---
type: api
title: Create an agent action
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4493/api/doc/kibana-serverless/operation/operation-post-fleet-agents-agentid-actions
resource: https://www.elastic.co/elastic/docs-builder/docs/4493/api/doc/kibana-serverless/operation/operation-post-fleet-agents-agentid-actions
products:
  - Kibana
---

# Create an agent action

- Server: `https://{kibana_url}`

## Paths

- `POST` `/api/fleet/agents/{agentId}/actions`
- `POST` `/s/{space_id}/api/fleet/agents/{agentId}/actions`

#### Path parameters

- `agentId` (string) — required
  The agent ID

## Description

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Create a new action for a specific agent.

## Required authorization

- Privileges: `fleet-agents-all`

## Authentication

- Api key: `Authorization: <value>`
  You must create an API key and use the encoded value in the request header. To learn about creating keys, go to [API keys](https://www.elastic.co/docs/current/serverless/api-keys).

## Header parameters

- `kbn-xsrf` (string) — required
  A required header to protect against CSRF attacks

## Request body

`application/json`

- `action` (union anyOf) — required
  - **{ ack_data }**
    - `ack_data` (object) — required
    - `data` (object) — required
    - `type` (enum) — required
      Values: `UNENROLL`, `UPGRADE`, `POLICY_REASSIGN`
  - **type: SETTINGS**
    - `data` (object) — required
      - `log_level` (enum · default: null) — optional — nullable
        Values: `debug`, `info`, `warning`, `error`, `null`
    - `type` (enum) — required
      Values: `SETTINGS`

## Responses

#### `200`

Successful response

`application/json`

- `item` (object)
  - `ack_data` (object)
  - `agents` (string[] · max items: 10000)
  - `created_at` (string)
  - `data` (object)
  - `expiration` (string)
  - `id` (string)
  - `minimum_execution_duration` (number)
  - `namespaces` (string[] · max items: 100)
  - `rollout_duration_seconds` (number)
  - `sent_at` (string)
  - `source_uri` (string)
  - `start_time` (string)
  - `total` (number)
  - `type` (string)
#### `400`

Bad Request

`application/json`

- `attributes` (object)
- `error` (string)
- `errorType` (string)
- `message` (string)
- `statusCode` (number)
## Code examples

#### Console

```console
POST kbn:/api/fleet/agents/AGENT_ID/actions
{
  "action": {
    "type": "UNENROLL"
  }
}
```

#### curl

```curl
curl -X POST "${KIBANA_URL}/api/fleet/agents/${AGENT_ID}/actions" \
  -H "kbn-xsrf: true" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "action": {
      "type": "UNENROLL"
    }
  }'
```

## Response examples

#### Post agent action

Created agent action

```json
{
  "item": {
    "agents": [
      "agent-id-1"
    ],
    "created_at": "2024-01-01T00:00:00.000Z",
    "id": "action-id-1",
    "type": "UNENROLL"
  }
}
```

#### Generic error response

Example of a generic error response

```json
{
  "error": "Bad Request",
  "message": "An error message describing what went wrong",
  "statusCode": 400
}
```