---
title: "Download a file"
method: GET
path: "/api/endpoint/action/{action_id}/file/{file_id}/download"
tags: ["Security Endpoint Management API"]
---

# Download a file

`GET /api/endpoint/action/{action_id}/file/{file_id}/download`

## Request

- Base URL: `https://localhost:5601`
- URL: `https://localhost:5601/api/endpoint/action/{action_id}/file/{file_id}/download`
- Auth: one of:
  - API key in header `Authorization`
  - HTTP basic

**Spaces method and path for this operation:**

<div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/{action_id}/file/{file_id}/download</span></div>

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Download a file associated with a response action. Files are downloaded in a password-protected `.zip` archive to prevent the file from running. Use password `elastic` to open the `.zip` in a safe environment.
> info
> Files retrieved from third-party-protected hosts require a different password. Refer to [Third-party response actions](https://www.elastic.co/docs/solutions/security/endpoint-response-actions/third-party-response-actions) for your system's password.

## Path parameters

- `action_id` string, required
- `file_id` string, required

## Response `200`

Indicates a successful call.

## Changes

> 266 revisions in range; 110 not diffed.

- **2026-07-21** `804740fca560`: 2 breaking, 2 warning
  - for the `path` request parameter `action_id`, the minLength was increased from `0` to `1`
  - for the `path` request parameter `file_id`, the minLength was increased from `0` to `1`
  - for the `path` request parameter `action_id`, the maxLength was set to `256`
  - for the `path` request parameter `file_id`, the maxLength was set to `256`

[Operation history](https://skmtc.dev/elastic/apis/kibana-apis/changes/api/endpoint/action/:action_id/file/:file_id/download/get.md)

---

[API](https://skmtc.dev/elastic/apis/kibana-apis.md) - [All operations](https://skmtc.dev/elastic/apis/kibana-apis/llms.txt) - [OpenAPI document](https://skmtc.dev/elastic/apis/kibana-apis/revisions/b87131d80c52?raw)