---
title: "Get a case attachment"
method: GET
path: "/api/cases/{caseId}/attachments/{attachmentId}"
tags: ["cases"]
---

# Get a case attachment

`GET /api/cases/{caseId}/attachments/{attachmentId}`

## Request

- Base URL: `https://localhost:5601`
- URL: `https://localhost:5601/api/cases/{caseId}/attachments/{attachmentId}`
- Auth: one of:
  - API key in header `Authorization`
  - HTTP basic

**Spaces method and path for this operation:**

<div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/{caseId}/attachments/{attachmentId}</span></div>

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Returns a single attachment from a case. You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case.

## Path parameters

- `caseId` string, required
- `attachmentId` string, required

## Response `200`

Indicates a successful call.

- CasesUnifiedAttachmentResponse
  - `attachmentId` union: The ID of the attached item, such as an alert or a dashboard. To attach several alerts, use an array. This isn't the attachment's own ID (`id`).
    - string
    - string[]
  - `created_at` string, date-time, required
  - `created_by` CasesCaseResponseCreatedByProperties, required
    - `email` string, nullable, required
    - `full_name` string, nullable, required
    - `profile_uid` string
    - `username` string, nullable, required
  - `data` CasesUnifiedAttachmentData, nullable: The attachment's content. Required for comments, where `content` is the comment text (up to 30,000 characters).
  - `id` string, required: The attachment identifier.
  - `metadata` CasesUnifiedAttachmentMetadata, nullable: Extra details about the attachment. For alerts, this is the alert's index and rule. Required for some types, such as `dashboard`.
  - `owner` 'cases' | 'observability' | 'securitySolution', required: The application that owns the cases: Stack Management, Observability, or Elastic Security.
  - `pushed_at` string, date-time, nullable, required: When this attachment was last pushed to an external system, such as Jira. Is `null` if it hasn't been pushed.
  - `pushed_by` CasesCaseResponsePushedByProperties, nullable, required
    - `email` string, nullable, required
    - `full_name` string, nullable, required
    - `profile_uid` string
    - `username` string, nullable, required
  - `type` string, required: The attachment type, such as `comment`, `security.alert`, `observability.alert`, `stack.alert`, `security.event`, `lens`, `dashboard`, or `file`. `security.*` types only work on Security cases, `observability.*` on Observability cases, and `stack.*` on Stack Management cases. Use `comment` (not the legacy `user` type) and a `*.alert` type (not `alert`). You can't add or replace file attachments with this API. To add a file, use `POST /api/cases/{caseId}/files`.
  - `updated_at` string, date-time, nullable, required
  - `updated_by` CasesCaseResponseUpdatedByProperties, nullable, required
    - `email` string, nullable, required
    - `full_name` string, nullable, required
    - `profile_uid` string
    - `username` string, nullable, required
  - `version` string, required: The attachment's current version. Include it when you replace the attachment.

## Other responses

- `401`: Authorization information is missing or invalid.
- `403`: You don't have the required privileges for this case.
- `404`: The attachment was not found in the case.

---

[API](https://skmtc.dev/elastic/apis/kibana-apis.md) - [All operations](https://skmtc.dev/elastic/apis/kibana-apis/llms.txt) - [OpenAPI document](https://skmtc.dev/elastic/apis/kibana-apis/revisions/31b9a1dac8bf?raw)