Bulk unenroll agents

POST /api/fleet/agents/bulk_unenroll
Api key auth

[Required authorization] Route required privileges: fleet-agents-all.

Headers

  • kbn-xsrf string Required

    A required header to protect against CSRF attacks

application/json

Body

  • agents array[string] | string Required

    Any of:
    array-1 array[string] string-2 string

    KQL query string, leave empty to action all agents

    list of agent IDs

  • batchSize number
  • force boolean

    Unenrolls hosted agents too

  • includeInactive boolean

    When passing agents by KQL query, unenrolls inactive agents too

  • revoke boolean

    Revokes API keys of agents

Responses

  • 200 application/json
    Hide response attribute Show response attribute object
    • actionId string Required
  • 400 application/json
    Hide response attributes Show response attributes object
    • error string
    • errorType string
    • message string Required
    • statusCode number
POST /api/fleet/agents/bulk_unenroll 
curl \
 --request POST 'https://<KIBANA_URL>/api/fleet/agents/bulk_unenroll' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --header "kbn-xsrf: true" \
 --data '{"agents":["string"],"batchSize":42.0,"force":true,"includeInactive":true,"revoke":true}'