---
title: "Get response actions"
method: GET
path: "/api/endpoint/action"
tags: ["Security Endpoint Management API"]
---

# Get response actions

`GET /api/endpoint/action`

**Spaces method and path for this operation:**

<div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action</span></div>

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Get a list of all response actions.

## Query parameters

- `page` integer — Page number
- `pageSize` integer — Number of items per page
- `commands` SecurityEndpointManagementAPICommand[] — A list of response action command names.
- `agentIds` union — A list of agent IDs. Max of 250.
  - string[]
  - string
- `userIds` union — A list of user IDs. Max of 50.
  - string[]
  - string
- `startDate` string — A start date in ISO 8601 format or Date Math format.
- `endDate` string — An end date in ISO format or Date Math format.
- `agentTypes` 'endpoint' | 'sentinel_one' | 'crowdstrike' | 'microsoft_defender_endpoint' — List of agent types to retrieve. Defaults to `endpoint`.
- `withOutputs` union — A list of action IDs that should include the complete output of the action. Max of 50.
  - string[]
  - string
- `types` SecurityEndpointManagementAPIType[] — List of types of response actions

## Response `200`

Indicates a successful call.

- SecurityEndpointManagementAPIGetEndpointActionListResponse
  - `agentTypes` string[] — The list of agent types the query was filtered by.
  - `commands` string[] — The list of commands the query was filtered by.
  - `data` SecurityEndpointManagementAPIResponseActionDetails[] — The list of response actions.
    - `agents` string[] — The agent IDs for the hosts that the response action was sent to
    - `agentState` object — The state of the response action for each agent ID that it was sent to
    - `agentType` 'endpoint' | 'sentinel_one' | 'crowdstrike' | 'microsoft_defender_endpoint' — List of agent types to retrieve. Defaults to `endpoint`.
    - `command` 'isolate' | 'unisolate' | 'kill-process' | 'suspend-process' | 'running-processes' | 'get-file' | 'execute' | 'upload' | 'scan' | 'runscript' | 'cancel' | 'memory-dump', required — The command for the response action
    - `completedAt` string, date-time — The response action completion time
    - `createdBy` string — The user who created the response action
    - `hosts` object — An object containing the host names associated with the agent IDs the response action was sent to
    - `id` string, uuid — The response action ID
    - `isComplete` boolean — Whether the response action is complete
    - `isExpired` boolean — Whether the response action is expired
    - `outputs` object — The outputs of the response action for each agent ID that it was sent to. Content different depending on the response action command and will only be present for agents that have responded to the response action
    - `parameters` object — The parameters of the response action. Content different depending on the response action command
    - `startedAt` string, date-time — The response action start time
    - `status` string — The response action status
    - `wasCanceled` boolean — Whether the response action was canceled
    - `wasSuccessful` boolean — Whether the response action was successful
  - `elasticAgentIds` string[] — The list of elastic agent IDs the query was filtered by.
  - `endDate` string — The end date filter applied to the query.
  - `page` integer — The current page number.
  - `pageSize` integer — The number of items per page.
  - `startDate` string — The start date filter applied to the query.
  - `statuses` string[] — The list of statuses the query was filtered by.
  - `total` integer — The total number of response actions matching the query.
  - `userIds` string[] — The list of user IDs the query was filtered by.

---

[API](https://skmtc.net/elastic/apis/kibana-apis.md) · [All operations](https://skmtc.net/elastic/apis/kibana-apis/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/elastic/kibana-apis/versions/531c9e2a7d23/schema)