---
type: api
title: Get response actions
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4493/api/doc/kibana/v9/operation/operation-endpointgetactionslist
resource: https://www.elastic.co/elastic/docs-builder/docs/4493/api/doc/kibana/v9/operation/operation-endpointgetactionslist
products:
  - Kibana
---

# Get response actions

- Server: `https://{kibana_url}`

## Paths

- `GET` `/api/endpoint/action`
- `GET` `/s/{space_id}/api/endpoint/action`

## Description

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Get a list of all response actions.

## Authentication

- Api key: `Authorization: <value>`
  These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: `Authorization: ApiKey base64AccessApiKey`
- Basic: `Authorization: Basic <credentials>`

## Query string parameters

- `page` (integer · min: 1 · default: 1) — optional
  The page number to return.
- `pageSize` (integer · min: 1 · max: 100 · default: 10) — optional
  The number of response actions to return per page.
- `commands` (enum[] · max items: 50) — optional
  A list of response action command names to filter by.
  Values: `isolate`, `unisolate`, `kill-process`, `suspend-process`, `running-processes`, `get-file`, `execute`, `upload`, `scan`, `runscript`, `cancel`, `memory-dump`
- `agentIds` (union oneOf · min length: 1) — optional
  A list of Elastic Agent IDs to filter the response actions by.
  Example: `["agent-id-1","agent-id-2"]`
  One of: `string[]` or `string`
- `userIds` (union oneOf) — optional
  A list of user IDs that submitted the response actions.
  Example: `["user-id-1","user-id-2"]`
  One of: `string[]` or `string`
- `startDate` (string) — optional
  A start date in ISO 8601 format or Date Math format (for example, `now-24h`).
  Example: `2023-10-31T00:00:00.000Z`
- `endDate` (string) — optional
  An end date in ISO 8601 format or Date Math format (for example, `now`).
  Example: `2023-10-31T23:59:59.999Z`
- `agentTypes` (enum) — optional
  The agent type to filter response actions by. Defaults to `endpoint`.
  Values: `endpoint`, `sentinel_one`, `crowdstrike`, `microsoft_defender_endpoint`
- `withOutputs` (union oneOf) — optional
  A list of response action IDs whose outputs should be included in the response.
  Example: `["action-id-1","action-id-2"]`
  One of: `string[]` or `string`
- `types` (enum[] · min length: 1 · max length: 2) — optional
  A list of response action types to filter by (`automated`, `manual`).
  Values: `automated`, `manual`

## Response

Indicates a successful call.

`application/json`

- `agentTypes` (string[])
  The list of agent types the query was filtered by.
- `commands` (string[])
  The list of commands the query was filtered by.
- `data` (object[])
  The list of response actions.
  - `agents` (string[] · format: uuid)
    The agent IDs for the hosts that the response action was sent to
  - `agentState` (map string to object)
    The state of the response action for each agent ID that it was sent to
    Map values (object · format: uuid)
    - `completedAt` (string)
      The date and time the response action was completed for the agent ID
    - `isCompleted` (boolean)
      Whether the response action is completed for the agent ID
    - `wasCanceled` (boolean)
      Whether the response action was canceled for the agent ID
    - `wasSuccessful` (boolean)
      Whether the response action was successful for the agent ID
  - `agentType` (enum)
    List of agent types to retrieve. Defaults to `endpoint`.
    Values: `endpoint`, `sentinel_one`, `crowdstrike`, `microsoft_defender_endpoint`
  - `command` (enum · min length: 1)
    The command for the response action
    Values: `isolate`, `unisolate`, `kill-process`, `suspend-process`, `running-processes`, `get-file`, `execute`, `upload`, `scan`, `runscript`, `cancel`, `memory-dump`
  - `completedAt` (string · format: date-time)
    The response action completion time
  - `createdBy` (string)
    The user who created the response action
  - `hosts` (map string to object)
    An object containing the host names associated with the agent IDs the response action was sent to
    Map values (object · format: uuid)
    - `name` (string)
      The host name
  - `id` (string · format: uuid)
    The response action ID
  - `isComplete` (boolean)
    Whether the response action is complete
  - `isExpired` (boolean)
    Whether the response action is expired
  - `outputs` (map string to object)
    The outputs of the response action for each agent ID that it was sent to. Content different depending on the
response action command and will only be present for agents that have responded to the response action
    Map values (object · format: uuid)
    - `content` (string | object)
      The response action output content for the agent ID. Exact format depends on the response action command.
    - `type` (enum)
      Values: `json`, `text`
  - `parameters` (object)
    The parameters of the response action. Content different depending on the response action command
  - `startedAt` (string · format: date-time)
    The response action start time
  - `status` (string)
    The response action status
  - `wasCanceled` (boolean)
    Whether the response action was canceled
  - `wasSuccessful` (boolean)
    Whether the response action was successful
- `elasticAgentIds` (string[])
  The list of elastic agent IDs the query was filtered by.
- `endDate` (string)
  The end date filter applied to the query.
- `page` (integer)
  The current page number.
- `pageSize` (integer)
  The number of items per page.
- `startDate` (string)
  The start date filter applied to the query.
- `statuses` (string[])
  The list of statuses the query was filtered by.
- `total` (integer)
  The total number of response actions matching the query.
- `userIds` (string[])
  The list of user IDs the query was filtered by.
## Code examples

#### Console

```console
GET kbn:/api/endpoint/action
```

#### curl

```curl
curl -X GET "${KIBANA_URL}/api/endpoint/action" \
  -H "Authorization: ApiKey ${API_KEY}"
```

## Response examples

#### A list of response actions

```json
{
  "data": [
    {
      "agents": [
        "afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0"
      ],
      "agentType": "endpoint",
      "command": "running-processes",
      "completedAt": "2022-08-08T09:50:47.672Z",
      "createdBy": "elastic",
      "id": "b3d6de74-36b0-4fa8-be46-c375bf1771bf",
      "isCompleted": true,
      "isExpired": false,
      "startedAt": "2022-08-08T15:24:57.402Z",
      "wasSuccessful": true
    },
    {
      "agents": [
        "afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0"
      ],
      "agentType": "endpoint",
      "command": "isolate",
      "completedAt": "2022-08-08T10:41:57.352Z",
      "createdBy": "elastic",
      "id": "43b4098b-8752-4fbb-a7a7-6df7c74d0ee3",
      "isCompleted": true,
      "isExpired": false,
      "startedAt": "2022-08-08T15:23:37.359Z",
      "wasSuccessful": true
    }
  ],
  "elasticAgentIds": [
    "afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0"
  ],
  "endDate": "now",
  "page": 1,
  "pageSize": 10,
  "startDate": "now-24h/h",
  "total": 2
}
```