Path parameters

• caseId string Required

  The identifier for the case. To retrieve case IDs, use the search cases (_find) API. All non-ASCII characters must be URL encoded.

• attachmentId string Required

  The ID of the attachment, which is its id field, not attachmentId. To get it, use the find case attachments API.

  Maximum length is 512.

Responses

• 200 application/json

  Indicates a successful call.

  Hide response attributes Show response attributes object

  • attachmentId string | array[string]

    The ID of the attached item, such as an alert or a dashboard. To attach several alerts, use an array. This isn't the attachment's own ID (id).

    One of:

    string-1 string array-2 array[string]
  • created_at string(date-time) Required
  • created_by object Required
    Hide created_by attributes Show created_by attributes object

    • email string | null Required
    • full_name string | null Required
    • profile_uid string
    • username string | null Required
  • data object | null

    The attachment's content. Required for comments, where content is the comment text (up to 30,000 characters). In requests, it can be up to 524,288 characters when serialized as JSON and nest up to 30 levels deep.

    Additional properties are allowed.

  • id string Required

    The attachment identifier.

  • metadata object | null

    Extra details about the attachment. For alerts, this is the alert's index and rule. Required for some types, such as dashboard. In requests, it can be up to 524,288 characters when serialized as JSON and nest up to 30 levels deep.

    Additional properties are allowed.

  • owner string Required

    The application that owns the cases: Stack Management, Observability, or Elastic Security.

    Values are cases, observability, or securitySolution.

  • pushed_at string(date-time) | null Required

    When this attachment was last pushed to an external system, such as Jira. Is null if it hasn't been pushed.

  • pushed_by object | null Required
    Hide pushed_by attributes Show pushed_by attributes object | null

    • email string | null Required
    • full_name string | null Required
    • profile_uid string
    • username string | null Required
  • type string Required

    The attachment type, such as comment, security.alert, observability.alert, stack.alert, security.event, lens, dashboard, or file. security.* types only work on Security cases, observability.* on Observability cases, and stack.* on Stack Management cases. Use comment (not the legacy user type) and a *.alert type (not alert). You can't add or replace file attachments with this API. To add a file, use POST /api/cases/{caseId}/files.

  • updated_at string(date-time) | null Required
  • updated_by object | null Required
    Hide updated_by attributes Show updated_by attributes object | null

    • email string | null Required
    • full_name string | null Required
    • profile_uid string
    • username string | null Required
  • version string Required

    The attachment's current version. Include it when you replace the attachment.

• 401 application/json

  Authorization information is missing or invalid.

  Hide response attributes Show response attributes object

  • error string
  • message string
  • statusCode integer
• 403 application/json

  You don't have the required privileges for this case.

  Hide response attributes Show response attributes object

  • error string
  • message string
  • statusCode integer
• 404 application/json

  The attachment was not found in the case.

  Hide response attributes Show response attributes object

  • error string
  • message string
  • statusCode integer