cases

Replace a case attachment

Spaces method and path for this operation:

<div><span class="operation-verb put">put</span> <span class="operation-path">/s/{space_id}/api/cases/{caseId}/attachments/{attachmentId}</span></div>

Refer to Spaces for more information.

Fully replaces an attachment. You cannot change the attachment type or owner. You must have all privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case.

put/api/cases/{caseId}/attachments/{attachmentId}

Request

Base URL
https://localhost:5601
URL
https://localhost:5601/api/cases/{caseId}/attachments/{attachmentId}
Auth
- API key in header Authorization
- or HTTP basic

Path parameters

caseIdstring required

Example:9c235210-6834-11ea-a78c-6ffb38a34414

The identifier for the case. To retrieve case IDs, use the search cases (_find) API. All non-ASCII characters must be URL encoded.

attachmentIdstring required

Example:71ec1870-725b-11ea-a0b2-c51ea50a58e2

The ID of the attachment, which is its id field, not attachmentId. To get it, use the find case attachments API.

Headers

kbn-xsrfstring required

Cross-site request forgery protection

Request body

Example request

{
  "data": {
    "content": "A new comment."
  },
  "owner": "cases",
  "type": "comment",
  "version": "WzIwNDMxLDFd"
}

Response

Indicates a successful call. Returns the replaced attachment.

created_atstring date-time required

dataCasesUnifiedAttachmentData nullable

The attachment's content. Required for comments, where content is the comment text (up to 30,000 characters).

idstring required

The attachment identifier.

metadataCasesUnifiedAttachmentMetadata nullable

Extra details about the attachment. For alerts, this is the alert's index and rule. Required for some types, such as dashboard.

owner'cases' | 'observability' | 'securitySolution' required

The application that owns the cases: Stack Management, Observability, or Elastic Security.

pushed_atstring date-time nullable required

When this attachment was last pushed to an external system, such as Jira. Is null if it hasn't been pushed.

typestring required

The attachment type, such as comment, security.alert, observability.alert, stack.alert, security.event, lens, dashboard, or file. security.* types only work on Security cases, observability.* on Observability cases, and stack.* on Stack Management cases. Use comment (not the legacy user type) and a *.alert type (not alert). You can't add or replace file attachments with this API. To add a file, use POST /api/cases/{caseId}/files.

updated_atstring date-time nullable required

versionstring required

The attachment's current version. Include it when you replace the attachment.

Example response

{
  "created_at": "2026-09-30T09:16:17.416Z",
  "created_by": {
    "profile_uid": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
    "username": "elastic"
  },
  "data": {
    "content": "A new comment."
  },
  "id": "71ec1870-725b-11ea-a0b2-c51ea50a58e2",
  "owner": "cases",
  "pushed_by": {
    "profile_uid": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
    "username": "elastic"
  },
  "type": "comment",
  "updated_by": {
    "profile_uid": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
    "username": "elastic"
  },
  "version": "WzIwNDMxLDFd"
}

Changes

No operation changes recorded.