---
title: "Get Case Artifacts"
method: GET
path: "/connect/case/artifacts/{id}"
tags: ["Cases"]
---

# Get Case Artifacts

`GET /connect/case/artifacts/{id}`

Searches for all artifacts attached to the given case ID and returns the matching artifacts, if any.
Observables are considered "artifacts" in SOC internal terminology.
If the case does not exist, this method will respond with a 200 status and an empty list.

## Path parameters

- `id` string, required

## Response `200`

The array of artifacts, or an empty array if no matching artifacts found

- ModelArtifact[]
  - `artifactType` string, required — The artifact type as set by the server. This is an internal, read-only field.
  - `caseId` string, required — The case ID for which this artifact is to be attached, or is already attached.
  - `createTime` string — The date and time that this object was created. This is a read-only field.
  - `description` string — A description that explains how this artifact relates to the case.
  - `groupId` string — The group ID as set by the server. This is an internal, read-only field.
  - `groupType` string — The group type as set by the server. This is an internal, read-only field.
  - `id` string — The ID assigned to this object by the server. This is a read-only field.
  - `ioc` boolean — A flag representing whether this artifact is an indicator of compromise (IoC).
  - `kind` string — The kind of object. This is a read-only field.
  - `md5` string — An MD5 hash of the artifact stream. This field is determined by the server upon file upload and is ready-only.
  - `mimeType` string — The mime type of the artifact stream. This field is determined by the server upon file upload and is read-only.
  - `operation` string — The operation that was applied to the object. This is a read-only field.
  - `protected` boolean — A flag representing whether this file artifact is protected. A protected file will be automatically zipped by the server before being retrieved, to avoid accidentally executing a potentially harmful attachment.
  - `sha1` string — A SHA-1 hash of the artifact stream. This field is determined by the server upon file upload and is ready-only.
  - `sha256` string — A SHA-256 hash of the artifact stream. This field is determined by the server upon file upload and is ready-only.
  - `streamId` string — The stream ID of the artifact stream. This field is determined by the server upon file upload and is ready-only.
  - `streamLength` integer — The length of the artifact stream. This field is determined by the server upon file upload and is ready-only.
  - `tags` string[] — Tags to assign to this artifact.
  - `tlp` string — The traffic light protocol value for this artifact.
  - `updateTime` string — The date and time that this object was last modified. This is a read-only field.
  - `userId` string — The user ID (or API client ID) that initated this event. This is a read-only field.
  - `value` string, required — The value of this artifact. Essentially this is the content of the artifact itself, such as an IP address, a hostname, a stream of file bytes, etc.

## Other responses

- `400` — The provided input object or parameters are malformed or invalid
- `401` — Request was not properly authenticated
- `403` — Insufficient permissions for this request
- `405` — Case module not configured on server
- `500` — Internal SOC error; review SOC logs

## Changes

- **2024-12-10** `ee1120fd1e20` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/security-onion-solutions/apis/security-onion-connect-api/changes/connect/case/artifacts/:id/get.md)

---

[API](https://skmtc.dev/security-onion-solutions/apis/security-onion-connect-api.md) · [All operations](https://skmtc.dev/security-onion-solutions/apis/security-onion-connect-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/security-onion-solutions/security-onion-connect-api/revisions/423752d0eb8a/schema)