---
title: "Find case attachments"
method: GET
path: "/api/cases/{caseId}/attachments"
tags: ["cases"]
---

# Find case attachments

`GET /api/cases/{caseId}/attachments`

## Request

- Base URL: `https://localhost:5601`
- URL: `https://localhost:5601/api/cases/{caseId}/attachments`
- Auth: one of:
  - API key in header `Authorization`
  - HTTP basic

**Spaces method and path for this operation:**

<div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/{caseId}/attachments</span></div>

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Returns a paginated list of attachments for a case, optionally filtered by type. Attachments that you do not have privileges to read are not returned. You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case.

## Path parameters

- `caseId` string, required

## Query parameters

- `type` union
  - string
  - string[]
- `page` integer
- `perPage` integer
- `sortOrder` 'asc' | 'desc'

## Response `200`

Indicates a successful call.

- CasesUnifiedAttachmentsFindResponse
  - `data` CasesUnifiedAttachmentResponse[], required: The attachments on the requested page.
    - `attachmentId` union: The ID of the attached item, such as an alert or a dashboard. To attach several alerts, use an array. This isn't the attachment's own ID (`id`).
      - string
      - string[]
    - `created_at` string, date-time, required
    - `created_by` CasesCaseResponseCreatedByProperties, required
      - `email` string, nullable, required
      - `full_name` string, nullable, required
      - `profile_uid` string
      - `username` string, nullable, required
    - `data` CasesUnifiedAttachmentData, nullable: The attachment's content. Required for comments, where `content` is the comment text (up to 30,000 characters).
    - `id` string, required: The attachment identifier.
    - `metadata` CasesUnifiedAttachmentMetadata, nullable: Extra details about the attachment. For alerts, this is the alert's index and rule. Required for some types, such as `dashboard`.
    - `owner` 'cases' | 'observability' | 'securitySolution', required: The application that owns the cases: Stack Management, Observability, or Elastic Security.
    - `pushed_at` string, date-time, nullable, required: When this attachment was last pushed to an external system, such as Jira. Is `null` if it hasn't been pushed.
    - `pushed_by` CasesCaseResponsePushedByProperties, nullable, required
      - `email` string, nullable, required
      - `full_name` string, nullable, required
      - `profile_uid` string
      - `username` string, nullable, required
    - `type` string, required: The attachment type, such as `comment`, `security.alert`, `observability.alert`, `stack.alert`, `security.event`, `lens`, `dashboard`, or `file`. `security.*` types only work on Security cases, `observability.*` on Observability cases, and `stack.*` on Stack Management cases. Use `comment` (not the legacy `user` type) and a `*.alert` type (not `alert`). You can't add or replace file attachments with this API. To add a file, use `POST /api/cases/{caseId}/files`.
    - `updated_at` string, date-time, nullable, required
    - `updated_by` CasesCaseResponseUpdatedByProperties, nullable, required
      - `email` string, nullable, required
      - `full_name` string, nullable, required
      - `profile_uid` string
      - `username` string, nullable, required
    - `version` string, required: The attachment's current version. Include it when you replace the attachment.
  - `page` integer, required: The current page number.
  - `per_page` integer, required: The number of items per page.
  - `total` integer, required: The total number of matching attachments you can access. Attachments with invalid or unsupported data are counted but not returned, so a page can have fewer than `per_page` items.

## Other responses

- `400`: A query parameter is invalid or exceeds its limit.
- `401`: Authorization information is missing or invalid.

---

[API](https://skmtc.dev/elastic/apis/kibana-apis.md) - [All operations](https://skmtc.dev/elastic/apis/kibana-apis/llms.txt) - [OpenAPI document](https://skmtc.dev/elastic/apis/kibana-apis/revisions/31b9a1dac8bf?raw)