---
type: api
title: Download a file
description: Download a file associated with a response action. Files are downloaded in a password-protected `.zip` archive to prevent the file from running. Use password `elastic` to open the `.zip` in a safe environment.
url: https://www.elastic.co/elastic/docs-builder/docs/4493/api/doc/kibana/v0/operation/operation-endpointfiledownload
resource: https://www.elastic.co/elastic/docs-builder/docs/4493/api/doc/kibana/v0/operation/operation-endpointfiledownload
products:
  - Kibana
---

# Download a file

- Server: `https://{kibana_url}`

## Paths

- `GET` `/api/endpoint/action/{action_id}/file/{file_id}/download`

#### Path parameters

- `action_id` (string · min length: 1 · max length: 256) — required
  The ID of the response action that generated the file.
- `file_id` (string · min length: 1 · max length: 256) — required
  The file identifier is constructed in one of two ways:
- For Elastic Defend agents (`agentType` of `endpoint`): combine the `action_id` and `agent_id` values using a dot (`.`) separator:
`{file_id}` = `{action_id}.{agent_id}`
- For all other agent types: the `file_id` is the `agent_id` for which the response action was sent to.

## Description

Download a file associated with a response action. Files are downloaded in a password-protected `.zip` archive to prevent the file from running. Use password `elastic` to open the `.zip` in a safe environment.
> info
> Files retrieved from third-party-protected hosts require a different password. Refer to [Third-party response actions](https://www.elastic.co/docs/solutions/security/endpoint-response-actions/third-party-response-actions) for your system's password.

## Authentication

- Api key: `Authorization: <value>`
  These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: `Authorization: ApiKey base64AccessApiKey`
- Basic: `Authorization: Basic <credentials>`

## Response

Indicates a successful call.

`application/octet-stream`

Type: `string · format: binary`

## Code examples

#### Console

```console
GET kbn:/api/endpoint/action/ACTION_ID/file/FILE_ID/download
```

#### curl

```curl
curl -X GET "${KIBANA_URL}/api/endpoint/action/${ACTION_ID}/file/${FILE_ID}/download" \
  -H "Authorization: ApiKey ${API_KEY}"
```

## Response examples

#### Password-protected ZIP archive containing the response action file

```json
binary file content (password-protected .zip)
```