---
type: api
title: Get response actions
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4641/api/doc/kibana/v8/operation/operation-endpointgetactionslist
resource: https://www.elastic.co/elastic/docs-builder/docs/4641/api/doc/kibana/v8/operation/operation-endpointgetactionslist
products:
  - Kibana
---

# Get response actions

Authentication: required

- Server: `https://{kibana_url}`

## Paths

- `GET` `/api/endpoint/action`
- `GET` `/s/{space_id}/api/endpoint/action`

#### Path parameters

- `space_id` (string) — optional
  An identifier for the space. If `space_id` is not provided in the URL, the default space is used. Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

## Description

Get a list of all response actions.

## Query string parameters

- `page` (integer · min: 1 · default: 1) — optional
- `pageSize` (integer · min: 1 · max: 100 · default: 10) — optional
- `commands` (enum[]) — optional
  Values: `isolate`, `unisolate`, `kill-process`, `suspend-process`, `running-processes`, `get-file`, `execute`, `upload`, `scan`
- `agentIds` (union string[] | string · min length: 1) — optional
  Example: `["agent-id-1","agent-id-2"]`
- `userIds` (union string[] | string) — optional
  Example: `["user-id-1","user-id-2"]`
- `startDate` (string) — optional
  Example: `2023-10-31T00:00:00.000Z`
- `endDate` (string) — optional
  Example: `2023-10-31T23:59:59.999Z`
- `agentTypes` (enum) — optional
  Values: `endpoint`, `sentinel_one`, `crowdstrike`, `microsoft_defender_endpoint`
- `withOutputs` (union string[] | string) — optional
  Example: `["action-id-1","action-id-2"]`
- `types` (enum[] · min length: 1 · max length: 2) — optional
  Values: `automated`, `manual`

## Response

OK

`application/json`

Type: `object`

## Code examples

#### Console

```console
GET kbn:/api/endpoint/action
```

#### curl

```curl
curl -X GET "${KIBANA_URL}/api/endpoint/action" \
  -H "Authorization: ApiKey ${API_KEY}"
```

## Response examples

#### 200

`application/json`

Generated from the API spec. Values are representative. Unions use the first variant; deeply nested or large bodies may omit fields.

```json
{
  "data": [
    {
      "agents": [
        "afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0"
      ],
      "agentType": "endpoint",
      "command": "running-processes",
      "completedAt": "2022-08-08T09:50:47.672Z",
      "createdBy": "elastic",
      "id": "b3d6de74-36b0-4fa8-be46-c375bf1771bf",
      "isCompleted": true,
      "isExpired": false,
      "startedAt": "2022-08-08T15:24:57.402Z",
      "wasSuccessful": true
    },
    {
      "agents": [
        "afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0"
      ],
      "agentType": "endpoint",
      "command": "isolate",
      "completedAt": "2022-08-08T10:41:57.352Z",
      "createdBy": "elastic",
      "id": "43b4098b-8752-4fbb-a7a7-6df7c74d0ee3",
      "isCompleted": true,
      "isExpired": false,
      "startedAt": "2022-08-08T15:23:37.359Z",
      "wasSuccessful": true
    },
    {
      "agents": [
        "afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0"
      ],
      "agentType": "endpoint",
      "command": "kill-process",
      "comment": "bad process - taking up too much cpu",
      "completedAt": "2022-08-08T09:44:50.952Z",
      "createdBy": "elastic",
      "id": "5bc92c86-b8e6-42dd-837f-12ad29e09caa",
      "isCompleted": true,
      "isExpired": false,
      "startedAt": "2022-08-08T14:38:44.125Z",
      "wasSuccessful": true
    },
    {
      "agents": [
        "afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0"
      ],
      "agentType": "endpoint",
      "command": "unisolate",
      "comment": "Not a threat to the network",
      "completedAt": "2022-08-08T09:40:47.398Z",
      "createdBy": "elastic",
      "id": "790d54e0-3aa3-4e5b-8255-3ce9d851246a",
      "isCompleted": true,
      "isExpired": false,
      "startedAt": "2022-08-08T14:38:15.391Z",
      "wasSuccessful": true
    }
  ],
  "elasticAgentIds": [
    "afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0"
  ],
  "endDate": "now",
  "page": 1,
  "pageSize": 10,
  "startDate": "now-24h/h",
  "total": 4
}
```