Unenroll an agent

Base URL
https://{kibana_url}
Auth

Unenroll a specific agent. By default, the agent stops sending data and its API keys are invalidated after it acknowledges the unenroll action. To invalidate the API keys immediately, use revoke. Force unenroll in the UI sends revoke: true.

Required authorization

Privileges fleet-agents-all

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

agentId string · min length: 0 required

The agent ID

Header parameters

kbn-xsrf string required

A required header to protect against CSRF attacks

Request body

force boolean

Unenrolls the agent even if it is enrolled in a hosted agent policy or is a managed agent. Does not revoke API keys immediately. To do so, also set revoke.

revoke boolean

Immediately invalidates the API keys of the agent without notifying it. The agent keeps running and can still send data to outputs not covered by the invalidated keys, such as Kafka and Logstash. Remote Elasticsearch keys are invalidated by Fleet Server on a best-effort basis. This action cannot be undone. Use it only for offline or compromised agents.

Responses

200

Successful response

application/json
400

Bad Request

application/json
Base URL
https://{kibana_url}