cases

Find case attachments

Spaces method and path for this operation:

<div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/{caseId}/attachments</span></div>

Refer to Spaces for more information.

Returns a paginated list of attachments for a case, optionally filtered by type. Attachments that you do not have privileges to read are not returned. You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case.

get/api/cases/{caseId}/attachments

Request

  • Base URL
    https://localhost:5601
  • URL
    https://localhost:5601/api/cases/{caseId}/attachments
  • Auth
    • API key in header Authorization
    • or HTTP basic

Path parameters

caseIdstring required
Example:9c235210-6834-11ea-a78c-6ffb38a34414

The identifier for the case. To retrieve case IDs, use the search cases (_find) API. All non-ASCII characters must be URL encoded.

Query parameters

string
OR
string[]

Filters the returned attachments by one or more attachment types, such as comment or security.alert. To filter by multiple types, repeat the parameter. Limited to 20 types.

pageinteger

The page number to return.

perPageinteger

The number of items to return. Limited to 100 items.

sortOrder'asc' | 'desc'

Sorts attachments by creation date: asc (oldest first) or desc (newest first).

Response

Indicates a successful call.

pageinteger required

The current page number.

per_pageinteger required

The number of items per page.

totalinteger required

The total number of matching attachments you can access. Attachments with invalid or unsupported data are counted but not returned, so a page can have fewer than per_page items.

Example response

{
  "data": [
    {
      "created_at": "2026-09-30T09:16:17.416Z",
      "created_by": {
        "profile_uid": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
        "username": "elastic"
      },
      "data": {
        "content": "A new comment."
      },
      "id": "71ec1870-725b-11ea-a0b2-c51ea50a58e2",
      "owner": "cases",
      "pushed_by": {
        "profile_uid": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
        "username": "elastic"
      },
      "type": "comment",
      "updated_by": {
        "profile_uid": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
        "username": "elastic"
      },
      "version": "WzIwNDMxLDFd"
    }
  ],
  "page": 1,
  "per_page": 20,
  "total": 1
}

Changes

No operation changes recorded.