---
type: api
title: Bulk unenroll agents
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4641/api/doc/kibana/operation/operation-post-fleet-agents-bulk-unenroll
resource: https://www.elastic.co/elastic/docs-builder/docs/4641/api/doc/kibana/operation/operation-post-fleet-agents-bulk-unenroll
products:
  - Kibana
---

# Bulk unenroll agents

Authentication: required

- Server: `https://{kibana_url}`

## Paths

- `POST` `/api/fleet/agents/bulk_unenroll`
- `POST` `/s/{space_id}/api/fleet/agents/bulk_unenroll`

#### Path parameters

- `space_id` (string) — optional
  An identifier for the space. If `space_id` is not provided in the URL, the default space is used. Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

## Description

Unenroll multiple agents. By default, the agents stop sending data and their API keys are invalidated after they acknowledge the unenroll action. To invalidate the API keys immediately, use `revoke`. **Force unenroll** in the UI sends `revoke: true`.

## Required authorization

- Privileges: `fleet-agents-all`

## Header parameters

- `kbn-xsrf` (string) — required
  A required header to protect against CSRF attacks

## Request body

`application/json`

- `agents` (union string[] | string) — required
- `batchSize` (number) — optional
- `dryRun` (boolean) — optional
- `force` (boolean) — optional
  Also unenrolls agents that are enrolled in hosted agent policies or are managed agents. Does not revoke API keys immediately. To do so, also set `revoke`.
- `includeInactive` (boolean) — optional
  When passing agents by KQL query, unenrolls inactive agents too
- `revoke` (boolean) — optional
  Immediately invalidates the API keys of the agents without notifying them. The agents keep running and can still send data to outputs not covered by the invalidated keys, such as Kafka and Logstash. Remote Elasticsearch keys are invalidated by Fleet Server on a best-effort basis. This action cannot be undone. Use it only for offline or compromised agents.

## Responses

#### `200`

Successful response

`application/json`

Any of:
- **{ actionId }**
  - `actionId` (string)
- **{ count }**
  - `count` (number)
#### `400`

Bad Request

`application/json`

- `attributes` (object)
- `error` (string)
- `errorType` (string)
- `message` (string)
- `statusCode` (number)
## Code examples

#### Console

```console
POST kbn:/api/fleet/agents/bulk_unenroll
{
  "agents": [
    "agent-id-1",
    "agent-id-2"
  ],
  "revoke": false
}
```

#### curl

```curl
curl -X POST "${KIBANA_URL}/api/fleet/agents/bulk_unenroll" \
  -H "kbn-xsrf: true" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "agents": [
      "agent-id-1",
      "agent-id-2"
    ],
    "revoke": false
  }'
```

## Response examples

#### Post bulk unenroll agents

`application/json`

Bulk unenroll action result

```json
{
  "actionId": "action-id-1"
}
```

#### Generic error response

`application/json`

Example of a generic error response

```json
{
  "error": "Bad Request",
  "message": "An error message describing what went wrong",
  "statusCode": 400
}
```