Download a file

View as Markdown
GET /api/endpoint/action/{action_id}/file/{file_id}/download
Api key auth Basic auth

Spaces method and path for this operation:

get /s/{space_id}/api/endpoint/action/{action_id}/file/{file_id}/download

Refer to Spaces for more information.

Download a file associated with a response action.

Path parameters

  • action_id string Required
  • file_id string Required

    The file identifier is constructed in one of two ways:

    • For Elastic Defend agents (agentType of endpoint): combine the action_id and agent_id values using a dot (.) separator: {file_id} = {action_id}.{agent_id}
    • For all other agent types: the file_id is the agent_id for which the response action was sent to.

Responses

  • 200 application/octet-stream

    OK
GET /api/endpoint/action/{action_id}/file/{file_id}/download 
curl \
 --request GET 'https://localhost:5601/api/endpoint/action/{action_id}/file/{file_id}/download' \
 --header "Authorization: $API_KEY"