Limited to 20 types.

• page integer

  The page number to return.

  Default value is 1.

• perPage integer

  The number of items to return. Limited to 100 items.

  Maximum value is 100. Default value is 20.

• sortOrder string

  Sorts attachments by creation date: asc (oldest first) or desc (newest first).

  Values are asc or desc. Default value is asc.

Responses

• 200 application/json

  Indicates a successful call.

  Hide response attributes Show response attributes object

  • data array[object] Required

    The attachments on the requested page.

    Hide data attributes Show data attributes object

    • attachmentId string | array[string]

      The ID of the attached item, such as an alert or a dashboard. To attach several alerts, use an array. This isn't the attachment's own ID (id).

      One of:

      string-1 string array-2 array[string]
    • created_at string(date-time) Required
    • created_by object Required
      Hide created_by attributes Show created_by attributes object

      • email string | null Required
      • full_name string | null Required
      • profile_uid string
      • username string | null Required
    • data object | null

      The attachment's content. Required for comments, where content is the comment text (up to 30,000 characters). In requests, it can be up to 524,288 characters when serialized as JSON and nest up to 30 levels deep.

      Additional properties are allowed.

    • id string Required

      The attachment identifier.

    • metadata object | null

      Extra details about the attachment. For alerts, this is the alert's index and rule. Required for some types, such as dashboard. In requests, it can be up to 524,288 characters when serialized as JSON and nest up to 30 levels deep.

      Additional properties are allowed.

    • owner string Required

      The application that owns the cases: Stack Management, Observability, or Elastic Security.

      Values are cases, observability, or securitySolution.

    • pushed_at string(date-time) | null Required

      When this attachment was last pushed to an external system, such as Jira. Is null if it hasn't been pushed.

    • pushed_by object | null Required
      Hide pushed_by attributes Show pushed_by attributes object | null

      • email string | null Required
      • full_name string | null Required
      • profile_uid string
      • username string | null Required
    • type string Required

      The attachment type, such as comment, security.alert, observability.alert, stack.alert, security.event, lens, dashboard, or file. security.* types only work on Security cases, observability.* on Observability cases, and stack.* on Stack Management cases. Use comment (not the legacy user type) and a *.alert type (not alert). You can't add or replace file attachments with this API. To add a file, use POST /api/cases/{caseId}/files.

    • updated_at string(date-time) | null Required
    • updated_by object | null Required
      Hide updated_by attributes Show updated_by attributes object | null

      • email string | null Required
      • full_name string | null Required
      • profile_uid string
      • username string | null Required
    • version string Required

      The attachment's current version. Include it when you replace the attachment.

  • page integer Required

    The current page number.

  • per_page integer Required

    The number of items per page.

  • total integer Required

    The total number of matching attachments you can access. Attachments with invalid or unsupported data are counted but not returned, so a page can have fewer than per_page items.

• 400 application/json

  A query parameter is invalid or exceeds its limit.

  Hide response attributes Show response attributes object

  • error string
  • message string
  • statusCode integer
• 401 application/json

  Authorization information is missing or invalid.

  Hide response attributes Show response attributes object

  • error string
  • message string
  • statusCode integer