Replace a case attachment

Base URL: https://{kibana_url}

PUT /api/cases/{caseId}/attachments/{attachmentId}
PUT /s/{space_id}/api/cases/{caseId}/attachments/{attachmentId}

Auth

Fully replaces an attachment. You cannot change the attachment type or owner. You must have all privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case.

Path parameters

space_id string optional: An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.
caseId string required: The identifier for the case. To retrieve case IDs, use the search cases (_find) API. All non-ASCII characters must be URL encoded.; Example: 9c235210-6834-11ea-a78c-6ffb38a34414
attachmentId string · max length: 512 required: The ID of the attachment, which is its id field, not attachmentId. To get it, use the find case attachments API.; Example: 71ec1870-725b-11ea-a0b2-c51ea50a58e2

Header parameters

kbn-xsrf string required: Cross-site request forgery protection

Request body

One of:

attachmentId union oneOf required: The ID of the attached item, such as an alert or a dashboard. To attach several alerts, use an array. This isn't the attachment's own ID (id).; One of: string[] or string
data object nullable: The attachment's content. Required for comments, where content is the comment text (up to 30,000 characters). In requests, it can be up to 524,288 characters when serialized as JSON and nest up to 30 levels deep.
metadata object nullable: Extra details about the attachment. For alerts, this is the alert's index and rule. Required for some types, such as dashboard. In requests, it can be up to 524,288 characters when serialized as JSON and nest up to 30 levels deep.
owner enum required: The application that owns the cases: Stack Management, Observability, or Elastic Security.; Values: cases observability securitySolution
type string required: The attachment type, such as comment, security.alert, observability.alert, stack.alert, security.event, lens, dashboard, or file. security.* types only work on Security cases, observability.* on Observability cases, and stack.* on Stack Management cases. Use comment (not the legacy user type) and a *.alert type (not alert). You can't add or replace file attachments with this API. To add a file, use POST /api/cases/{caseId}/files.
version string required: The current version of the attachment. To retrieve it, use the get case attachment API. If the attachment changed since you read it, the request fails with a 409 status code.

Responses

Indicates a successful call. Returns the replaced attachment.

application/json

attachmentId union oneOf: The ID of the attached item, such as an alert or a dashboard. To attach several alerts, use an array. This isn't the attachment's own ID (id).; One of: string[] or string
created_at string · format: date-time required
created_by object required
data object nullable: The attachment's content. Required for comments, where content is the comment text (up to 30,000 characters). In requests, it can be up to 524,288 characters when serialized as JSON and nest up to 30 levels deep.
id string required: The attachment identifier.
metadata object nullable: Extra details about the attachment. For alerts, this is the alert's index and rule. Required for some types, such as dashboard. In requests, it can be up to 524,288 characters when serialized as JSON and nest up to 30 levels deep.
owner enum required: The application that owns the cases: Stack Management, Observability, or Elastic Security.; Values: cases observability securitySolution
pushed_at string · format: date-time required nullable: When this attachment was last pushed to an external system, such as Jira. Is null if it hasn't been pushed.
pushed_by object required nullable
type string required: The attachment type, such as comment, security.alert, observability.alert, stack.alert, security.event, lens, dashboard, or file. security.* types only work on Security cases, observability.* on Observability cases, and stack.* on Stack Management cases. Use comment (not the legacy user type) and a *.alert type (not alert). You can't add or replace file attachments with this API. To add a file, use POST /api/cases/{caseId}/files.
updated_at string · format: date-time required nullable
updated_by object required nullable
version string required: The attachment's current version. Include it when you replace the attachment.

The request failed for one of these reasons:

The request body is invalid.
The attachment type is file.
The request changes the attachment type or owner.

application/json

error string
message string
statusCode integer

Authorization information is missing or invalid.

application/json

error string
message string
statusCode integer

You don't have the required privileges for this case.

application/json

error string
message string
statusCode integer

The attachment was not found in the case.

application/json

error string
message string
statusCode integer

The attachment changed since you read it. Get the latest version and retry.

application/json

error string
message string
statusCode integer