---
title: "POST /cases/{id}/evidence"
method: POST
path: "/cases/{id}/evidence"
tags: ["cases"]
---

# POST /cases/{id}/evidence

`POST /cases/{id}/evidence`

## Path parameters

- `id` string, required

## Request body

- AddCaseEvidenceRequest
  - `description` string, nullable
  - `kind` string, required
  - `payload` object, required
  - `title` string, required

## Response `200`

Updated case with appended evidence

- ActionCase
  - `createdAt` string, required
  - `description` string, nullable
  - `entityType` string, nullable
  - `entityValue` string, nullable
  - `evidence` ActionCaseEvidence[], required
    - `createdAt` string, required
    - `description` string, nullable
    - `id` string, required
    - `kind` string, required
    - `payload` object, required
    - `title` string, required
  - `id` string, required
  - `linkedAlertId` string, nullable
  - `linkedCveFindingId` string, nullable
  - `linkedReportId` string, nullable
  - `organizationId` string, nullable
  - `priority` string, required
  - `status` string, required
  - `title` string, required
  - `updatedAt` string, required
  - `userId` string, required

## Other responses

- `400` — Evidence kind and title are required
- `404` — Case not found

## Changes

- **2026-08-31** `9d9ef31d83e5` — 2 breaking, 1 info
  - the response property `message` became nullable for the status `404`
  - the response property `message` became optional for the status `404`
  - added the non-success response with the status `400`

[Change history](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/changes/cases/:id/evidence/post.md)

---

[API](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api.md) · [All operations](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/ismalicious/ismalicious-threat-intelligence-api/revisions/9d9ef31d83e5/schema)