Get file information

Base URL: https://{kibana_url}

GET /api/endpoint/action/{action_id}/file/{file_id}
GET /s/{space_id}/api/endpoint/action/{action_id}/file/{file_id}

Auth

Get information for the specified response action file download.

Path parameters

space_id string optional: An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.
action_id string · min length: 1 · max length: 256 required: The ID of the response action that generated the file.
file_id string · min length: 1 · max length: 256 required: The file identifier is constructed in one of two ways:

For Elastic Defend agents (agentType of endpoint): combine the action_id and agent_id values using a dot (.) separator: {file_id} = {action_id}.{agent_id}

For all other agent types: the file_id is the agent_id for which the response action was sent to.

Response

Indicates a successful call.

application/json

data object

View as Markdown

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

GET kbn:/api/endpoint/action/ACTION_ID/file/FILE_ID

Generated from the API spec

curl Shell

curl -X GET "${KIBANA_URL}/api/endpoint/action/${ACTION_ID}/file/${FILE_ID}" \
  -H "Authorization: ApiKey ${API_KEY}"

Generated from the API spec

Response

{
  "data": {
    "actionId": "233db9ea-6733-4849-9226-5a7039c7161d",
    "agentId": "ed518850-681a-4d60-bb98-e22640cae2a8",
    "agentType": "endpoint",
    "created": "2025-02-26T13:37:30.452Z",
    "id": "233db9ea-6733-4849-9226-5a7039c7161d.ed518850-681a-4d60-bb98-e22640cae2a8",
    "mimeType": "application/zip",
    "name": "memory_dump.zip",
    "size": 1048576,
    "status": "READY"
  }
}