---
type: api
title: Download a file
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v9/operation/operation-endpointfiledownload
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v9/operation/operation-endpointfiledownload
products:
  - Kibana
---

# Download a file

- Server: `https://{kibana_url}`

## Paths

- `GET` `/api/endpoint/action/{action_id}/file/{file_id}/download`
- `GET` `/s/{space_id}/api/endpoint/action/{action_id}/file/{file_id}/download`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v9/authentication#apikeyauth)
- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v9/authentication#basicauth)

#### Path Parameters

- `action_id` (string)
  The ID of the response action that generated the file.
- `file_id` (string)
  The file identifier is constructed in one of two ways:
- For Elastic Defend agents (`agentType` of `endpoint`): combine the `action_id` and `agent_id` values using a dot (`.`) separator:
`{file_id}` = `{action_id}.{agent_id}`
- For all other agent types: the `file_id` is the `agent_id` for which the response action was sent to.

## Description

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Download a file associated with a response action. Files are downloaded in a password-protected `.zip` archive to prevent the file from running. Use password `elastic` to open the `.zip` in a safe environment.
> info
> Files retrieved from third-party-protected hosts require a different password. Refer to [Third-party response actions](https://www.elastic.co/docs/solutions/security/endpoint-response-actions/third-party-response-actions) for your system's password.

## Response

Indicates a successful call.

`application/octet-stream`

Type: `string`

## Code Examples

#### Console

```console
GET /api/endpoint/action/{action_id}/file/{file_id}/download
```

#### curl

```curl
curl -X GET "https://{kibana_url}/api/endpoint/action/{action_id}/file/{file_id}/download"
```

## Response Examples

#### Password-protected ZIP archive containing the response action file

```json
binary file content (password-protected .zip)
```