---
title: "Create Case Artifact"
method: POST
path: "/connect/case/artifacts/"
tags: ["Cases"]
---

# Create Case Artifact

`POST /connect/case/artifacts/`

Attach an observable to an existing case.
Observables are considered "artifacts" in SOC internal terminology.
If not creating a file artifact then only the artifact itself should be sent as the body, in JSON format.
If creating a file artifact then two multipart-form values should be supplied: "json" (the artifact object), and "attachment" (the file bytes). The file size, hashes, mime type will be automatically generated and populated into the artifact object on the server.

## Request body

- ModelArtifact
  - `artifactType` string, required — The artifact type as set by the server. This is an internal, read-only field.
  - `caseId` string, required — The case ID for which this artifact is to be attached, or is already attached.
  - `createTime` string — The date and time that this object was created. This is a read-only field.
  - `description` string — A description that explains how this artifact relates to the case.
  - `groupId` string — The group ID as set by the server. This is an internal, read-only field.
  - `groupType` string — The group type as set by the server. This is an internal, read-only field.
  - `id` string — The ID assigned to this object by the server. This is a read-only field.
  - `ioc` boolean — A flag representing whether this artifact is an indicator of compromise (IoC).
  - `kind` string — The kind of object. This is a read-only field.
  - `md5` string — An MD5 hash of the artifact stream. This field is determined by the server upon file upload and is ready-only.
  - `mimeType` string — The mime type of the artifact stream. This field is determined by the server upon file upload and is read-only.
  - `operation` string — The operation that was applied to the object. This is a read-only field.
  - `protected` boolean — A flag representing whether this file artifact is protected. A protected file will be automatically zipped by the server before being retrieved, to avoid accidentally executing a potentially harmful attachment.
  - `sha1` string — A SHA-1 hash of the artifact stream. This field is determined by the server upon file upload and is ready-only.
  - `sha256` string — A SHA-256 hash of the artifact stream. This field is determined by the server upon file upload and is ready-only.
  - `streamId` string — The stream ID of the artifact stream. This field is determined by the server upon file upload and is ready-only.
  - `streamLength` integer — The length of the artifact stream. This field is determined by the server upon file upload and is ready-only.
  - `tags` string[] — Tags to assign to this artifact.
  - `tlp` string — The traffic light protocol value for this artifact.
  - `updateTime` string — The date and time that this object was last modified. This is a read-only field.
  - `userId` string — The user ID (or API client ID) that initiated this event. This is a read-only field.
  - `value` string, required — The value of this artifact. Essentially this is the content of the artifact itself, such as an IP address, a hostname, a filename, etc.

## Response `200`

Outputs the artifact object including its generated ID.

- ModelArtifact
  - `artifactType` string, required — The artifact type as set by the server. This is an internal, read-only field.
  - `caseId` string, required — The case ID for which this artifact is to be attached, or is already attached.
  - `createTime` string — The date and time that this object was created. This is a read-only field.
  - `description` string — A description that explains how this artifact relates to the case.
  - `groupId` string — The group ID as set by the server. This is an internal, read-only field.
  - `groupType` string — The group type as set by the server. This is an internal, read-only field.
  - `id` string — The ID assigned to this object by the server. This is a read-only field.
  - `ioc` boolean — A flag representing whether this artifact is an indicator of compromise (IoC).
  - `kind` string — The kind of object. This is a read-only field.
  - `md5` string — An MD5 hash of the artifact stream. This field is determined by the server upon file upload and is ready-only.
  - `mimeType` string — The mime type of the artifact stream. This field is determined by the server upon file upload and is read-only.
  - `operation` string — The operation that was applied to the object. This is a read-only field.
  - `protected` boolean — A flag representing whether this file artifact is protected. A protected file will be automatically zipped by the server before being retrieved, to avoid accidentally executing a potentially harmful attachment.
  - `sha1` string — A SHA-1 hash of the artifact stream. This field is determined by the server upon file upload and is ready-only.
  - `sha256` string — A SHA-256 hash of the artifact stream. This field is determined by the server upon file upload and is ready-only.
  - `streamId` string — The stream ID of the artifact stream. This field is determined by the server upon file upload and is ready-only.
  - `streamLength` integer — The length of the artifact stream. This field is determined by the server upon file upload and is ready-only.
  - `tags` string[] — Tags to assign to this artifact.
  - `tlp` string — The traffic light protocol value for this artifact.
  - `updateTime` string — The date and time that this object was last modified. This is a read-only field.
  - `userId` string — The user ID (or API client ID) that initiated this event. This is a read-only field.
  - `value` string, required — The value of this artifact. Essentially this is the content of the artifact itself, such as an IP address, a hostname, a filename, etc.

## Other responses

- `400` — The provided input object or parameters are malformed or invalid
- `401` — Request was not properly authenticated
- `403` — Insufficient permissions for this request
- `405` — Case module not configured on server
- `500` — Internal SOC error; review SOC logs

---

[API](https://skmtc.net/security-onion-solutions/apis/security-onion-connect-api.md) · [All operations](https://skmtc.net/security-onion-solutions/apis/security-onion-connect-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/security-onion-solutions/security-onion-connect-api/revisions/0576ce393f8d/schema)