---
title: "Create a case attachment"
method: POST
path: "/api/cases/{caseId}/attachments"
tags: ["cases"]
---

# Create a case attachment

`POST /api/cases/{caseId}/attachments`

## Request

- Base URL: `https://localhost:5601`
- URL: `https://localhost:5601/api/cases/{caseId}/attachments`
- Auth: one of:
  - API key in header `Authorization`
  - HTTP basic

**Spaces method and path for this operation:**

<div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/{caseId}/attachments</span></div>

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Adds a single attachment, such as a comment or an alert, to a case. You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case. NOTE: Each case can have a maximum of 1,000 alerts.

## Path parameters

- `caseId` string, required

## Headers

- `kbn-xsrf` string, required

## Request body

- union: The attachment to add to the case. Reference attachment types, such as alerts, require `attachmentId`. Value attachment types, such as comments, require `data` and don't accept `attachmentId`. The `owner` must match the owner of the case. Unknown properties are rejected.
  - object
    - `attachmentId` union, required: The ID of the attached item, such as an alert or a dashboard. To attach several alerts, use an array. This isn't the attachment's own ID (`id`).
      - string
      - string[]
    - `data` CasesUnifiedAttachmentData, nullable: The attachment's content. Required for comments, where `content` is the comment text (up to 30,000 characters).
    - `metadata` CasesUnifiedAttachmentMetadata, nullable: Extra details about the attachment. For alerts, this is the alert's index and rule. Required for some types, such as `dashboard`.
    - `owner` 'cases' | 'observability' | 'securitySolution', required: The application that owns the cases: Stack Management, Observability, or Elastic Security.
    - `type` string, required: The attachment type, such as `comment`, `security.alert`, `observability.alert`, `stack.alert`, `security.event`, `lens`, `dashboard`, or `file`. `security.*` types only work on Security cases, `observability.*` on Observability cases, and `stack.*` on Stack Management cases. Use `comment` (not the legacy `user` type) and a `*.alert` type (not `alert`). You can't add or replace file attachments with this API. To add a file, use `POST /api/cases/{caseId}/files`.
  - object
    - `data` CasesUnifiedAttachmentData, nullable, required: The attachment's content. Required for comments, where `content` is the comment text (up to 30,000 characters).
    - `metadata` CasesUnifiedAttachmentMetadata, nullable: Extra details about the attachment. For alerts, this is the alert's index and rule. Required for some types, such as `dashboard`.
    - `owner` 'cases' | 'observability' | 'securitySolution', required: The application that owns the cases: Stack Management, Observability, or Elastic Security.
    - `type` string, required: The attachment type, such as `comment`, `security.alert`, `observability.alert`, `stack.alert`, `security.event`, `lens`, `dashboard`, or `file`. `security.*` types only work on Security cases, `observability.*` on Observability cases, and `stack.*` on Stack Management cases. Use `comment` (not the legacy `user` type) and a `*.alert` type (not `alert`). You can't add or replace file attachments with this API. To add a file, use `POST /api/cases/{caseId}/files`.

## Response `201`

Indicates a successful call. Returns the new attachment, or the existing one if the alert or event was already attached.

- CasesUnifiedAttachmentResponse
  - `attachmentId` union: The ID of the attached item, such as an alert or a dashboard. To attach several alerts, use an array. This isn't the attachment's own ID (`id`).
    - string
    - string[]
  - `created_at` string, date-time, required
  - `created_by` CasesCaseResponseCreatedByProperties, required
    - `email` string, nullable, required
    - `full_name` string, nullable, required
    - `profile_uid` string
    - `username` string, nullable, required
  - `data` CasesUnifiedAttachmentData, nullable: The attachment's content. Required for comments, where `content` is the comment text (up to 30,000 characters).
  - `id` string, required: The attachment identifier.
  - `metadata` CasesUnifiedAttachmentMetadata, nullable: Extra details about the attachment. For alerts, this is the alert's index and rule. Required for some types, such as `dashboard`.
  - `owner` 'cases' | 'observability' | 'securitySolution', required: The application that owns the cases: Stack Management, Observability, or Elastic Security.
  - `pushed_at` string, date-time, nullable, required: When this attachment was last pushed to an external system, such as Jira. Is `null` if it hasn't been pushed.
  - `pushed_by` CasesCaseResponsePushedByProperties, nullable, required
    - `email` string, nullable, required
    - `full_name` string, nullable, required
    - `profile_uid` string
    - `username` string, nullable, required
  - `type` string, required: The attachment type, such as `comment`, `security.alert`, `observability.alert`, `stack.alert`, `security.event`, `lens`, `dashboard`, or `file`. `security.*` types only work on Security cases, `observability.*` on Observability cases, and `stack.*` on Stack Management cases. Use `comment` (not the legacy `user` type) and a `*.alert` type (not `alert`). You can't add or replace file attachments with this API. To add a file, use `POST /api/cases/{caseId}/files`.
  - `updated_at` string, date-time, nullable, required
  - `updated_by` CasesCaseResponseUpdatedByProperties, nullable, required
    - `email` string, nullable, required
    - `full_name` string, nullable, required
    - `profile_uid` string
    - `username` string, nullable, required
  - `version` string, required: The attachment's current version. Include it when you replace the attachment.

## Other responses

- `400`: The request failed for one of these reasons: - The request body is invalid. - The attachment type isn't registered, or is `file`. - The owner doesn't match the case owner. - A case limit was exceeded.
- `401`: Authorization information is missing or invalid.
- `403`: You don't have the required privileges for this case.
- `404`: The case was not found.

---

[API](https://skmtc.dev/elastic/apis/kibana-apis.md) - [All operations](https://skmtc.dev/elastic/apis/kibana-apis/llms.txt) - [OpenAPI document](https://skmtc.dev/elastic/apis/kibana-apis/revisions/31b9a1dac8bf?raw)