> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tracecat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Attachments

## `core.cases.upload_attachment`

Upload a file attachment to a case.

### Inputs

<ParamField path="case_id" type="string" required>
  The ID of the case to attach the file to.
</ParamField>

<ParamField path="content_base64" type="string" required>
  The file content encoded in base64.
</ParamField>

<ParamField path="content_type" type="string" required>
  The MIME type of the file (e.g., 'application/pdf').
</ParamField>

<ParamField path="file_name" type="string" required>
  The original filename.
</ParamField>

### Examples

**Work with attachments**

```yaml theme={null}
- ref: upload_attachment
  action: core.cases.upload_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    file_name: note.txt
    content_base64: Zm9yZW5zaWMgbm90ZXM=
    content_type: text/plain
- ref: upload_attachment_from_url
  action: core.cases.upload_attachment_from_url
  args:
    case_id: ${{ TRIGGER.case_id }}
    url: https://artifacts.example.com/evidence/${{ TRIGGER.alert_id }}
    headers:
      Authorization: Bearer ${{ SECRETS.artifacts.API_TOKEN }}
    file_name: evidence.json
- ref: list_attachments
  action: core.cases.list_attachments
  args:
    case_id: ${{ TRIGGER.case_id }}
- ref: get_attachment
  action: core.cases.get_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
- ref: get_download_url
  action: core.cases.get_attachment_download_url
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
    expiry: 900
- ref: download_attachment
  action: core.cases.download_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
- ref: delete_attachment
  action: core.cases.delete_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
```

## `core.cases.upload_attachment_from_url`

Upload a file attachment to a case from a URL.

### Inputs

<ParamField path="case_id" type="string" required>
  The ID of the case to attach the file to.
</ParamField>

<ParamField path="url" type="string" required>
  The URL of the file to upload.
</ParamField>

<ParamField path="file_name" type="string | null">
  Filename of the file to upload. If not provided, the filename will be inferred from the URL.

  Default: `null`.
</ParamField>

<ParamField path="headers" type="map[string, string] | null">
  The headers to use when downloading the file.

  Default: `null`.
</ParamField>

### Examples

**Work with attachments**

```yaml theme={null}
- ref: upload_attachment
  action: core.cases.upload_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    file_name: note.txt
    content_base64: Zm9yZW5zaWMgbm90ZXM=
    content_type: text/plain
- ref: upload_attachment_from_url
  action: core.cases.upload_attachment_from_url
  args:
    case_id: ${{ TRIGGER.case_id }}
    url: https://artifacts.example.com/evidence/${{ TRIGGER.alert_id }}
    headers:
      Authorization: Bearer ${{ SECRETS.artifacts.API_TOKEN }}
    file_name: evidence.json
- ref: list_attachments
  action: core.cases.list_attachments
  args:
    case_id: ${{ TRIGGER.case_id }}
- ref: get_attachment
  action: core.cases.get_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
- ref: get_download_url
  action: core.cases.get_attachment_download_url
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
    expiry: 900
- ref: download_attachment
  action: core.cases.download_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
- ref: delete_attachment
  action: core.cases.delete_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
```

## `core.cases.list_attachments`

List all attachments for a case.

### Inputs

<ParamField path="case_id" type="string" required>
  The ID of the case to list attachments for.
</ParamField>

### Examples

**Work with attachments**

```yaml theme={null}
- ref: upload_attachment
  action: core.cases.upload_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    file_name: note.txt
    content_base64: Zm9yZW5zaWMgbm90ZXM=
    content_type: text/plain
- ref: upload_attachment_from_url
  action: core.cases.upload_attachment_from_url
  args:
    case_id: ${{ TRIGGER.case_id }}
    url: https://artifacts.example.com/evidence/${{ TRIGGER.alert_id }}
    headers:
      Authorization: Bearer ${{ SECRETS.artifacts.API_TOKEN }}
    file_name: evidence.json
- ref: list_attachments
  action: core.cases.list_attachments
  args:
    case_id: ${{ TRIGGER.case_id }}
- ref: get_attachment
  action: core.cases.get_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
- ref: get_download_url
  action: core.cases.get_attachment_download_url
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
    expiry: 900
- ref: download_attachment
  action: core.cases.download_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
- ref: delete_attachment
  action: core.cases.delete_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
```

## `core.cases.get_attachment`

Get attachment metadata without downloading the content.

### Inputs

<ParamField path="attachment_id" type="string" required>
  The ID of the attachment to get.
</ParamField>

<ParamField path="case_id" type="string" required>
  The ID of the case containing the attachment.
</ParamField>

### Examples

**Work with attachments**

```yaml theme={null}
- ref: upload_attachment
  action: core.cases.upload_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    file_name: note.txt
    content_base64: Zm9yZW5zaWMgbm90ZXM=
    content_type: text/plain
- ref: upload_attachment_from_url
  action: core.cases.upload_attachment_from_url
  args:
    case_id: ${{ TRIGGER.case_id }}
    url: https://artifacts.example.com/evidence/${{ TRIGGER.alert_id }}
    headers:
      Authorization: Bearer ${{ SECRETS.artifacts.API_TOKEN }}
    file_name: evidence.json
- ref: list_attachments
  action: core.cases.list_attachments
  args:
    case_id: ${{ TRIGGER.case_id }}
- ref: get_attachment
  action: core.cases.get_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
- ref: get_download_url
  action: core.cases.get_attachment_download_url
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
    expiry: 900
- ref: download_attachment
  action: core.cases.download_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
- ref: delete_attachment
  action: core.cases.delete_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
```

## `core.cases.get_attachment_download_url`

Get a presigned S3 URL for downloading an attachment.

### Inputs

<ParamField path="attachment_id" type="string" required>
  The ID of the attachment.
</ParamField>

<ParamField path="case_id" type="string" required>
  The ID of the case containing the attachment.
</ParamField>

<ParamField path="expiry" type="integer | null">
  URL expiry time in seconds. If not provided, uses the default from configuration.

  Default: `null`.
</ParamField>

### Examples

**Work with attachments**

```yaml theme={null}
- ref: upload_attachment
  action: core.cases.upload_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    file_name: note.txt
    content_base64: Zm9yZW5zaWMgbm90ZXM=
    content_type: text/plain
- ref: upload_attachment_from_url
  action: core.cases.upload_attachment_from_url
  args:
    case_id: ${{ TRIGGER.case_id }}
    url: https://artifacts.example.com/evidence/${{ TRIGGER.alert_id }}
    headers:
      Authorization: Bearer ${{ SECRETS.artifacts.API_TOKEN }}
    file_name: evidence.json
- ref: list_attachments
  action: core.cases.list_attachments
  args:
    case_id: ${{ TRIGGER.case_id }}
- ref: get_attachment
  action: core.cases.get_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
- ref: get_download_url
  action: core.cases.get_attachment_download_url
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
    expiry: 900
- ref: download_attachment
  action: core.cases.download_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
- ref: delete_attachment
  action: core.cases.delete_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
```

## `core.cases.download_attachment`

Download an attachment's content.

### Inputs

<ParamField path="attachment_id" type="string" required>
  The ID of the attachment to download.
</ParamField>

<ParamField path="case_id" type="string" required>
  The ID of the case containing the attachment.
</ParamField>

### Examples

**Work with attachments**

```yaml theme={null}
- ref: upload_attachment
  action: core.cases.upload_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    file_name: note.txt
    content_base64: Zm9yZW5zaWMgbm90ZXM=
    content_type: text/plain
- ref: upload_attachment_from_url
  action: core.cases.upload_attachment_from_url
  args:
    case_id: ${{ TRIGGER.case_id }}
    url: https://artifacts.example.com/evidence/${{ TRIGGER.alert_id }}
    headers:
      Authorization: Bearer ${{ SECRETS.artifacts.API_TOKEN }}
    file_name: evidence.json
- ref: list_attachments
  action: core.cases.list_attachments
  args:
    case_id: ${{ TRIGGER.case_id }}
- ref: get_attachment
  action: core.cases.get_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
- ref: get_download_url
  action: core.cases.get_attachment_download_url
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
    expiry: 900
- ref: download_attachment
  action: core.cases.download_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
- ref: delete_attachment
  action: core.cases.delete_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
```

## `core.cases.delete_attachment`

Delete an attachment from a case.

### Inputs

<ParamField path="attachment_id" type="string" required>
  The ID of the attachment to delete.
</ParamField>

<ParamField path="case_id" type="string" required>
  The ID of the case containing the attachment.
</ParamField>

### Examples

**Work with attachments**

```yaml theme={null}
- ref: upload_attachment
  action: core.cases.upload_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    file_name: note.txt
    content_base64: Zm9yZW5zaWMgbm90ZXM=
    content_type: text/plain
- ref: upload_attachment_from_url
  action: core.cases.upload_attachment_from_url
  args:
    case_id: ${{ TRIGGER.case_id }}
    url: https://artifacts.example.com/evidence/${{ TRIGGER.alert_id }}
    headers:
      Authorization: Bearer ${{ SECRETS.artifacts.API_TOKEN }}
    file_name: evidence.json
- ref: list_attachments
  action: core.cases.list_attachments
  args:
    case_id: ${{ TRIGGER.case_id }}
- ref: get_attachment
  action: core.cases.get_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
- ref: get_download_url
  action: core.cases.get_attachment_download_url
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
    expiry: 900
- ref: download_attachment
  action: core.cases.download_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
- ref: delete_attachment
  action: core.cases.delete_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
```