Skip to main content

​
core.cases.upload_attachment

Upload a file attachment to a case.

​
Inputs

​
case_id
string
required
The ID of the case to attach the file to.
​
content_base64
string
required
The file content encoded in base64.
​
content_type
string
required
The MIME type of the file (e.g., ‘application/pdf’).
​
file_name
string
required
The original filename.

​
Examples

Work with attachments 
- ref: upload_attachment
  action: core.cases.upload_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    file_name: note.txt
    content_base64: Zm9yZW5zaWMgbm90ZXM=
    content_type: text/plain
- ref: upload_attachment_from_url
  action: core.cases.upload_attachment_from_url
  args:
    case_id: ${{ TRIGGER.case_id }}
    url: https://artifacts.example.com/evidence/${{ TRIGGER.alert_id }}
    headers:
      Authorization: Bearer ${{ SECRETS.artifacts.API_TOKEN }}
    file_name: evidence.json
- ref: list_attachments
  action: core.cases.list_attachments
  args:
    case_id: ${{ TRIGGER.case_id }}
- ref: get_attachment
  action: core.cases.get_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
- ref: get_download_url
  action: core.cases.get_attachment_download_url
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
    expiry: 900
- ref: download_attachment
  action: core.cases.download_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
- ref: delete_attachment
  action: core.cases.delete_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}

​
core.cases.upload_attachment_from_url

Upload a file attachment to a case from a URL.

​
Inputs

​
case_id
string
required
The ID of the case to attach the file to.
​
url
string
required
The URL of the file to upload.
​
file_name
string | null
Filename of the file to upload. If not provided, the filename will be inferred from the URL.Default: null.
​
headers
map[string, string] | null
The headers to use when downloading the file.Default: null.

​
Examples

Work with attachments 
- ref: upload_attachment
  action: core.cases.upload_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    file_name: note.txt
    content_base64: Zm9yZW5zaWMgbm90ZXM=
    content_type: text/plain
- ref: upload_attachment_from_url
  action: core.cases.upload_attachment_from_url
  args:
    case_id: ${{ TRIGGER.case_id }}
    url: https://artifacts.example.com/evidence/${{ TRIGGER.alert_id }}
    headers:
      Authorization: Bearer ${{ SECRETS.artifacts.API_TOKEN }}
    file_name: evidence.json
- ref: list_attachments
  action: core.cases.list_attachments
  args:
    case_id: ${{ TRIGGER.case_id }}
- ref: get_attachment
  action: core.cases.get_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
- ref: get_download_url
  action: core.cases.get_attachment_download_url
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
    expiry: 900
- ref: download_attachment
  action: core.cases.download_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
- ref: delete_attachment
  action: core.cases.delete_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}

​
core.cases.list_attachments

List all attachments for a case.

​
Inputs

​
case_id
string
required
The ID of the case to list attachments for.

​
Examples

Work with attachments 
- ref: upload_attachment
  action: core.cases.upload_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    file_name: note.txt
    content_base64: Zm9yZW5zaWMgbm90ZXM=
    content_type: text/plain
- ref: upload_attachment_from_url
  action: core.cases.upload_attachment_from_url
  args:
    case_id: ${{ TRIGGER.case_id }}
    url: https://artifacts.example.com/evidence/${{ TRIGGER.alert_id }}
    headers:
      Authorization: Bearer ${{ SECRETS.artifacts.API_TOKEN }}
    file_name: evidence.json
- ref: list_attachments
  action: core.cases.list_attachments
  args:
    case_id: ${{ TRIGGER.case_id }}
- ref: get_attachment
  action: core.cases.get_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
- ref: get_download_url
  action: core.cases.get_attachment_download_url
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
    expiry: 900
- ref: download_attachment
  action: core.cases.download_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
- ref: delete_attachment
  action: core.cases.delete_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}

​
core.cases.get_attachment

Get attachment metadata without downloading the content.

​
Inputs

​
attachment_id
string
required
The ID of the attachment to get.
​
case_id
string
required
The ID of the case containing the attachment.

​
Examples

Work with attachments 
- ref: upload_attachment
  action: core.cases.upload_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    file_name: note.txt
    content_base64: Zm9yZW5zaWMgbm90ZXM=
    content_type: text/plain
- ref: upload_attachment_from_url
  action: core.cases.upload_attachment_from_url
  args:
    case_id: ${{ TRIGGER.case_id }}
    url: https://artifacts.example.com/evidence/${{ TRIGGER.alert_id }}
    headers:
      Authorization: Bearer ${{ SECRETS.artifacts.API_TOKEN }}
    file_name: evidence.json
- ref: list_attachments
  action: core.cases.list_attachments
  args:
    case_id: ${{ TRIGGER.case_id }}
- ref: get_attachment
  action: core.cases.get_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
- ref: get_download_url
  action: core.cases.get_attachment_download_url
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
    expiry: 900
- ref: download_attachment
  action: core.cases.download_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
- ref: delete_attachment
  action: core.cases.delete_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}

​
core.cases.get_attachment_download_url

Get a presigned S3 URL for downloading an attachment.

​
Inputs

​
attachment_id
string
required
The ID of the attachment.
​
case_id
string
required
The ID of the case containing the attachment.
​
expiry
integer | null
URL expiry time in seconds. If not provided, uses the default from configuration.Default: null.

​
Examples

Work with attachments 
- ref: upload_attachment
  action: core.cases.upload_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    file_name: note.txt
    content_base64: Zm9yZW5zaWMgbm90ZXM=
    content_type: text/plain
- ref: upload_attachment_from_url
  action: core.cases.upload_attachment_from_url
  args:
    case_id: ${{ TRIGGER.case_id }}
    url: https://artifacts.example.com/evidence/${{ TRIGGER.alert_id }}
    headers:
      Authorization: Bearer ${{ SECRETS.artifacts.API_TOKEN }}
    file_name: evidence.json
- ref: list_attachments
  action: core.cases.list_attachments
  args:
    case_id: ${{ TRIGGER.case_id }}
- ref: get_attachment
  action: core.cases.get_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
- ref: get_download_url
  action: core.cases.get_attachment_download_url
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
    expiry: 900
- ref: download_attachment
  action: core.cases.download_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
- ref: delete_attachment
  action: core.cases.delete_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}

​
core.cases.download_attachment

Download an attachment’s content.

​
Inputs

​
attachment_id
string
required
The ID of the attachment to download.
​
case_id
string
required
The ID of the case containing the attachment.

​
Examples

Work with attachments 
- ref: upload_attachment
  action: core.cases.upload_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    file_name: note.txt
    content_base64: Zm9yZW5zaWMgbm90ZXM=
    content_type: text/plain
- ref: upload_attachment_from_url
  action: core.cases.upload_attachment_from_url
  args:
    case_id: ${{ TRIGGER.case_id }}
    url: https://artifacts.example.com/evidence/${{ TRIGGER.alert_id }}
    headers:
      Authorization: Bearer ${{ SECRETS.artifacts.API_TOKEN }}
    file_name: evidence.json
- ref: list_attachments
  action: core.cases.list_attachments
  args:
    case_id: ${{ TRIGGER.case_id }}
- ref: get_attachment
  action: core.cases.get_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
- ref: get_download_url
  action: core.cases.get_attachment_download_url
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
    expiry: 900
- ref: download_attachment
  action: core.cases.download_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
- ref: delete_attachment
  action: core.cases.delete_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}

​
core.cases.delete_attachment

Delete an attachment from a case.

​
Inputs

​
attachment_id
string
required
The ID of the attachment to delete.
​
case_id
string
required
The ID of the case containing the attachment.

​
Examples

Work with attachments 
- ref: upload_attachment
  action: core.cases.upload_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    file_name: note.txt
    content_base64: Zm9yZW5zaWMgbm90ZXM=
    content_type: text/plain
- ref: upload_attachment_from_url
  action: core.cases.upload_attachment_from_url
  args:
    case_id: ${{ TRIGGER.case_id }}
    url: https://artifacts.example.com/evidence/${{ TRIGGER.alert_id }}
    headers:
      Authorization: Bearer ${{ SECRETS.artifacts.API_TOKEN }}
    file_name: evidence.json
- ref: list_attachments
  action: core.cases.list_attachments
  args:
    case_id: ${{ TRIGGER.case_id }}
- ref: get_attachment
  action: core.cases.get_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
- ref: get_download_url
  action: core.cases.get_attachment_download_url
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
    expiry: 900
- ref: download_attachment
  action: core.cases.download_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
- ref: delete_attachment
  action: core.cases.delete_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}