Bulk unenroll agents

Base URL: https://{kibana_url}

POST /api/fleet/agents/bulk_unenroll

Auth

Unenroll multiple agents, optionally revoking their enrollment API keys.

Required authorization

Privileges fleet-agents-all

Header parameters

kbn-xsrf string required: A required header to protect against CSRF attacks

Request body

agents union string[] | string required
batchSize number
dryRun boolean
force boolean: Unenrolls hosted agents too
includeInactive boolean: When passing agents by KQL query, unenrolls inactive agents too
revoke boolean: Revokes API keys of agents

Responses

Successful response

application/json

Any of:

actionId string required

Bad Request

application/json

attributes object required
error string
errorType string
message string required
statusCode number

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Unenroll multiple agents

Console Kibana Dev Tools

POST kbn:/api/fleet/agents/bulk_unenroll
{
  "agents": [
    "agent-id-1",
    "agent-id-2"
  ],
  "revoke": false
}

Generated from the API spec

curl Shell

curl -X POST "${KIBANA_URL}/api/fleet/agents/bulk_unenroll" \
  -H "kbn-xsrf: true" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "agents": [
      "agent-id-1",
      "agent-id-2"
    ],
    "revoke": false
  }'

Generated from the API spec

Response

Bulk unenroll action result

{
  "actionId": "action-id-1"
}

{
  "error": "Bad Request",
  "message": "An error message describing what went wrong",
  "statusCode": 400
}

Required authorization

Header parameters

Request body { }

Responses

Request body