action_get
Read-only
Retrieve Zabbix actions that define automated event responses, filter by event source, and include operation details to inspect event-driven workflows.
Instructions
Retrieve actions that define automated responses to Zabbix events. Actions tie conditions (e.g. trigger severity, host group membership) to operations (e.g. send message, execute script, close problem). Filter by event source to narrow results: 0=trigger, 1=discovery, 2=autoregistration, 3=internal, 4=service. Use selectOperations, selectRecoveryOperations, selectUpdateOperations in the output to include the full operation definitions.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of results to return. | |
| filter | No | Return only results whose properties exactly match the given values (a single value or a list of values per key). Example: {"status": 0} or {"status": [0, 1]}. Keys: actionid, esc_period, eventsource, name, notify_if_canceled (6.0+), pause_suppressed, pause_symptoms (6.4+), status. Text properties cannot be filtered; use 'search' for them. | |
| output | No | Properties of the action object to return. Pass 'extend' for all, 'count' for the number of matches only, or a list of property names. Default when omitted: actionid, name, status, eventsource. Properties: actionid, esc_period, eventsource, name, notify_if_canceled (6.0+), pause_suppressed, pause_symptoms (6.4+), status. | |
| search | No | Return results whose string properties contain the given pattern (case-insensitive; '*' is a wildcard when searchWildcardsEnabled is true). Example: {"name": "web"}. Keys: esc_period, name. | |
| server | No | Target Zabbix server. Available: default. Defaults to 'default' if omitted. | |
| hostids | No | Return only actions that reference these host IDs in their conditions. | |
| groupids | No | Return only actions that reference these host group IDs in their conditions. | |
| raw_json | No | Strips the security disclaimer preamble from the response so it is pure JSON. Default: false. Requires the bearer token to have 'allow_raw_json' explicitly enabled by an operator in the admin portal - tokens without that policy receive a PolicyError instead. WARNING: setting true bypasses the prompt-injection mitigation marker that wraps untrusted Zabbix data (host names, item descriptions, problem text). LLM clients (Claude, GPT, Cursor, ...) should leave this false; only programmatic non-LLM consumers (Python scripts, n8n workflows that json.loads the result) should set true. | |
| actionids | No | Return only actions with the given IDs. | |
| sortfield | No | Sort by one or more of: actionid, name, status (a list for several; pair with 'sortorder'). No other property is sortable. | |
| sortorder | No | Sort order: 'ASC' (ascending) or 'DESC' (descending). | |
| triggerids | No | Return only actions that reference these trigger IDs in their conditions. | |
| countOutput | No | Return the count of matching results instead of the actual data. | |
| eventsource | No | Return only actions with the given event source. Values: 0 = trigger events, 1 = discovery events, 2 = autoregistration events, 3 = internal events, 4 = service events. | |
| searchByAny | No | If true, return results matching ANY search field (OR). Default is ALL fields (AND). | |
| extra_params | No | Other native action.get parameters, merged into the request as-is. Parameters: mediatypeids, scriptids, userids, usrgrpids. Sub-object selects (value 'extend', 'count' or a list of property names): selectFilter, selectOperations, selectRecoveryOperations, selectUpdateOperations (6.0+). Any other key is refused here, because Zabbix would silently ignore it. For a parameter you are sure exists on your release but is not listed, use zabbix_raw_api_call. | |
| searchWildcardsEnabled | No | If true, enable * and ? wildcards in search patterns. |