Bulk unenroll agents

Base URL
https://{kibana_url}
  • POST /api/fleet/agents/bulk_unenroll
  • POST /s/{space_id}/api/fleet/agents/bulk_unenroll
Auth

Unenroll multiple agents, optionally revoking their enrollment API keys.

Required authorization

Privileges fleet-agents-all

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Header parameters

kbn-xsrf string required

A required header to protect against CSRF attacks

Request body

agents union string[] | string required
batchSize number
dryRun boolean
force boolean

Unenrolls hosted agents too

includeInactive boolean

When passing agents by KQL query, unenrolls inactive agents too

revoke boolean

Revokes API keys of agents

Responses

Successful response

application/json
Any of:
actionId string required

Bad Request

application/json
attributes object required
error string
errorType string
message string required
statusCode number
Base URL
https://{kibana_url}