Bulk revoke or delete enrollment API keys

Base URL
https://{kibana_url}
  • POST /api/fleet/enrollment_api_keys/_bulk_delete
  • POST /s/{space_id}/api/fleet/enrollment_api_keys/_bulk_delete
Auth

Revoke or delete multiple enrollment API keys.

Required authorization

Privileges fleet-agents-all

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Header parameters

kbn-xsrf string required

A required header to protect against CSRF attacks

Request body

forceDelete boolean · default: false

When false (default), invalidate the API key and mark the token as inactive. When true, also delete the token document.

includeHidden boolean · default: false

When true, allow deletion of hidden enrollment tokens (managed/agentless policies). Defaults to false.

kuery string

KQL query to select enrollment tokens to delete.

tokenIds string[] · max items: 10000

List of enrollment token IDs to delete.

Responses

Successful response

application/json
action string required
count number required
errorCount number required
successCount number required

Bad Request

application/json
attributes object required
error string
errorType string
message string required
statusCode number
Base URL
https://{kibana_url}