Overview
Attachments in Corsa can be linked to multiple entity types:Step 1: Upload Files
Endpoint:POST /v1/attachments/upload
Upload files directly and associate them with an entity. Files are sent as multipart form data. The response returns attachment IDs that you can use to relate files to additional entities later.
Constraints
- Maximum file size: 10 MB (10,485,760 bytes) per file
- Maximum files per request: 10
- Maximum total request size: 110 MB (115,343,360 bytes), which covers 10 files at the per-file limit plus multipart overhead
- All files must be sent in the
filesmultipart field
Supported File Types
Files are validated by their content, not only their extension. A file whose content does not match its extension is rejected.
Error Responses
Limit errors return JSON that includes the limit that was exceeded:
Step 2: Create from External URL
Endpoint:POST /v1/attachments/external-document
If your documents are hosted externally (e.g., in your own storage or a vendor system), create attachment records by providing a download URL.
Source Values
Step 3: Relate Attachments to Entities
Endpoint:POST /v1/attachments/relate
Link existing attachments to a new entity. This is useful when the same document is relevant to multiple entities (e.g., a report that applies to both an alert and a case).
You can relate up to 100 attachments in a single request.
Step 4: Retrieve Attachments
List Attachments for an Entity
Endpoint:GET /v1/attachments
Get Download URLs
Endpoint:GET /v1/attachments/download-urls
Retrieve signed download URLs for specific attachments.
Step 5: Update & Delete Attachments
Update an Attachment
Endpoint:PUT /v1/attachments/{attachmentId}
Delete an Attachment
Endpoint:DELETE /v1/attachments/{attachmentId}
What’s Next?
Ingest Alerts & Cases
Push external alerts and create investigation cases.
Manage Alerts & Cases
Batch create, bulk assign, and update alerts and cases.