cases

Create a case attachment

Spaces method and path for this operation:

<div><span class="operation-verb post">post</span> <span class="operation-path">/s/{space_id}/api/cases/{caseId}/attachments</span></div>

Refer to Spaces for more information.

Adds a single attachment, such as a comment or an alert, to a case. You must have all privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case. NOTE: Each case can have a maximum of 1,000 alerts.

post/api/cases/{caseId}/attachments

Request

Base URL
https://localhost:5601
URL
https://localhost:5601/api/cases/{caseId}/attachments
Auth
- API key in header Authorization
- or HTTP basic

Path parameters

caseIdstring required

Example:9c235210-6834-11ea-a78c-6ffb38a34414

The identifier for the case. To retrieve case IDs, use the search cases (_find) API. All non-ASCII characters must be URL encoded.

Headers

kbn-xsrfstring required

Cross-site request forgery protection

Request body

Example request

{
  "data": {
    "content": "A new comment."
  },
  "owner": "cases",
  "type": "comment"
}

Response

Indicates a successful call. Returns the new attachment, or the existing one if the alert or event was already attached.

created_atstring date-time required

dataCasesUnifiedAttachmentData nullable

The attachment's content. Required for comments, where content is the comment text (up to 30,000 characters).

idstring required

The attachment identifier.

metadataCasesUnifiedAttachmentMetadata nullable

Extra details about the attachment. For alerts, this is the alert's index and rule. Required for some types, such as dashboard.

owner'cases' | 'observability' | 'securitySolution' required

The application that owns the cases: Stack Management, Observability, or Elastic Security.

pushed_atstring date-time nullable required

When this attachment was last pushed to an external system, such as Jira. Is null if it hasn't been pushed.

typestring required

The attachment type, such as comment, security.alert, observability.alert, stack.alert, security.event, lens, dashboard, or file. security.* types only work on Security cases, observability.* on Observability cases, and stack.* on Stack Management cases. Use comment (not the legacy user type) and a *.alert type (not alert). You can't add or replace file attachments with this API. To add a file, use POST /api/cases/{caseId}/files.

updated_atstring date-time nullable required

versionstring required

The attachment's current version. Include it when you replace the attachment.

Example response

{
  "created_at": "2026-09-30T09:16:17.416Z",
  "created_by": {
    "profile_uid": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
    "username": "elastic"
  },
  "data": {
    "content": "A new comment."
  },
  "id": "71ec1870-725b-11ea-a0b2-c51ea50a58e2",
  "owner": "cases",
  "pushed_by": {
    "profile_uid": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
    "username": "elastic"
  },
  "type": "comment",
  "updated_by": {
    "profile_uid": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
    "username": "elastic"
  },
  "version": "WzIwNDMxLDFd"
}

Changes

No operation changes recorded.