Bulk unenroll agents

Base URL: https://{kibana_url}

POST /api/fleet/agents/bulk_unenroll
POST /s/{space_id}/api/fleet/agents/bulk_unenroll

Auth

Unenroll multiple agents. By default, the agents stop sending data and their API keys are invalidated after they acknowledge the unenroll action. To invalidate the API keys immediately, use revoke. Force unenroll in the UI sends revoke: true.

Required authorization

Privileges fleet-agents-all

Path parameters

space_id string optional: An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Header parameters

kbn-xsrf string required: A required header to protect against CSRF attacks

Request body

agents union string[] | string required
batchSize number
dryRun boolean
force boolean: Also unenrolls agents that are enrolled in hosted agent policies or are managed agents. Does not revoke API keys immediately. To do so, also set revoke.
includeInactive boolean: When passing agents by KQL query, unenrolls inactive agents too
revoke boolean: Immediately invalidates the API keys of the agents without notifying them. The agents keep running and can still send data to outputs not covered by the invalidated keys, such as Kafka and Logstash. Remote Elasticsearch keys are invalidated by Fleet Server on a best-effort basis. This action cannot be undone. Use it only for offline or compromised agents.

Responses

Successful response

application/json

Any of:

actionId string required

Bad Request