--- title: "Get action details" method: GET path: "/api/endpoint/action/{action_id}" tags: ["Security Endpoint Management API"] --- # Get action details `GET /api/endpoint/action/{action_id}` **Spaces method and path for this operation:**
get /s/{space_id}/api/endpoint/action/{action_id}
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information. Get the details of a response action using the action ID. ## Path parameters - `action_id` string, required ## Response `200` OK - union - SecurityEndpointManagementAPIKillProcess - `agents` string[] — The agent IDs for the hosts that the response action was sent to - `agentState` object — The state of the response action for each agent ID that it was sent to - `agentType` 'endpoint' | 'sentinel_one' | 'crowdstrike' | 'microsoft_defender_endpoint' — List of agent types to retrieve. Defaults to `endpoint`. - `command` 'isolate' | 'unisolate' | 'kill-process' | 'suspend-process' | 'running-processes' | 'get-file' | 'execute' | 'upload' | 'scan' | 'runscript' | 'cancel' | 'memory-dump', required — The command for the response action - `completedAt` string, date-time — The response action completion time - `createdBy` string — The user who created the response action - `hosts` object — An object containing the host names associated with the agent IDs the response action was sent to - `id` string, uuid — The response action ID - `isComplete` boolean — Whether the response action is complete - `isExpired` boolean — Whether the response action is expired - `outputs` object — The outputs of the response action for each agent ID that it was sent to. Content different depending on the response action command and will only be present for agents that have responded to the response action - `parameters` union - object — The parameters of the response action. Content different depending on the response action command - `pid` number — The process ID (PID) of the process to terminate. - object — The parameters of the response action. Content different depending on the response action command - `entity_id` string — The entity ID of the process to terminate. - object — The parameters of the response action. Content different depending on the response action command - `process_name` string — The name of the process to terminate. Valid for SentinelOne agent type only. - `startedAt` string, date-time — The response action start time - `status` string — The response action status - `wasCanceled` boolean — Whether the response action was canceled - `wasSuccessful` boolean — Whether the response action was successful - SecurityEndpointManagementAPIGetFile - `agents` string[] — The agent IDs for the hosts that the response action was sent to - `agentState` object — The state of the response action for each agent ID that it was sent to - `agentType` 'endpoint' | 'sentinel_one' | 'crowdstrike' | 'microsoft_defender_endpoint' — List of agent types to retrieve. Defaults to `endpoint`. - `command` 'isolate' | 'unisolate' | 'kill-process' | 'suspend-process' | 'running-processes' | 'get-file' | 'execute' | 'upload' | 'scan' | 'runscript' | 'cancel' | 'memory-dump', required — The command for the response action - `completedAt` string, date-time — The response action completion time - `createdBy` string — The user who created the response action - `hosts` object — An object containing the host names associated with the agent IDs the response action was sent to - `id` string, uuid — The response action ID - `isComplete` boolean — Whether the response action is complete - `isExpired` boolean — Whether the response action is expired - `outputs` object — The outputs of the response action for each agent ID that it was sent to. Content different depending on the response action command and will only be present for agents that have responded to the response action - `parameters` object — The parameters of the response action. Content different depending on the response action command - `path` string - `startedAt` string, date-time — The response action start time - `status` string — The response action status - `wasCanceled` boolean — Whether the response action was canceled - `wasSuccessful` boolean — Whether the response action was successful - SecurityEndpointManagementAPIExecute - `agents` string[] — The agent IDs for the hosts that the response action was sent to - `agentState` object — The state of the response action for each agent ID that it was sent to - `agentType` 'endpoint' | 'sentinel_one' | 'crowdstrike' | 'microsoft_defender_endpoint' — List of agent types to retrieve. Defaults to `endpoint`. - `command` 'isolate' | 'unisolate' | 'kill-process' | 'suspend-process' | 'running-processes' | 'get-file' | 'execute' | 'upload' | 'scan' | 'runscript' | 'cancel' | 'memory-dump', required — The command for the response action - `completedAt` string, date-time — The response action completion time - `createdBy` string — The user who created the response action - `hosts` object — An object containing the host names associated with the agent IDs the response action was sent to - `id` string, uuid — The response action ID - `isComplete` boolean — Whether the response action is complete - `isExpired` boolean — Whether the response action is expired - `outputs` object — The outputs of the response action for each agent ID that it was sent to. Content different depending on the response action command and will only be present for agents that have responded to the response action - `parameters` object — The parameters of the response action. Content different depending on the response action command - `command` string - `timeout` number - `startedAt` string, date-time — The response action start time - `status` string — The response action status - `wasCanceled` boolean — Whether the response action was canceled - `wasSuccessful` boolean — Whether the response action was successful - SecurityEndpointManagementAPIRunscript - `agents` string[] — The agent IDs for the hosts that the response action was sent to - `agentState` object — The state of the response action for each agent ID that it was sent to - `agentType` 'endpoint' | 'sentinel_one' | 'crowdstrike' | 'microsoft_defender_endpoint' — List of agent types to retrieve. Defaults to `endpoint`. - `command` 'isolate' | 'unisolate' | 'kill-process' | 'suspend-process' | 'running-processes' | 'get-file' | 'execute' | 'upload' | 'scan' | 'runscript' | 'cancel' | 'memory-dump', required — The command for the response action - `completedAt` string, date-time — The response action completion time - `createdBy` string — The user who created the response action - `hosts` object — An object containing the host names associated with the agent IDs the response action was sent to - `id` string, uuid — The response action ID - `isComplete` boolean — Whether the response action is complete - `isExpired` boolean — Whether the response action is expired - `outputs` object — The outputs of the response action for each agent ID that it was sent to. Content different depending on the response action command and will only be present for agents that have responded to the response action - `parameters` union - object — The parameters of the response action. Content different depending on the response action command - `cloudFile` string - `commandLine` string - `hostPath` string - `raw` string - `timeout` number - object — The parameters of the response action. Content different depending on the response action command - `args` string - `scriptName` string - object — The parameters of the response action. Content different depending on the response action command - `scriptId` string - `scriptInput` string - `startedAt` string, date-time — The response action start time - `status` string — The response action status - `wasCanceled` boolean — Whether the response action was canceled - `wasSuccessful` boolean — Whether the response action was successful - SecurityEndpointManagementAPIUpload - `agents` string[] — The agent IDs for the hosts that the response action was sent to - `agentState` object — The state of the response action for each agent ID that it was sent to - `agentType` 'endpoint' | 'sentinel_one' | 'crowdstrike' | 'microsoft_defender_endpoint' — List of agent types to retrieve. Defaults to `endpoint`. - `command` 'isolate' | 'unisolate' | 'kill-process' | 'suspend-process' | 'running-processes' | 'get-file' | 'execute' | 'upload' | 'scan' | 'runscript' | 'cancel' | 'memory-dump', required — The command for the response action - `completedAt` string, date-time — The response action completion time - `createdBy` string — The user who created the response action - `hosts` object — An object containing the host names associated with the agent IDs the response action was sent to - `id` string, uuid — The response action ID - `isComplete` boolean — Whether the response action is complete - `isExpired` boolean — Whether the response action is expired - `outputs` object — The outputs of the response action for each agent ID that it was sent to. Content different depending on the response action command and will only be present for agents that have responded to the response action - `parameters` object — The parameters for upload returned on the details are derived via the API from the file that was uploaded at the time that the response action was submitted - `file_id` string - `file_name` string - `file_sha256` string - `file_size` number - `startedAt` string, date-time — The response action start time - `status` string — The response action status - `wasCanceled` boolean — Whether the response action was canceled - `wasSuccessful` boolean — Whether the response action was successful - SecurityEndpointManagementAPIScan - `agents` string[] — The agent IDs for the hosts that the response action was sent to - `agentState` object — The state of the response action for each agent ID that it was sent to - `agentType` 'endpoint' | 'sentinel_one' | 'crowdstrike' | 'microsoft_defender_endpoint' — List of agent types to retrieve. Defaults to `endpoint`. - `command` 'isolate' | 'unisolate' | 'kill-process' | 'suspend-process' | 'running-processes' | 'get-file' | 'execute' | 'upload' | 'scan' | 'runscript' | 'cancel' | 'memory-dump', required — The command for the response action - `completedAt` string, date-time — The response action completion time - `createdBy` string — The user who created the response action - `hosts` object — An object containing the host names associated with the agent IDs the response action was sent to - `id` string, uuid — The response action ID - `isComplete` boolean — Whether the response action is complete - `isExpired` boolean — Whether the response action is expired - `outputs` object — The outputs of the response action for each agent ID that it was sent to. Content different depending on the response action command and will only be present for agents that have responded to the response action - `parameters` object — The parameters of the response action. Content different depending on the response action command - `path` string - `startedAt` string, date-time — The response action start time - `status` string — The response action status - `wasCanceled` boolean — Whether the response action was canceled - `wasSuccessful` boolean — Whether the response action was successful - SecurityEndpointManagementAPICancel - `agents` string[] — The agent IDs for the hosts that the response action was sent to - `agentState` object — The state of the response action for each agent ID that it was sent to - `agentType` 'endpoint' | 'sentinel_one' | 'crowdstrike' | 'microsoft_defender_endpoint' — List of agent types to retrieve. Defaults to `endpoint`. - `command` 'isolate' | 'unisolate' | 'kill-process' | 'suspend-process' | 'running-processes' | 'get-file' | 'execute' | 'upload' | 'scan' | 'runscript' | 'cancel' | 'memory-dump', required — The command for the response action - `completedAt` string, date-time — The response action completion time - `createdBy` string — The user who created the response action - `hosts` object — An object containing the host names associated with the agent IDs the response action was sent to - `id` string, uuid — The response action ID - `isComplete` boolean — Whether the response action is complete - `isExpired` boolean — Whether the response action is expired - `outputs` object — The outputs of the response action for each agent ID that it was sent to. Content different depending on the response action command and will only be present for agents that have responded to the response action - `parameters` object — The parameters of the response action. Content different depending on the response action command - `id` string, uuid - `startedAt` string, date-time — The response action start time - `status` string — The response action status - `wasCanceled` boolean — Whether the response action was canceled - `wasSuccessful` boolean — Whether the response action was successful - SecurityEndpointManagementAPIIsolate — Details of an isolate action response. - `agents` string[] — The agent IDs for the hosts that the response action was sent to - `agentState` object — The state of the response action for each agent ID that it was sent to - `agentType` 'endpoint' | 'sentinel_one' | 'crowdstrike' | 'microsoft_defender_endpoint' — List of agent types to retrieve. Defaults to `endpoint`. - `command` 'isolate' | 'unisolate' | 'kill-process' | 'suspend-process' | 'running-processes' | 'get-file' | 'execute' | 'upload' | 'scan' | 'runscript' | 'cancel' | 'memory-dump', required — The command for the response action - `completedAt` string, date-time — The response action completion time - `createdBy` string — The user who created the response action - `hosts` object — An object containing the host names associated with the agent IDs the response action was sent to - `id` string, uuid — The response action ID - `isComplete` boolean — Whether the response action is complete - `isExpired` boolean — Whether the response action is expired - `outputs` object — The outputs of the response action for each agent ID that it was sent to. Content different depending on the response action command and will only be present for agents that have responded to the response action - `parameters` object — The parameters of the response action. Content different depending on the response action command - `startedAt` string, date-time — The response action start time - `status` string — The response action status - `wasCanceled` boolean — Whether the response action was canceled - `wasSuccessful` boolean — Whether the response action was successful - SecurityEndpointManagementAPIUnisolate — Details of an unisolate action response. - `agents` string[] — The agent IDs for the hosts that the response action was sent to - `agentState` object — The state of the response action for each agent ID that it was sent to - `agentType` 'endpoint' | 'sentinel_one' | 'crowdstrike' | 'microsoft_defender_endpoint' — List of agent types to retrieve. Defaults to `endpoint`. - `command` 'isolate' | 'unisolate' | 'kill-process' | 'suspend-process' | 'running-processes' | 'get-file' | 'execute' | 'upload' | 'scan' | 'runscript' | 'cancel' | 'memory-dump', required — The command for the response action - `completedAt` string, date-time — The response action completion time - `createdBy` string — The user who created the response action - `hosts` object — An object containing the host names associated with the agent IDs the response action was sent to - `id` string, uuid — The response action ID - `isComplete` boolean — Whether the response action is complete - `isExpired` boolean — Whether the response action is expired - `outputs` object — The outputs of the response action for each agent ID that it was sent to. Content different depending on the response action command and will only be present for agents that have responded to the response action - `parameters` object — The parameters of the response action. Content different depending on the response action command - `startedAt` string, date-time — The response action start time - `status` string — The response action status - `wasCanceled` boolean — Whether the response action was canceled - `wasSuccessful` boolean — Whether the response action was successful - SecurityEndpointManagementAPISuspendProcess - `agents` string[] — The agent IDs for the hosts that the response action was sent to - `agentState` object — The state of the response action for each agent ID that it was sent to - `agentType` 'endpoint' | 'sentinel_one' | 'crowdstrike' | 'microsoft_defender_endpoint' — List of agent types to retrieve. Defaults to `endpoint`. - `command` 'isolate' | 'unisolate' | 'kill-process' | 'suspend-process' | 'running-processes' | 'get-file' | 'execute' | 'upload' | 'scan' | 'runscript' | 'cancel' | 'memory-dump', required — The command for the response action - `completedAt` string, date-time — The response action completion time - `createdBy` string — The user who created the response action - `hosts` object — An object containing the host names associated with the agent IDs the response action was sent to - `id` string, uuid — The response action ID - `isComplete` boolean — Whether the response action is complete - `isExpired` boolean — Whether the response action is expired - `outputs` object — The outputs of the response action for each agent ID that it was sent to. Content different depending on the response action command and will only be present for agents that have responded to the response action - `parameters` union - object — The parameters of the response action. Content different depending on the response action command - `pid` number — The process ID (PID) of the process to terminate. - object — The parameters of the response action. Content different depending on the response action command - `entity_id` string — The entity ID of the process to terminate. - `startedAt` string, date-time — The response action start time - `status` string — The response action status - `wasCanceled` boolean — Whether the response action was canceled - `wasSuccessful` boolean — Whether the response action was successful - SecurityEndpointManagementAPIRunningProcesses - `agents` string[] — The agent IDs for the hosts that the response action was sent to - `agentState` object — The state of the response action for each agent ID that it was sent to - `agentType` 'endpoint' | 'sentinel_one' | 'crowdstrike' | 'microsoft_defender_endpoint' — List of agent types to retrieve. Defaults to `endpoint`. - `command` 'isolate' | 'unisolate' | 'kill-process' | 'suspend-process' | 'running-processes' | 'get-file' | 'execute' | 'upload' | 'scan' | 'runscript' | 'cancel' | 'memory-dump', required — The command for the response action - `completedAt` string, date-time — The response action completion time - `createdBy` string — The user who created the response action - `hosts` object — An object containing the host names associated with the agent IDs the response action was sent to - `id` string, uuid — The response action ID - `isComplete` boolean — Whether the response action is complete - `isExpired` boolean — Whether the response action is expired - `outputs` object — The outputs of the response action for each agent ID that it was sent to. Content different depending on the response action command and will only be present for agents that have responded to the response action - `parameters` object — The parameters of the response action. Content different depending on the response action command - `startedAt` string, date-time — The response action start time - `status` string — The response action status - `wasCanceled` boolean — Whether the response action was canceled - `wasSuccessful` boolean — Whether the response action was successful - SecurityEndpointManagementAPIMemoryDump - `agents` string[] — The agent IDs for the hosts that the response action was sent to - `agentState` object — The state of the response action for each agent ID that it was sent to - `agentType` 'endpoint' | 'sentinel_one' | 'crowdstrike' | 'microsoft_defender_endpoint' — List of agent types to retrieve. Defaults to `endpoint`. - `command` 'isolate' | 'unisolate' | 'kill-process' | 'suspend-process' | 'running-processes' | 'get-file' | 'execute' | 'upload' | 'scan' | 'runscript' | 'cancel' | 'memory-dump', required — The command for the response action - `completedAt` string, date-time — The response action completion time - `createdBy` string — The user who created the response action - `hosts` object — An object containing the host names associated with the agent IDs the response action was sent to - `id` string, uuid — The response action ID - `isComplete` boolean — Whether the response action is complete - `isExpired` boolean — Whether the response action is expired - `outputs` object — The outputs of the response action for each agent ID that it was sent to. Content different depending on the response action command and will only be present for agents that have responded to the response action - `parameters` union, required - object — The parameters of the response action. Content different depending on the response action command - `type` 'kernel', required — Kernel-level memory dump - object — The parameters of the response action. Content different depending on the response action command - `pid` number, required — The process ID (PID) - `type` 'process', required — Process-level memory dump using a process ID - object — The parameters of the response action. Content different depending on the response action command - `entity_id` string, required — The process entity ID - `type` 'process', required — Process-level memory dump using an entity ID - `startedAt` string, date-time — The response action start time - `status` string — The response action status - `wasCanceled` boolean — Whether the response action was canceled - `wasSuccessful` boolean — Whether the response action was successful --- [API](https://skmtc.net/elastic/apis/kibana-apis.md) · [All operations](https://skmtc.net/elastic/apis/kibana-apis/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/elastic/kibana-apis/versions/531c9e2a7d23/schema)