---
type: api
title: Get action details
description: Get the details of a response action using the action ID.
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v0/operation/operation-endpointgetactionsdetails
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v0/operation/operation-endpointgetactionsdetails
products:
  - Kibana
---

# Get action details

- Server: `https://{kibana_url}`

## Paths

- `GET` `/api/endpoint/action/{action_id}`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v0/authentication#apikeyauth)
- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v0/authentication#basicauth)

#### Path Parameters

- `action_id` (string · min: 1 · max: 256)
  The ID of the response action to retrieve.

## Description

Get the details of a response action using the action ID.

## Response

OK

`application/json`

One of:
- **KillProcess** (`command: kill-process`)
  - `agents` ([] string)
    The agent IDs for the hosts that the response action was sent to
  - `agentState` (map string to object)
    The state of the response action for each agent ID that it was sent to
    Map values (object)
    - `completedAt` (string)
      The date and time the response action was completed for the agent ID
    - `isCompleted` (boolean)
      Whether the response action is completed for the agent ID
    - `wasCanceled` (boolean)
      Whether the response action was canceled for the agent ID
    - `wasSuccessful` (boolean)
      Whether the response action was successful for the agent ID
  - `agentType` (enum)
    List of agent types to retrieve. Defaults to `endpoint`.
    Values: `endpoint`, `sentinel_one`, `crowdstrike`, `microsoft_defender_endpoint`
  - `command` (enum  · min: 1)
    The command for the response action
    Values: `isolate`, `unisolate`, `kill-process`, `suspend-process`, `running-processes`, `get-file`, `execute`, `upload`, `scan`, `runscript`, `cancel`, `memory-dump`
  - `completedAt` (string)
    The response action completion time
  - `createdBy` (string)
    The user who created the response action
  - `hosts` (map string to object)
    An object containing the host names associated with the agent IDs the response action was sent to
    Map values (object)
    - `name` (string)
      The host name
  - `id` (string)
    The response action ID
  - `isComplete` (boolean)
    Whether the response action is complete
  - `isExpired` (boolean)
    Whether the response action is expired
  - `outputs` (map string to object)
    The outputs of the response action for each agent ID that it was sent to. Content different depending on the
response action command and will only be present for agents that have responded to the response action
    Map values (object)
    - `content` (string | object)
      The response action output content for the agent ID. Exact format depends on the response action command.
    - `type` (enum)
      Values: `json`, `text`
  - `parameters` (object)
    The parameters of the response action. Content different depending on the response action command
  - `startedAt` (string)
    The response action start time
  - `status` (string)
    The response action status
  - `wasCanceled` (boolean)
    Whether the response action was canceled
  - `wasSuccessful` (boolean)
    Whether the response action was successful
- **GetFile** (`command: get-file`)
  - `agents` ([] string)
    The agent IDs for the hosts that the response action was sent to
  - `agentState` (map string to object)
    The state of the response action for each agent ID that it was sent to
    Map values (object)
    - `completedAt` (string)
      The date and time the response action was completed for the agent ID
    - `isCompleted` (boolean)
      Whether the response action is completed for the agent ID
    - `wasCanceled` (boolean)
      Whether the response action was canceled for the agent ID
    - `wasSuccessful` (boolean)
      Whether the response action was successful for the agent ID
  - `agentType` (enum)
    List of agent types to retrieve. Defaults to `endpoint`.
    Values: `endpoint`, `sentinel_one`, `crowdstrike`, `microsoft_defender_endpoint`
  - `command` (enum  · min: 1)
    The command for the response action
    Values: `isolate`, `unisolate`, `kill-process`, `suspend-process`, `running-processes`, `get-file`, `execute`, `upload`, `scan`, `runscript`, `cancel`, `memory-dump`
  - `completedAt` (string)
    The response action completion time
  - `createdBy` (string)
    The user who created the response action
  - `hosts` (map string to object)
    An object containing the host names associated with the agent IDs the response action was sent to
    Map values (object)
    - `name` (string)
      The host name
  - `id` (string)
    The response action ID
  - `isComplete` (boolean)
    Whether the response action is complete
  - `isExpired` (boolean)
    Whether the response action is expired
  - `outputs` (map string to object)
    The outputs of the response action for each agent ID that it was sent to. Content different depending on the
response action command and will only be present for agents that have responded to the response action
    Map values (object)
    - `content` (string | object)
      The response action output content for the agent ID. Exact format depends on the response action command.
    - `type` (enum)
      Values: `json`, `text`
  - `parameters` (object)
    The parameters of the response action. Content different depending on the response action command
  - `startedAt` (string)
    The response action start time
  - `status` (string)
    The response action status
  - `wasCanceled` (boolean)
    Whether the response action was canceled
  - `wasSuccessful` (boolean)
    Whether the response action was successful
- **Execute** (`command: execute`)
  - `agents` ([] string)
    The agent IDs for the hosts that the response action was sent to
  - `agentState` (map string to object)
    The state of the response action for each agent ID that it was sent to
    Map values (object)
    - `completedAt` (string)
      The date and time the response action was completed for the agent ID
    - `isCompleted` (boolean)
      Whether the response action is completed for the agent ID
    - `wasCanceled` (boolean)
      Whether the response action was canceled for the agent ID
    - `wasSuccessful` (boolean)
      Whether the response action was successful for the agent ID
  - `agentType` (enum)
    List of agent types to retrieve. Defaults to `endpoint`.
    Values: `endpoint`, `sentinel_one`, `crowdstrike`, `microsoft_defender_endpoint`
  - `command` (enum  · min: 1)
    The command for the response action
    Values: `isolate`, `unisolate`, `kill-process`, `suspend-process`, `running-processes`, `get-file`, `execute`, `upload`, `scan`, `runscript`, `cancel`, `memory-dump`
  - `completedAt` (string)
    The response action completion time
  - `createdBy` (string)
    The user who created the response action
  - `hosts` (map string to object)
    An object containing the host names associated with the agent IDs the response action was sent to
    Map values (object)
    - `name` (string)
      The host name
  - `id` (string)
    The response action ID
  - `isComplete` (boolean)
    Whether the response action is complete
  - `isExpired` (boolean)
    Whether the response action is expired
  - `outputs` (map string to object)
    The outputs of the response action for each agent ID that it was sent to. Content different depending on the
response action command and will only be present for agents that have responded to the response action
    Map values (object)
    - `content` (string | object)
      The response action output content for the agent ID. Exact format depends on the response action command.
    - `type` (enum)
      Values: `json`, `text`
  - `parameters` (object)
    The parameters of the response action. Content different depending on the response action command
  - `startedAt` (string)
    The response action start time
  - `status` (string)
    The response action status
  - `wasCanceled` (boolean)
    Whether the response action was canceled
  - `wasSuccessful` (boolean)
    Whether the response action was successful
- **Runscript** (`command: runscript`)
  - `agents` ([] string)
    The agent IDs for the hosts that the response action was sent to
  - `agentState` (map string to object)
    The state of the response action for each agent ID that it was sent to
    Map values (object)
    - `completedAt` (string)
      The date and time the response action was completed for the agent ID
    - `isCompleted` (boolean)
      Whether the response action is completed for the agent ID
    - `wasCanceled` (boolean)
      Whether the response action was canceled for the agent ID
    - `wasSuccessful` (boolean)
      Whether the response action was successful for the agent ID
  - `agentType` (enum)
    List of agent types to retrieve. Defaults to `endpoint`.
    Values: `endpoint`, `sentinel_one`, `crowdstrike`, `microsoft_defender_endpoint`
  - `command` (enum  · min: 1)
    The command for the response action
    Values: `isolate`, `unisolate`, `kill-process`, `suspend-process`, `running-processes`, `get-file`, `execute`, `upload`, `scan`, `runscript`, `cancel`, `memory-dump`
  - `completedAt` (string)
    The response action completion time
  - `createdBy` (string)
    The user who created the response action
  - `hosts` (map string to object)
    An object containing the host names associated with the agent IDs the response action was sent to
    Map values (object)
    - `name` (string)
      The host name
  - `id` (string)
    The response action ID
  - `isComplete` (boolean)
    Whether the response action is complete
  - `isExpired` (boolean)
    Whether the response action is expired
  - `outputs` (map string to object)
    The outputs of the response action for each agent ID that it was sent to. Content different depending on the
response action command and will only be present for agents that have responded to the response action
    Map values (object)
    - `content` (string | object)
      The response action output content for the agent ID. Exact format depends on the response action command.
    - `type` (enum)
      Values: `json`, `text`
  - `parameters` (object)
    The parameters of the response action. Content different depending on the response action command
  - `startedAt` (string)
    The response action start time
  - `status` (string)
    The response action status
  - `wasCanceled` (boolean)
    Whether the response action was canceled
  - `wasSuccessful` (boolean)
    Whether the response action was successful
- **Upload** (`command: upload`)
  - `agents` ([] string)
    The agent IDs for the hosts that the response action was sent to
  - `agentState` (map string to object)
    The state of the response action for each agent ID that it was sent to
    Map values (object)
    - `completedAt` (string)
      The date and time the response action was completed for the agent ID
    - `isCompleted` (boolean)
      Whether the response action is completed for the agent ID
    - `wasCanceled` (boolean)
      Whether the response action was canceled for the agent ID
    - `wasSuccessful` (boolean)
      Whether the response action was successful for the agent ID
  - `agentType` (enum)
    List of agent types to retrieve. Defaults to `endpoint`.
    Values: `endpoint`, `sentinel_one`, `crowdstrike`, `microsoft_defender_endpoint`
  - `command` (enum  · min: 1)
    The command for the response action
    Values: `isolate`, `unisolate`, `kill-process`, `suspend-process`, `running-processes`, `get-file`, `execute`, `upload`, `scan`, `runscript`, `cancel`, `memory-dump`
  - `completedAt` (string)
    The response action completion time
  - `createdBy` (string)
    The user who created the response action
  - `hosts` (map string to object)
    An object containing the host names associated with the agent IDs the response action was sent to
    Map values (object)
    - `name` (string)
      The host name
  - `id` (string)
    The response action ID
  - `isComplete` (boolean)
    Whether the response action is complete
  - `isExpired` (boolean)
    Whether the response action is expired
  - `outputs` (map string to object)
    The outputs of the response action for each agent ID that it was sent to. Content different depending on the
response action command and will only be present for agents that have responded to the response action
    Map values (object)
    - `content` (string | object)
      The response action output content for the agent ID. Exact format depends on the response action command.
    - `type` (enum)
      Values: `json`, `text`
  - `parameters` (object)
    The parameters of the response action. Content different depending on the response action command
  - `startedAt` (string)
    The response action start time
  - `status` (string)
    The response action status
  - `wasCanceled` (boolean)
    Whether the response action was canceled
  - `wasSuccessful` (boolean)
    Whether the response action was successful
- **Scan** (`command: scan`)
  - `agents` ([] string)
    The agent IDs for the hosts that the response action was sent to
  - `agentState` (map string to object)
    The state of the response action for each agent ID that it was sent to
    Map values (object)
    - `completedAt` (string)
      The date and time the response action was completed for the agent ID
    - `isCompleted` (boolean)
      Whether the response action is completed for the agent ID
    - `wasCanceled` (boolean)
      Whether the response action was canceled for the agent ID
    - `wasSuccessful` (boolean)
      Whether the response action was successful for the agent ID
  - `agentType` (enum)
    List of agent types to retrieve. Defaults to `endpoint`.
    Values: `endpoint`, `sentinel_one`, `crowdstrike`, `microsoft_defender_endpoint`
  - `command` (enum  · min: 1)
    The command for the response action
    Values: `isolate`, `unisolate`, `kill-process`, `suspend-process`, `running-processes`, `get-file`, `execute`, `upload`, `scan`, `runscript`, `cancel`, `memory-dump`
  - `completedAt` (string)
    The response action completion time
  - `createdBy` (string)
    The user who created the response action
  - `hosts` (map string to object)
    An object containing the host names associated with the agent IDs the response action was sent to
    Map values (object)
    - `name` (string)
      The host name
  - `id` (string)
    The response action ID
  - `isComplete` (boolean)
    Whether the response action is complete
  - `isExpired` (boolean)
    Whether the response action is expired
  - `outputs` (map string to object)
    The outputs of the response action for each agent ID that it was sent to. Content different depending on the
response action command and will only be present for agents that have responded to the response action
    Map values (object)
    - `content` (string | object)
      The response action output content for the agent ID. Exact format depends on the response action command.
    - `type` (enum)
      Values: `json`, `text`
  - `parameters` (object)
    The parameters of the response action. Content different depending on the response action command
  - `startedAt` (string)
    The response action start time
  - `status` (string)
    The response action status
  - `wasCanceled` (boolean)
    Whether the response action was canceled
  - `wasSuccessful` (boolean)
    Whether the response action was successful
- **Cancel** (`command: cancel`)
  - `agents` ([] string)
    The agent IDs for the hosts that the response action was sent to
  - `agentState` (map string to object)
    The state of the response action for each agent ID that it was sent to
    Map values (object)
    - `completedAt` (string)
      The date and time the response action was completed for the agent ID
    - `isCompleted` (boolean)
      Whether the response action is completed for the agent ID
    - `wasCanceled` (boolean)
      Whether the response action was canceled for the agent ID
    - `wasSuccessful` (boolean)
      Whether the response action was successful for the agent ID
  - `agentType` (enum)
    List of agent types to retrieve. Defaults to `endpoint`.
    Values: `endpoint`, `sentinel_one`, `crowdstrike`, `microsoft_defender_endpoint`
  - `command` (enum  · min: 1)
    The command for the response action
    Values: `isolate`, `unisolate`, `kill-process`, `suspend-process`, `running-processes`, `get-file`, `execute`, `upload`, `scan`, `runscript`, `cancel`, `memory-dump`
  - `completedAt` (string)
    The response action completion time
  - `createdBy` (string)
    The user who created the response action
  - `hosts` (map string to object)
    An object containing the host names associated with the agent IDs the response action was sent to
    Map values (object)
    - `name` (string)
      The host name
  - `id` (string)
    The response action ID
  - `isComplete` (boolean)
    Whether the response action is complete
  - `isExpired` (boolean)
    Whether the response action is expired
  - `outputs` (map string to object)
    The outputs of the response action for each agent ID that it was sent to. Content different depending on the
response action command and will only be present for agents that have responded to the response action
    Map values (object)
    - `content` (string | object)
      The response action output content for the agent ID. Exact format depends on the response action command.
    - `type` (enum)
      Values: `json`, `text`
  - `parameters` (object)
    The parameters of the response action. Content different depending on the response action command
  - `startedAt` (string)
    The response action start time
  - `status` (string)
    The response action status
  - `wasCanceled` (boolean)
    Whether the response action was canceled
  - `wasSuccessful` (boolean)
    Whether the response action was successful
- **Isolate** (`command: isolate`)
  - `agents` ([] string)
    The agent IDs for the hosts that the response action was sent to
  - `agentState` (map string to object)
    The state of the response action for each agent ID that it was sent to
    Map values (object)
    - `completedAt` (string)
      The date and time the response action was completed for the agent ID
    - `isCompleted` (boolean)
      Whether the response action is completed for the agent ID
    - `wasCanceled` (boolean)
      Whether the response action was canceled for the agent ID
    - `wasSuccessful` (boolean)
      Whether the response action was successful for the agent ID
  - `agentType` (enum)
    List of agent types to retrieve. Defaults to `endpoint`.
    Values: `endpoint`, `sentinel_one`, `crowdstrike`, `microsoft_defender_endpoint`
  - `command` (enum  · min: 1)
    The command for the response action
    Values: `isolate`, `unisolate`, `kill-process`, `suspend-process`, `running-processes`, `get-file`, `execute`, `upload`, `scan`, `runscript`, `cancel`, `memory-dump`
  - `completedAt` (string)
    The response action completion time
  - `createdBy` (string)
    The user who created the response action
  - `hosts` (map string to object)
    An object containing the host names associated with the agent IDs the response action was sent to
    Map values (object)
    - `name` (string)
      The host name
  - `id` (string)
    The response action ID
  - `isComplete` (boolean)
    Whether the response action is complete
  - `isExpired` (boolean)
    Whether the response action is expired
  - `outputs` (map string to object)
    The outputs of the response action for each agent ID that it was sent to. Content different depending on the
response action command and will only be present for agents that have responded to the response action
    Map values (object)
    - `content` (string | object)
      The response action output content for the agent ID. Exact format depends on the response action command.
    - `type` (enum)
      Values: `json`, `text`
  - `parameters` (object)
    The parameters of the response action. Content different depending on the response action command
  - `startedAt` (string)
    The response action start time
  - `status` (string)
    The response action status
  - `wasCanceled` (boolean)
    Whether the response action was canceled
  - `wasSuccessful` (boolean)
    Whether the response action was successful
- **Unisolate** (`command: unisolate`)
  - `agents` ([] string)
    The agent IDs for the hosts that the response action was sent to
  - `agentState` (map string to object)
    The state of the response action for each agent ID that it was sent to
    Map values (object)
    - `completedAt` (string)
      The date and time the response action was completed for the agent ID
    - `isCompleted` (boolean)
      Whether the response action is completed for the agent ID
    - `wasCanceled` (boolean)
      Whether the response action was canceled for the agent ID
    - `wasSuccessful` (boolean)
      Whether the response action was successful for the agent ID
  - `agentType` (enum)
    List of agent types to retrieve. Defaults to `endpoint`.
    Values: `endpoint`, `sentinel_one`, `crowdstrike`, `microsoft_defender_endpoint`
  - `command` (enum  · min: 1)
    The command for the response action
    Values: `isolate`, `unisolate`, `kill-process`, `suspend-process`, `running-processes`, `get-file`, `execute`, `upload`, `scan`, `runscript`, `cancel`, `memory-dump`
  - `completedAt` (string)
    The response action completion time
  - `createdBy` (string)
    The user who created the response action
  - `hosts` (map string to object)
    An object containing the host names associated with the agent IDs the response action was sent to
    Map values (object)
    - `name` (string)
      The host name
  - `id` (string)
    The response action ID
  - `isComplete` (boolean)
    Whether the response action is complete
  - `isExpired` (boolean)
    Whether the response action is expired
  - `outputs` (map string to object)
    The outputs of the response action for each agent ID that it was sent to. Content different depending on the
response action command and will only be present for agents that have responded to the response action
    Map values (object)
    - `content` (string | object)
      The response action output content for the agent ID. Exact format depends on the response action command.
    - `type` (enum)
      Values: `json`, `text`
  - `parameters` (object)
    The parameters of the response action. Content different depending on the response action command
  - `startedAt` (string)
    The response action start time
  - `status` (string)
    The response action status
  - `wasCanceled` (boolean)
    Whether the response action was canceled
  - `wasSuccessful` (boolean)
    Whether the response action was successful
- **SuspendProcess** (`command: suspend-process`)
  - `agents` ([] string)
    The agent IDs for the hosts that the response action was sent to
  - `agentState` (map string to object)
    The state of the response action for each agent ID that it was sent to
    Map values (object)
    - `completedAt` (string)
      The date and time the response action was completed for the agent ID
    - `isCompleted` (boolean)
      Whether the response action is completed for the agent ID
    - `wasCanceled` (boolean)
      Whether the response action was canceled for the agent ID
    - `wasSuccessful` (boolean)
      Whether the response action was successful for the agent ID
  - `agentType` (enum)
    List of agent types to retrieve. Defaults to `endpoint`.
    Values: `endpoint`, `sentinel_one`, `crowdstrike`, `microsoft_defender_endpoint`
  - `command` (enum  · min: 1)
    The command for the response action
    Values: `isolate`, `unisolate`, `kill-process`, `suspend-process`, `running-processes`, `get-file`, `execute`, `upload`, `scan`, `runscript`, `cancel`, `memory-dump`
  - `completedAt` (string)
    The response action completion time
  - `createdBy` (string)
    The user who created the response action
  - `hosts` (map string to object)
    An object containing the host names associated with the agent IDs the response action was sent to
    Map values (object)
    - `name` (string)
      The host name
  - `id` (string)
    The response action ID
  - `isComplete` (boolean)
    Whether the response action is complete
  - `isExpired` (boolean)
    Whether the response action is expired
  - `outputs` (map string to object)
    The outputs of the response action for each agent ID that it was sent to. Content different depending on the
response action command and will only be present for agents that have responded to the response action
    Map values (object)
    - `content` (string | object)
      The response action output content for the agent ID. Exact format depends on the response action command.
    - `type` (enum)
      Values: `json`, `text`
  - `parameters` (object)
    The parameters of the response action. Content different depending on the response action command
  - `startedAt` (string)
    The response action start time
  - `status` (string)
    The response action status
  - `wasCanceled` (boolean)
    Whether the response action was canceled
  - `wasSuccessful` (boolean)
    Whether the response action was successful
- **RunningProcesses** (`command: running-processes`)
  - `agents` ([] string)
    The agent IDs for the hosts that the response action was sent to
  - `agentState` (map string to object)
    The state of the response action for each agent ID that it was sent to
    Map values (object)
    - `completedAt` (string)
      The date and time the response action was completed for the agent ID
    - `isCompleted` (boolean)
      Whether the response action is completed for the agent ID
    - `wasCanceled` (boolean)
      Whether the response action was canceled for the agent ID
    - `wasSuccessful` (boolean)
      Whether the response action was successful for the agent ID
  - `agentType` (enum)
    List of agent types to retrieve. Defaults to `endpoint`.
    Values: `endpoint`, `sentinel_one`, `crowdstrike`, `microsoft_defender_endpoint`
  - `command` (enum  · min: 1)
    The command for the response action
    Values: `isolate`, `unisolate`, `kill-process`, `suspend-process`, `running-processes`, `get-file`, `execute`, `upload`, `scan`, `runscript`, `cancel`, `memory-dump`
  - `completedAt` (string)
    The response action completion time
  - `createdBy` (string)
    The user who created the response action
  - `hosts` (map string to object)
    An object containing the host names associated with the agent IDs the response action was sent to
    Map values (object)
    - `name` (string)
      The host name
  - `id` (string)
    The response action ID
  - `isComplete` (boolean)
    Whether the response action is complete
  - `isExpired` (boolean)
    Whether the response action is expired
  - `outputs` (map string to object)
    The outputs of the response action for each agent ID that it was sent to. Content different depending on the
response action command and will only be present for agents that have responded to the response action
    Map values (object)
    - `content` (string | object)
      The response action output content for the agent ID. Exact format depends on the response action command.
    - `type` (enum)
      Values: `json`, `text`
  - `parameters` (object)
    The parameters of the response action. Content different depending on the response action command
  - `startedAt` (string)
    The response action start time
  - `status` (string)
    The response action status
  - `wasCanceled` (boolean)
    Whether the response action was canceled
  - `wasSuccessful` (boolean)
    Whether the response action was successful
- **MemoryDump** (`command: memory-dump`)
  - `agents` ([] string)
    The agent IDs for the hosts that the response action was sent to
  - `agentState` (map string to object)
    The state of the response action for each agent ID that it was sent to
    Map values (object)
    - `completedAt` (string)
      The date and time the response action was completed for the agent ID
    - `isCompleted` (boolean)
      Whether the response action is completed for the agent ID
    - `wasCanceled` (boolean)
      Whether the response action was canceled for the agent ID
    - `wasSuccessful` (boolean)
      Whether the response action was successful for the agent ID
  - `agentType` (enum)
    List of agent types to retrieve. Defaults to `endpoint`.
    Values: `endpoint`, `sentinel_one`, `crowdstrike`, `microsoft_defender_endpoint`
  - `command` (enum  · min: 1)
    The command for the response action
    Values: `isolate`, `unisolate`, `kill-process`, `suspend-process`, `running-processes`, `get-file`, `execute`, `upload`, `scan`, `runscript`, `cancel`, `memory-dump`
  - `completedAt` (string)
    The response action completion time
  - `createdBy` (string)
    The user who created the response action
  - `hosts` (map string to object)
    An object containing the host names associated with the agent IDs the response action was sent to
    Map values (object)
    - `name` (string)
      The host name
  - `id` (string)
    The response action ID
  - `isComplete` (boolean)
    Whether the response action is complete
  - `isExpired` (boolean)
    Whether the response action is expired
  - `outputs` (map string to object)
    The outputs of the response action for each agent ID that it was sent to. Content different depending on the
response action command and will only be present for agents that have responded to the response action
    Map values (object)
    - `content` (string | object)
      The response action output content for the agent ID. Exact format depends on the response action command.
    - `type` (enum)
      Values: `json`, `text`
  - `parameters` (object)
    The parameters of the response action. Content different depending on the response action command
  - `startedAt` (string)
    The response action start time
  - `status` (string)
    The response action status
  - `wasCanceled` (boolean)
    Whether the response action was canceled
  - `wasSuccessful` (boolean)
    Whether the response action was successful
## Code Examples

#### Console

```console
GET /api/endpoint/action/{action_id}
```

#### curl

```curl
curl -X GET "https://{kibana_url}/api/endpoint/action/{action_id}"
```

## Response Examples

#### Details of an isolate response action

```json
{
  "data": {
    "agents": [
      "ed518850-681a-4d60-bb98-e22640cae2a8"
    ],
    "agentType": "endpoint",
    "command": "isolate",
    "completedAt": "2022-08-08T10:41:57.352Z",
    "createdBy": "elastic",
    "id": "233db9ea-6733-4849-9226-5a7039c7161d",
    "isCompleted": true,
    "isExpired": false,
    "startedAt": "2022-08-08T15:23:37.359Z",
    "wasSuccessful": true
  }
}
```