Problem using the API bulk

[joseluratm]

hi, I need to use the endpoint api /api/case/artifact/_bulk
I'm trying to send a list with artifacts,a single artifact, and a lot of different ways, but no one works.
Can you share an example of how to use it correctly , please?

Thanks!!!

[To-om]

Hi,
The endpoint /api/case/artifact/_bulk is available only using PATCH method and is used to update a set of observable (cf. the file routes).
If you want to create several observables with the same type, you can put all data in a list:

POST /api/case/{caseId}/artifact
{
  "dataType": "ip",
  "data": ["192.168.0.1", "192.168.0.2", "192.168.0.3", "192.168.0.4"],
  "message": "my IP addresses"
}

If the observables you want to create haven't the same type, you cannot do it with only one call. You have to do a request for each (or for each type).

[joseluratm]

Thanks To-om, if we understand well this is the correct way to create a new artifact when it doesn't exists, but it could be great to develop a little piece of code to update a observables list. We thinked using bulk request we could achieve it.

We are trying to use bulk request to update tags and description from an existing observable. We opened this ticket to know if there is a way to provide a JSON to do it using this request. Am i using bulk request in the wrong way? The only way to achieve this update is looping over each single one observable?

thanks!!