Bulk revoke or delete enrollment API keys
Server:
https://{kibana_url}
- POST /api/fleet/enrollment_api_keys/_bulk_delete
- POST /s/{space_id}/api/fleet/enrollment_api_keys/_bulk_delete
Refer to Spaces for more information.
Revoke or delete multiple enrollment API keys.
[Required authorization] Route required privileges: fleet-agents-all.
Request
-
forceDeleteboolean · default: false -
When false (default), invalidate the API key and mark the token as inactive. When true, also delete the token document.
-
includeHiddenboolean · default: false -
When true, allow deletion of hidden enrollment tokens (managed/agentless policies). Defaults to false.
-
kuerystring -
KQL query to select enrollment tokens to delete.
-
tokenIdsstring · max: 10000 -
List of enrollment token IDs to delete.
Responses
Successful response
-
actionstringrequired -
countnumberrequired -
errorCountnumberrequired -
successCountnumberrequired
Bad Request
-
attributesobjectrequired -
errorstring -
errorTypestring -
messagestringrequired -
statusCodenumber