---
type: api
title: Delete a case attachment
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4641/api/doc/kibana/operation/operation-deletecaseattachmentdefaultspace
resource: https://www.elastic.co/elastic/docs-builder/docs/4641/api/doc/kibana/operation/operation-deletecaseattachmentdefaultspace
products:
  - Kibana
---

# Delete a case attachment

Authentication: required

Availability: Planned

- Server: `https://{kibana_url}`

## Paths

- `DELETE` `/api/cases/{caseId}/attachments/{attachmentId}`
- `DELETE` `/s/{space_id}/api/cases/{caseId}/attachments/{attachmentId}`

#### Path parameters

- `space_id` (string) — optional
  An identifier for the space. If `space_id` is not provided in the URL, the default space is used. Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
- `caseId` (string) — required
  The identifier for the case. To retrieve case IDs, use the search cases (`_find)` API. All non-ASCII characters must be URL encoded.
  Example: `9c235210-6834-11ea-a78c-6ffb38a34414`
- `attachmentId` (string · max length: 512) — required
  The ID of the attachment, which is its `id` field, not `attachmentId`. To get it, use the find case attachments API.
  Example: `71ec1870-725b-11ea-a0b2-c51ea50a58e2`

## Description

Deletes a single attachment from a case. If it's a file, the file is also deleted. If it's an attack (`security.attack`), the alerts it added are also removed from the case, unless they're attached separately or by another attack. You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case.

## Header parameters

- `kbn-xsrf` (string) — required
  Cross-site request forgery protection

## Responses

#### `204`

Indicates a successful call.

#### `401`

Authorization information is missing or invalid.

`application/json`

- `error` (string)
- `message` (string)
- `statusCode` (integer)
#### `403`

You don't have the required privileges for this case.

`application/json`

- `error` (string)
- `message` (string)
- `statusCode` (integer)
#### `404`

The attachment was not found in the case.

`application/json`

- `error` (string)
- `message` (string)
- `statusCode` (integer)
## Code examples

#### Console

```console
DELETE kbn:/api/cases/9c235210-6834-11ea-a78c-6ffb38a34414/attachments/71ec1870-725b-11ea-a0b2-c51ea50a58e2
```

#### curl

```curl
curl -X DELETE "${KIBANA_URL}/api/cases/9c235210-6834-11ea-a78c-6ffb38a34414/attachments/71ec1870-725b-11ea-a0b2-c51ea50a58e2" \
  -H "kbn-xsrf: true" \
  -H "Authorization: ApiKey ${API_KEY}"
```

## Response examples

#### Authorization information is missing or invalid.

`application/json`

```json
{
  "error": "Unauthorized",
  "message": "Unable to authenticate with the provided credentials.",
  "statusCode": 401
}
```

#### The user does not have access to the requested resource.

`application/json`

```json
{
  "error": "Forbidden",
  "message": "Unauthorized to access cases",
  "statusCode": 403
}
```

#### The requested resource was not found.

`application/json`

```json
{
  "error": "Not Found",
  "message": "Saved object [cases-template/9da1ea2a-09f8-4d0e-bf9d-09bf8c9d0f42] not found",
  "statusCode": 404
}
```