Type to search.

Find case attachments

Base URL
https://{kibana_url}
Auth The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Planned We plan to add this functionality in a future Elastic Stack update. Subject to changes. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

Returns a paginated list of attachments for a case, optionally filtered by type. Attachments that you do not have privileges to read are not returned. You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case.

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

caseId string required

The identifier for the case. To retrieve case IDs, use the search cases (_find) API. All non-ASCII characters must be URL encoded.

Example: 9c235210-6834-11ea-a78c-6ffb38a34414

Query parameters

type union string | string[]

Filters the returned attachments by one or more attachment types, such as comment or security.alert. To filter by multiple types, repeat the parameter. Limited to 20 types.

Example: comment
page integer · default: 1

The page number to return.

perPage integer · max: 100 · default: 20

The number of items to return. Limited to 100 items.

sortOrder enum · default: asc

Sorts attachments by creation date: asc (oldest first) or desc (newest first).

Values: asc desc

Responses

Indicates a successful call.

application/json
data object[] required

The attachments on the requested page.

attachmentId union oneOf

The ID of the attached item, such as an alert or a dashboard. To attach several alerts, use an array. This isn't the attachment's own ID (id).

One of: string[] or string
created_at string · format: date-time required
created_by object required
email string required nullable
full_name string required nullable
profile_uid string
username string required nullable
data object nullable

The attachment's content. Required for comments, where content is the comment text (up to 30,000 characters). In requests, it can be up to 524,288 characters when serialized as JSON and nest up to 30 levels deep.

id string required

The attachment identifier.

metadata object nullable

Extra details about the attachment. For alerts, this is the alert's index and rule. Required for some types, such as dashboard. In requests, it can be up to 524,288 characters when serialized as JSON and nest up to 30 levels deep.

owner enum required

The application that owns the cases: Stack Management, Observability, or Elastic Security.

Values: cases observability securitySolution
pushed_at string · format: date-time required nullable

When this attachment was last pushed to an external system, such as Jira. Is null if it hasn't been pushed.

pushed_by object required nullable
email string required nullable
full_name string required nullable
profile_uid string
username string required nullable
type string required

The attachment type, such as comment, security.alert, observability.alert, stack.alert, security.event, lens, dashboard, or file. security.* types only work on Security cases, observability.* on Observability cases, and stack.* on Stack Management cases. Use comment (not the legacy user type) and a *.alert type (not alert). You can't add or replace file attachments with this API. To add a file, use POST /api/cases/{caseId}/files.

updated_at string · format: date-time required nullable
updated_by object required nullable
email string required nullable
full_name string required nullable
profile_uid string
username string required nullable
version string required

The attachment's current version. Include it when you replace the attachment.

page integer required

The current page number.

per_page integer required

The number of items per page.

total integer required

The total number of matching attachments you can access. Attachments with invalid or unsupported data are counted but not returned, so a page can have fewer than per_page items.