Bulk unenroll agents

POST /api/fleet/agents/bulk_unenroll
Api key auth Basic auth

Spaces method and path for this operation:

post /s/{space_id}/api/fleet/agents/bulk_unenroll

Refer to Spaces for more information.

Headers

  • kbn-xsrf string Required

    Kibana's anti Cross-Site Request Forgery token. Can be any string value.

application/json

Body

  • agents string | array[string] Required

    One of:
    string-1 string array-2 array[string]

    KQL query string, leave empty to action all agents

    list of agent IDs

  • force boolean

    Unenrolls hosted agents too

  • includeInactive boolean

    When passing agents by KQL query, unenrolls inactive agents too

  • revoke boolean

    Revokes API keys of agents

Responses

  • 200 application/json

    OK

    Hide response attribute Show response attribute object
    • actionId string
  • 400 application/json

    Generic Error

    Hide response attributes Show response attributes object
    • error string
    • message string
    • statusCode number
POST /api/fleet/agents/bulk_unenroll 
curl \
 --request POST 'https://localhost:5601/api/fleet/agents/bulk_unenroll' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --header "kbn-xsrf: string" \
 --data '"{\n  \"agents\": [\n    \"agent1\",\n    \"agent2\"\n  ],\n  \"force\": false,\n  \"revoke\": true\n}"'
Request example 
{
  "agents": [
    "agent1",
    "agent2"
  ],
  "force": false,
  "revoke": true
}