---
title: stack kb security-endpoint-management-api endpoint-get-actions-list cli command
description: Get response actions Behaviour flags: --dry-run — validate all inputs and exit without performing any action 
url: https://www.elastic.co/elastic/docs-builder/docs/4083/reference/elastic-cli/cli/stack/kb/security-endpoint-management-api/endpoint-get-actions-list
applies_to:
  - Elastic Cloud Serverless: Preview
  - Elastic Stack: Preview
---

# stack kb security-endpoint-management-api endpoint-get-actions-list cli command
<cli-modifiers>
</cli-modifiers>

```bash
elastic stack kb security-endpoint-management-api endpoint-get-actions-list \
  [options]
```

Get response actions
**Behaviour flags:**
`--dry-run` — validate all inputs and exit without performing any action

## Options

<definitions>
  <definition term="--page number">
    The page number to return.
  </definition>
  <definition term="--page-size number">
    The number of response actions to return per page.
  </definition>
  <definition term="--commands string[]">
    A list of response action command names to filter by.
    **Repeatable:** pass `--commands` multiple times to supply more than one value
  </definition>
  <definition term="--agent-ids string">
    A list of Elastic Agent IDs to filter the response actions by.
    **Repeatable:** pass `--agent-ids` multiple times to supply more than one value
  </definition>
  <definition term="--user-ids string">
    A list of user IDs that submitted the response actions.
    **Repeatable:** pass `--user-ids` multiple times to supply more than one value
  </definition>
  <definition term="--start-date string">
    A start date in ISO 8601 format or Date Math format (for example, `now-24h`).
  </definition>
  <definition term="--end-date string">
    An end date in ISO 8601 format or Date Math format (for example, `now`).
  </definition>
  <definition term="--agent-types enum">
    The agent type to filter response actions by. Defaults to `endpoint`.
    **Values:** endpoint, sentinel_one, crowdstrike, microsoft_defender_endpoint
  </definition>
  <definition term="--with-outputs string">
    A list of response action IDs whose outputs should be included in the response.
    **Repeatable:** pass `--with-outputs` multiple times to supply more than one value
  </definition>
  <definition term="--types string[]">
    A list of response action types to filter by (`automated`, `manual`).
    **Repeatable:** pass `--types` multiple times to supply more than one value
  </definition>
  <definition term="--input-file string">
    path to a JSON file to use as command input
  </definition>
  <definition term="--dry-run">
    validate all inputs and exit without performing any action (preview changes without applying them)
  </definition>
</definitions>


## Global Options

<definitions>
  <definition term="--json">
    output as JSON
  </definition>
</definitions>