{
  "opencollection": "1.0.0",
  "info": {
    "name": "Kibana APIs Actions Security Endpoint Management API API",
    "version": "1.0"
  },
  "request": {
    "auth": {
      "type": "apikey",
      "key": "Authorization",
      "value": "{{Authorization}}",
      "placement": "header"
    }
  },
  "items": [
    {
      "info": {
        "name": "Security Endpoint Management API",
        "type": "folder"
      },
      "items": [
        {
          "info": {
            "name": "Get response actions",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://{kibana_url}/api/endpoint/action",
            "params": [
              {
                "name": "page",
                "value": "",
                "type": "query"
              },
              {
                "name": "pageSize",
                "value": "",
                "type": "query"
              },
              {
                "name": "commands",
                "value": "",
                "type": "query"
              },
              {
                "name": "agentIds",
                "value": "",
                "type": "query"
              },
              {
                "name": "userIds",
                "value": "",
                "type": "query"
              },
              {
                "name": "startDate",
                "value": "",
                "type": "query"
              },
              {
                "name": "endDate",
                "value": "",
                "type": "query"
              },
              {
                "name": "agentTypes",
                "value": "",
                "type": "query"
              },
              {
                "name": "withOutputs",
                "value": "",
                "type": "query"
              },
              {
                "name": "types",
                "value": "",
                "type": "query"
              }
            ]
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb get\">get</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/endpoint/action</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a list of all response actions."
        },
        {
          "info": {
            "name": "Get response actions status",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://{kibana_url}/api/endpoint/action_status",
            "params": [
              {
                "name": "agent_ids",
                "value": "",
                "type": "query",
                "description": "A list of agent IDs to get the action status for."
              }
            ]
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb get\">get</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/endpoint/action_status</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the status of response actions for the specified agent IDs."
        },
        {
          "info": {
            "name": "Get action details",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://{kibana_url}/api/endpoint/action/:action_id",
            "params": [
              {
                "name": "action_id",
                "value": "",
                "type": "path"
              }
            ]
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb get\">get</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/endpoint/action/{action_id}</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the details of a response action using the action ID."
        },
        {
          "info": {
            "name": "Get file information",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://{kibana_url}/api/endpoint/action/:action_id/file/:file_id",
            "params": [
              {
                "name": "action_id",
                "value": "",
                "type": "path",
                "description": "The ID of the response action that generated the file."
              },
              {
                "name": "file_id",
                "value": "",
                "type": "path",
                "description": "The file identifier is constructed in one of two ways:\n- For Elastic Defend agents (`agentType` of `endpoint`): combine the `action_id` and `agent_id` values using a dot (`.`) separator:\n`{file_id}` = `{action_id}.{agent_id}`\n- For all other agent types: the `file_id` is the `agent_id` for which the response action was sent to.\n"
              }
            ]
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb get\">get</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/endpoint/action/{action_id}/file/{file_id}</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet information for the specified response action file download.\n"
        },
        {
          "info": {
            "name": "Download a file",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://{kibana_url}/api/endpoint/action/:action_id/file/:file_id/download",
            "params": [
              {
                "name": "action_id",
                "value": "",
                "type": "path",
                "description": "The ID of the response action that generated the file."
              },
              {
                "name": "file_id",
                "value": "",
                "type": "path",
                "description": "The file identifier is constructed in one of two ways:\n- For Elastic Defend agents (`agentType` of `endpoint`): combine the `action_id` and `agent_id` values using a dot (`.`) separator:\n`{file_id}` = `{action_id}.{agent_id}`\n- For all other agent types: the `file_id` is the `agent_id` for which the response action was sent to.\n"
              }
            ]
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb get\">get</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/endpoint/action/{action_id}/file/{file_id}/download</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nDownload a file associated with a response action. Files are downloaded in a password-protected `.zip` archive to prevent the file from running. Use password `elastic` to open the `.zip` "
        },
        {
          "info": {
            "name": "Cancel a response action",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://{kibana_url}/api/endpoint/action/cancel",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb post\">post</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/endpoint/action/cancel</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCancel a running or pending response action (Applies only to some agent types)."
        },
        {
          "info": {
            "name": "Run a command",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://{kibana_url}/api/endpoint/action/execute",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb post\">post</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/endpoint/action/execute</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRun a shell command on an endpoint."
        },
        {
          "info": {
            "name": "Get a file",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://{kibana_url}/api/endpoint/action/get_file",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb post\">post</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/endpoint/action/get_file</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a file from an endpoint."
        },
        {
          "info": {
            "name": "Isolate an endpoint",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://{kibana_url}/api/endpoint/action/isolate",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb post\">post</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/endpoint/action/isolate</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nIsolate an endpoint from the network. The endpoint remains isolated until it's released."
        },
        {
          "info": {
            "name": "Terminate a process",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://{kibana_url}/api/endpoint/action/kill_process",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb post\">post</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/endpoint/action/kill_process</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nTerminate a running process on an endpoint."
        },
        {
          "info": {
            "name": "Generate a memory dump from the host machine",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://{kibana_url}/api/endpoint/action/memory_dump",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb post\">post</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/endpoint/action/memory_dump</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGenerates memory dumps on the targeted host."
        },
        {
          "info": {
            "name": "Get running processes",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://{kibana_url}/api/endpoint/action/running_procs",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb post\">post</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/endpoint/action/running_procs</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a list of all processes running on an endpoint."
        },
        {
          "info": {
            "name": "Run a script",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://{kibana_url}/api/endpoint/action/runscript",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb post\">post</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/endpoint/action/runscript</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRun a script on a host. Currently supported only for some agent types."
        },
        {
          "info": {
            "name": "Scan a file or directory",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://{kibana_url}/api/endpoint/action/scan",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb post\">post</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/endpoint/action/scan</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nScan a specific file or directory on an endpoint for malware."
        },
        {
          "info": {
            "name": "Get actions state",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://{kibana_url}/api/endpoint/action/state"
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb get\">get</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/endpoint/action/state</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a response actions state, which reports whether encryption is enabled."
        },
        {
          "info": {
            "name": "Suspend a process",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://{kibana_url}/api/endpoint/action/suspend_process",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb post\">post</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/endpoint/action/suspend_process</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nSuspend a running process on an endpoint."
        },
        {
          "info": {
            "name": "Release an isolated endpoint",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://{kibana_url}/api/endpoint/action/unisolate",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb post\">post</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/endpoint/action/unisolate</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nRelease an isolated endpoint, allowing it to rejoin a network."
        },
        {
          "info": {
            "name": "Upload a file",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://{kibana_url}/api/endpoint/action/upload",
            "body": {
              "type": "multipart-form",
              "data": []
            }
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb post\">post</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/endpoint/action/upload</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nUpload a file to an endpoint."
        },
        {
          "info": {
            "name": "Get a metadata list",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://{kibana_url}/api/endpoint/metadata",
            "params": [
              {
                "name": "page",
                "value": "",
                "type": "query"
              },
              {
                "name": "pageSize",
                "value": "",
                "type": "query"
              },
              {
                "name": "kuery",
                "value": "",
                "type": "query"
              },
              {
                "name": "hostStatuses",
                "value": "",
                "type": "query"
              },
              {
                "name": "sortField",
                "value": "",
                "type": "query"
              },
              {
                "name": "sortDirection",
                "value": "",
                "type": "query"
              }
            ]
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb get\">get</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/endpoint/metadata</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet a list of all endpoint host metadata."
        },
        {
          "info": {
            "name": "Get metadata",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://{kibana_url}/api/endpoint/metadata/:id",
            "params": [
              {
                "name": "id",
                "value": "",
                "type": "path",
                "description": "The agent ID of the endpoint."
              }
            ]
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb get\">get</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/endpoint/metadata/{id}</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet host metadata for a specific endpoint."
        },
        {
          "info": {
            "name": "Get a policy response",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://{kibana_url}/api/endpoint/policy_response",
            "params": [
              {
                "name": "agentId",
                "value": "",
                "type": "query",
                "description": "The agent ID to retrieve the policy response for."
              }
            ]
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb get\">get</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/endpoint/policy_response</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the most recent policy response for an endpoint."
        },
        {
          "info": {
            "name": "Get a protection updates note",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://{kibana_url}/api/endpoint/protection_updates_note/:package_policy_id",
            "params": [
              {
                "name": "package_policy_id",
                "value": "",
                "type": "path",
                "description": "The package policy ID to retrieve the protection updates note for."
              }
            ]
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb get\">get</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/endpoint/protection_updates_note/{package_policy_id}</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nGet the protection updates note for a package policy."
        },
        {
          "info": {
            "name": "Create or update a protection updates note",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://{kibana_url}/api/endpoint/protection_updates_note/:package_policy_id",
            "params": [
              {
                "name": "package_policy_id",
                "value": "",
                "type": "path",
                "description": "The package policy ID to create or update the protection updates note for."
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "**Spaces method and path for this operation:**\n\n<div><span class=\"operation-verb post\">post</span>&nbsp;<span class=\"operation-path\">/s/{space_id}/api/endpoint/protection_updates_note/{package_policy_id}</span></div>\n\nRefer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.\n\nCreate or update the protection updates note for a package policy."
        }
      ]
    }
  ],
  "bundled": true
}