POST /api/fleet/agents/bulk_unenroll
Api key auth Basic auth

Spaces method and path for this operation:

post /s/{space_id}/api/fleet/agents/bulk_unenroll

Refer to Spaces for more information.

Unenroll multiple agents, optionally revoking their enrollment API keys.

[Required authorization] Route required privileges: fleet-agents-all.

Headers

  • kbn-xsrf string Required

    A required header to protect against CSRF attacks

application/json

Body

  • agents array[string] | string Required

    Any of:
    array-1 array[string] string-2 string

    list of agent IDs

    Not more than 10000 elements.

    KQL query string, leave empty to action all agents

  • batchSize number
  • force boolean

    Unenrolls hosted agents too

  • includeInactive boolean

    When passing agents by KQL query, unenrolls inactive agents too

  • revoke boolean

    Revokes API keys of agents

Responses

  • 200 application/json

    Successful response

    Hide response attribute Show response attribute object
    • actionId string Required
  • 400 application/json

    Bad Request

    Hide response attributes Show response attributes object
    • attributes Required
    • error string
    • errorType string
    • message string Required
    • statusCode number
POST /api/fleet/agents/bulk_unenroll 
curl \
 --request POST 'https://localhost:5601/api/fleet/agents/bulk_unenroll' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --header "kbn-xsrf: true" \
 --data '{"agents":["agent-id-1","agent-id-2"],"revoke":false}'
Request example
Unenroll multiple agents 
{
  "agents": [
    "agent-id-1",
    "agent-id-2"
  ],
  "revoke": false
}
Response examples (200)
Bulk unenroll action result 
{
  "actionId": "action-id-1"
}
Response examples (400)
Example of a generic error response 
{
  "error": "Bad Request",
  "message": "An error message describing what went wrong",
  "statusCode": 400
}