---
title: "Terminate a process"
method: POST
path: "/api/endpoint/action/kill_process"
tags: ["Security Endpoint Management API"]
---

# Terminate a process

`POST /api/endpoint/action/kill_process`

**Spaces method and path for this operation:**

<div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/kill_process</span></div>

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Terminate a running process on an endpoint.

## Request body

- SecurityEndpointManagementAPIKillProcessRouteRequestBody
  - `agent_type` 'endpoint' | 'sentinel_one' | 'crowdstrike' | 'microsoft_defender_endpoint' — List of agent types to retrieve. Defaults to `endpoint`.
  - `alert_ids` string[] — If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.
  - `case_ids` string[] — The IDs of cases where the action taken will be logged. Max of 50.
  - `comment` string — Optional comment
  - `endpoint_ids` string[], required — List of endpoint IDs (cannot contain empty strings). Max of 250.
  - `parameters` union, required — Parameters object
    - object
      - `pid` integer — The process ID (PID) of the process to terminate.
    - object
      - `entity_id` string — The entity ID of the process to terminate.
    - object
      - `process_name` string — The name of the process to terminate. Valid for SentinelOne agent type only.

## Response `200`

Indicates a successful call.

- SecurityEndpointManagementAPIResponseActionCreateSuccessResponse
  - `data` SecurityEndpointManagementAPIResponseActionDetails
    - `agents` string[] — The agent IDs for the hosts that the response action was sent to
    - `agentState` object — The state of the response action for each agent ID that it was sent to
    - `agentType` 'endpoint' | 'sentinel_one' | 'crowdstrike' | 'microsoft_defender_endpoint' — List of agent types to retrieve. Defaults to `endpoint`.
    - `command` 'isolate' | 'unisolate' | 'kill-process' | 'suspend-process' | 'running-processes' | 'get-file' | 'execute' | 'upload' | 'scan' | 'runscript' | 'cancel' | 'memory-dump', required — The command for the response action
    - `completedAt` string, date-time — The response action completion time
    - `createdBy` string — The user who created the response action
    - `hosts` object — An object containing the host names associated with the agent IDs the response action was sent to
    - `id` string, uuid — The response action ID
    - `isComplete` boolean — Whether the response action is complete
    - `isExpired` boolean — Whether the response action is expired
    - `outputs` object — The outputs of the response action for each agent ID that it was sent to. Content different depending on the response action command and will only be present for agents that have responded to the response action
    - `parameters` object — The parameters of the response action. Content different depending on the response action command
    - `startedAt` string, date-time — The response action start time
    - `status` string — The response action status
    - `wasCanceled` boolean — Whether the response action was canceled
    - `wasSuccessful` boolean — Whether the response action was successful

---

[API](https://skmtc.net/elastic/apis/kibana-apis.md) · [All operations](https://skmtc.net/elastic/apis/kibana-apis/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/elastic/kibana-apis/versions/531c9e2a7d23/schema)