GET /api/endpoint/action/{action_id}/file/{file_id}
Api key auth

Spaces method and path for this operation:

get /s/{space_id}/api/endpoint/action/{action_id}/file/{file_id}

Refer to Spaces for more information.

Get information for the specified response action file download.

Path parameters

  • action_id string Required

    The ID of the response action that generated the file.

  • file_id string Required

    The file identifier is constructed in one of two ways:

    • For Elastic Defend agents (agentType of endpoint): combine the action_id and agent_id values using a dot (.) separator: {file_id} = {action_id}.{agent_id}
    • For all other agent types: the file_id is the agent_id for which the response action was sent to.

Responses

  • 200 application/json

    Indicates a successful call.

    Hide response attribute Show response attribute object
    • data object
      Hide data attributes Show data attributes object
      • actionId string

        The response action ID.

      • agentId string

        The agent ID that generated the file.

      • agentType string

        The type of agent that generated the file.

      • created string(date-time)

        The date and time the file was created.

      • id string

        The unique file identifier.

      • mimeType string

        The MIME type of the file.

      • name string

        The file name.

      • size number

        The file size in bytes.

      • status string

        The file upload status.

        Values are AWAITING_UPLOAD, UPLOADING, READY, UPLOAD_ERROR, or DELETED.
GET /api/endpoint/action/{action_id}/file/{file_id} 
curl \
 --request GET 'https://<KIBANA_URL>/api/endpoint/action/{action_id}/file/{file_id}' \
 --header "Authorization: $API_KEY"
Response examples (200) 
{
  "data": {
    "actionId": "233db9ea-6733-4849-9226-5a7039c7161d",
    "agentId": "ed518850-681a-4d60-bb98-e22640cae2a8",
    "agentType": "endpoint",
    "created": "2025-02-26T13:37:30.452Z",
    "id": "233db9ea-6733-4849-9226-5a7039c7161d.ed518850-681a-4d60-bb98-e22640cae2a8",
    "mimeType": "application/zip",
    "name": "memory_dump.zip",
    "size": 1048576,
    "status": "READY"
  }
}