---
title: "Replace a case attachment"
method: PUT
path: "/api/cases/{caseId}/attachments/{attachmentId}"
tags: ["cases"]
---

# Replace a case attachment

`PUT /api/cases/{caseId}/attachments/{attachmentId}`

## Request

- Base URL: `https://localhost:5601`
- URL: `https://localhost:5601/api/cases/{caseId}/attachments/{attachmentId}`
- Auth: one of:
  - API key in header `Authorization`
  - HTTP basic

**Spaces method and path for this operation:**

<div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/{caseId}/attachments/{attachmentId}</span></div>

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Fully replaces an attachment. You cannot change the attachment type or owner. You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case.

## Path parameters

- `caseId` string, required
- `attachmentId` string, required

## Headers

- `kbn-xsrf` string, required

## Request body

- union: The full replacement for the attachment. The `type` and `owner` must match the existing attachment. Reference attachment types require `attachmentId`. Value attachment types require `data` and don't accept `attachmentId`. Unknown properties are rejected.
  - object
    - `attachmentId` union, required: The ID of the attached item, such as an alert or a dashboard. To attach several alerts, use an array. This isn't the attachment's own ID (`id`).
      - string
      - string[]
    - `data` CasesUnifiedAttachmentData, nullable: The attachment's content. Required for comments, where `content` is the comment text (up to 30,000 characters).
    - `metadata` CasesUnifiedAttachmentMetadata, nullable: Extra details about the attachment. For alerts, this is the alert's index and rule. Required for some types, such as `dashboard`.
    - `owner` 'cases' | 'observability' | 'securitySolution', required: The application that owns the cases: Stack Management, Observability, or Elastic Security.
    - `type` string, required: The attachment type, such as `comment`, `security.alert`, `observability.alert`, `stack.alert`, `security.event`, `lens`, `dashboard`, or `file`. `security.*` types only work on Security cases, `observability.*` on Observability cases, and `stack.*` on Stack Management cases. Use `comment` (not the legacy `user` type) and a `*.alert` type (not `alert`). You can't add or replace file attachments with this API. To add a file, use `POST /api/cases/{caseId}/files`.
    - `version` string, required: The current version of the attachment. To retrieve it, use the get case attachment API. If the attachment changed since you read it, the request fails with a 409 status code.
  - object
    - `data` CasesUnifiedAttachmentData, nullable, required: The attachment's content. Required for comments, where `content` is the comment text (up to 30,000 characters).
    - `metadata` CasesUnifiedAttachmentMetadata, nullable: Extra details about the attachment. For alerts, this is the alert's index and rule. Required for some types, such as `dashboard`.
    - `owner` 'cases' | 'observability' | 'securitySolution', required: The application that owns the cases: Stack Management, Observability, or Elastic Security.
    - `type` string, required: The attachment type, such as `comment`, `security.alert`, `observability.alert`, `stack.alert`, `security.event`, `lens`, `dashboard`, or `file`. `security.*` types only work on Security cases, `observability.*` on Observability cases, and `stack.*` on Stack Management cases. Use `comment` (not the legacy `user` type) and a `*.alert` type (not `alert`). You can't add or replace file attachments with this API. To add a file, use `POST /api/cases/{caseId}/files`.
    - `version` string, required: The current version of the attachment. To retrieve it, use the get case attachment API. If the attachment changed since you read it, the request fails with a 409 status code.

## Response `200`

Indicates a successful call. Returns the replaced attachment.

- CasesUnifiedAttachmentResponse
  - `attachmentId` union: The ID of the attached item, such as an alert or a dashboard. To attach several alerts, use an array. This isn't the attachment's own ID (`id`).
    - string
    - string[]
  - `created_at` string, date-time, required
  - `created_by` CasesCaseResponseCreatedByProperties, required
    - `email` string, nullable, required
    - `full_name` string, nullable, required
    - `profile_uid` string
    - `username` string, nullable, required
  - `data` CasesUnifiedAttachmentData, nullable: The attachment's content. Required for comments, where `content` is the comment text (up to 30,000 characters).
  - `id` string, required: The attachment identifier.
  - `metadata` CasesUnifiedAttachmentMetadata, nullable: Extra details about the attachment. For alerts, this is the alert's index and rule. Required for some types, such as `dashboard`.
  - `owner` 'cases' | 'observability' | 'securitySolution', required: The application that owns the cases: Stack Management, Observability, or Elastic Security.
  - `pushed_at` string, date-time, nullable, required: When this attachment was last pushed to an external system, such as Jira. Is `null` if it hasn't been pushed.
  - `pushed_by` CasesCaseResponsePushedByProperties, nullable, required
    - `email` string, nullable, required
    - `full_name` string, nullable, required
    - `profile_uid` string
    - `username` string, nullable, required
  - `type` string, required: The attachment type, such as `comment`, `security.alert`, `observability.alert`, `stack.alert`, `security.event`, `lens`, `dashboard`, or `file`. `security.*` types only work on Security cases, `observability.*` on Observability cases, and `stack.*` on Stack Management cases. Use `comment` (not the legacy `user` type) and a `*.alert` type (not `alert`). You can't add or replace file attachments with this API. To add a file, use `POST /api/cases/{caseId}/files`.
  - `updated_at` string, date-time, nullable, required
  - `updated_by` CasesCaseResponseUpdatedByProperties, nullable, required
    - `email` string, nullable, required
    - `full_name` string, nullable, required
    - `profile_uid` string
    - `username` string, nullable, required
  - `version` string, required: The attachment's current version. Include it when you replace the attachment.

## Other responses

- `400`: The request failed for one of these reasons: - The request body is invalid. - The attachment type is `file`. - The request changes the attachment type or owner.
- `401`: Authorization information is missing or invalid.
- `403`: You don't have the required privileges for this case.
- `404`: The attachment was not found in the case.
- `409`: The attachment changed since you read it. Get the latest version and retry.

---

[API](https://skmtc.dev/elastic/apis/kibana-apis.md) - [All operations](https://skmtc.dev/elastic/apis/kibana-apis/llms.txt) - [OpenAPI document](https://skmtc.dev/elastic/apis/kibana-apis/revisions/31b9a1dac8bf?raw)