---
type: api
title: Unenroll an agent
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4641/api/doc/kibana/operation/operation-post-fleet-agents-agentid-unenroll
resource: https://www.elastic.co/elastic/docs-builder/docs/4641/api/doc/kibana/operation/operation-post-fleet-agents-agentid-unenroll
products:
  - Kibana
---

# Unenroll an agent

Authentication: required

- Server: `https://{kibana_url}`

## Paths

- `POST` `/api/fleet/agents/{agentId}/unenroll`
- `POST` `/s/{space_id}/api/fleet/agents/{agentId}/unenroll`

#### Path parameters

- `space_id` (string) — optional
  An identifier for the space. If `space_id` is not provided in the URL, the default space is used. Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
- `agentId` (string · min length: 0) — required
  The agent ID

## Description

Unenroll a specific agent. By default, the agent stops sending data and its API keys are invalidated after it acknowledges the unenroll action. To invalidate the API keys immediately, use `revoke`. **Force unenroll** in the UI sends `revoke: true`.

## Required authorization

- Privileges: `fleet-agents-all`

## Header parameters

- `kbn-xsrf` (string) — required
  A required header to protect against CSRF attacks

## Request body

`application/json`

- `force` (boolean) — optional
  Unenrolls the agent even if it is enrolled in a hosted agent policy or is a managed agent. Does not revoke API keys immediately. To do so, also set `revoke`.
- `revoke` (boolean) — optional
  Immediately invalidates the API keys of the agent without notifying it. The agent keeps running and can still send data to outputs not covered by the invalidated keys, such as Kafka and Logstash. Remote Elasticsearch keys are invalidated by Fleet Server on a best-effort basis. This action cannot be undone. Use it only for offline or compromised agents.

## Responses

#### `200`

Successful response

`application/json`

#### `400`

Bad Request

`application/json`

## Code examples

#### Console

```console
POST kbn:/api/fleet/agents/AGENT_ID/unenroll
{
  "revoke": false
}
```

#### curl

```curl
curl -X POST "${KIBANA_URL}/api/fleet/agents/${AGENT_ID}/unenroll" \
  -H "kbn-xsrf: true" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "revoke": false
  }'
```

## Response examples

#### Post unenroll agent

`application/json`

Agent successfully unenrolled

```json
{}
```

#### Generic error response

`application/json`

Example of a generic error response

```json
{
  "error": "Bad Request",
  "message": "An error message describing what went wrong",
  "statusCode": 400
}
```