---
title: "Retrieves a list of actions."
method: GET
path: "/v1/{accountId}/actions"
tags: ["Get Actions"]
---

# Retrieves a list of actions.

`GET /v1/{accountId}/actions`

## Request

- Base URL: `https://api.usa.cloud.watchguard.com/rest/threatsync/management`
- URL: `https://api.usa.cloud.watchguard.com/rest/threatsync/management/v1/{accountId}/actions`
- Auth: API key in header `WatchGuard-API-Key` and HTTP bearer
- TypeScript: <https://skmtc.dev/watchguard/apis/threatsync-management-api/docs/v1/:accountId/actions/get.ts> (a function with typed inputs; its response is checked against the schema)

Retrieves a list of actions.

## Path parameters

- `accountId` string, required

## Query parameters

- `query` string
- `sortBy` string
- `sortOrder` string
- `groupBy` string
- `fields` string
- `countOnly` boolean
- `limit` integer
- `startAfter` string
- `duration` string

## Response `200`

Successful response.

- FetchActions: Get actions for an incident.
  - `items` ActionWithIncidentIdPerformed[]: List of actions.
    - `id` string: ID of an action.
    - `account` string: Account ID.
    - `entityId` string: ID of the entity.
    - `entityType` string: The type of entity.
    - `parameters` object: Parameters required to perform the action. These depend on the specified action.
      - `address` string: The IP address to block.
    - `irreversible` boolean: Indicates whether the action is reversible.
    - `type` string: Identifies whether an action was performed manually or through an automation policy.
    - `responder` string: Indicates whether the action was initiated at the source, initiated manually, or initiated by an automation policy.
    - `creationTime` string: The time the action was created.
    - `command` string: The name of the action performed.
    - `lastUpdateTime` string: Last updated time of the action.
    - `initiatedBy` string: The name of the operator who initiated the action.
    - `incidentId` string: ID of an incident.
    - `errorMessage` string: Describes the reason the action failed.
    - `status` string: Status of the action.
    - `history` object[]: History of the action.
      - `errorMessage` string: Describes the reason the action failed.
      - `lastUpdateTime` string: Last updated time of the action.
      - `status` string: Status of the action.
    - `result` object: Result of the action.
      - `status` string: Status of the action.
  - `count` integer: Total count of actions.

## Other responses

- `default`: Error response.

---

[API](https://skmtc.dev/watchguard/apis/threatsync-management-api.md) - [All operations](https://skmtc.dev/watchguard/apis/threatsync-management-api/llms.txt) - [OpenAPI document](https://skmtc.dev/watchguard/apis/threatsync-management-api/revisions/2993b1908d27?raw)