---
title: "Update Case Artifact"
method: PUT
path: "/connect/case/artifacts"
tags: ["Cases"]
---

# Update Case Artifact

`PUT /connect/case/artifacts`

Updates an existing case artifact with a provided artifact object as input. Important: The artifact value and type cannot be modified.

## Request body

- ModelArtifact
  - `artifactType` string, required — The artifact type as set by the server. This is an internal, read-only field.
  - `caseId` string, required — The case ID for which this artifact is to be attached, or is already attached.
  - `createTime` string — The date and time that this object was created. This is a read-only field.
  - `description` string — A description that explains how this artifact relates to the case.
  - `groupId` string — The group ID as set by the server. This is an internal, read-only field.
  - `groupType` string — The group type as set by the server. This is an internal, read-only field.
  - `id` string — The ID assigned to this object by the server. This is a read-only field.
  - `ioc` boolean — A flag representing whether this artifact is an indicator of compromise (IoC).
  - `kind` string — The kind of object. This is a read-only field.
  - `md5` string — An MD5 hash of the artifact stream. This field is determined by the server upon file upload and is ready-only.
  - `mimeType` string — The mime type of the artifact stream. This field is determined by the server upon file upload and is read-only.
  - `operation` string — The operation that was applied to the object. This is a read-only field.
  - `protected` boolean — A flag representing whether this file artifact is protected. A protected file will be automatically zipped by the server before being retrieved, to avoid accidentally executing a potentially harmful attachment.
  - `sha1` string — A SHA-1 hash of the artifact stream. This field is determined by the server upon file upload and is ready-only.
  - `sha256` string — A SHA-256 hash of the artifact stream. This field is determined by the server upon file upload and is ready-only.
  - `streamId` string — The stream ID of the artifact stream. This field is determined by the server upon file upload and is ready-only.
  - `streamLength` integer — The length of the artifact stream. This field is determined by the server upon file upload and is ready-only.
  - `tags` string[] — Tags to assign to this artifact.
  - `tlp` string — The traffic light protocol value for this artifact.
  - `updateTime` string — The date and time that this object was last modified. This is a read-only field.
  - `userId` string — The user ID (or API client ID) that initiated this event. This is a read-only field.
  - `value` string, required — The value of this artifact. Essentially this is the content of the artifact itself, such as an IP address, a hostname, a filename, etc.

## Response `200`

Outputs the case artifact object.

- ModelArtifact
  - `artifactType` string, required — The artifact type as set by the server. This is an internal, read-only field.
  - `caseId` string, required — The case ID for which this artifact is to be attached, or is already attached.
  - `createTime` string — The date and time that this object was created. This is a read-only field.
  - `description` string — A description that explains how this artifact relates to the case.
  - `groupId` string — The group ID as set by the server. This is an internal, read-only field.
  - `groupType` string — The group type as set by the server. This is an internal, read-only field.
  - `id` string — The ID assigned to this object by the server. This is a read-only field.
  - `ioc` boolean — A flag representing whether this artifact is an indicator of compromise (IoC).
  - `kind` string — The kind of object. This is a read-only field.
  - `md5` string — An MD5 hash of the artifact stream. This field is determined by the server upon file upload and is ready-only.
  - `mimeType` string — The mime type of the artifact stream. This field is determined by the server upon file upload and is read-only.
  - `operation` string — The operation that was applied to the object. This is a read-only field.
  - `protected` boolean — A flag representing whether this file artifact is protected. A protected file will be automatically zipped by the server before being retrieved, to avoid accidentally executing a potentially harmful attachment.
  - `sha1` string — A SHA-1 hash of the artifact stream. This field is determined by the server upon file upload and is ready-only.
  - `sha256` string — A SHA-256 hash of the artifact stream. This field is determined by the server upon file upload and is ready-only.
  - `streamId` string — The stream ID of the artifact stream. This field is determined by the server upon file upload and is ready-only.
  - `streamLength` integer — The length of the artifact stream. This field is determined by the server upon file upload and is ready-only.
  - `tags` string[] — Tags to assign to this artifact.
  - `tlp` string — The traffic light protocol value for this artifact.
  - `updateTime` string — The date and time that this object was last modified. This is a read-only field.
  - `userId` string — The user ID (or API client ID) that initiated this event. This is a read-only field.
  - `value` string, required — The value of this artifact. Essentially this is the content of the artifact itself, such as an IP address, a hostname, a filename, etc.

## Other responses

- `400` — The provided input object or parameters are malformed or invalid
- `401` — Request was not properly authenticated
- `403` — Insufficient permissions for this request
- `404` — Case artifact not found
- `405` — Case module not configured on server
- `500` — Internal SOC error; review SOC logs

---

[API](https://skmtc.net/security-onion-solutions/apis/security-onion-connect-api.md) · [All operations](https://skmtc.net/security-onion-solutions/apis/security-onion-connect-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/security-onion-solutions/security-onion-connect-api/versions/0576ce393f8d/schema)