Bulk unenroll agents

View as Markdown
POST /api/fleet/agents/bulk_unenroll
Api key auth Basic auth

Spaces method and path for this operation:

post /s/{space_id}/api/fleet/agents/bulk_unenroll

Refer to Spaces for more information.

[Required authorization] Route required privileges: fleet-agents-all.

Headers

  • kbn-xsrf string Required

    A required header to protect against CSRF attacks

application/json

Body

  • agents array[string] | string Required

    Any of:
    array-1 array[string] string-2 string

    KQL query string, leave empty to action all agents

    list of agent IDs

  • batchSize number
  • force boolean

    Unenrolls hosted agents too

  • includeInactive boolean

    When passing agents by KQL query, unenrolls inactive agents too

  • revoke boolean

    Revokes API keys of agents

Responses

  • 200 application/json

    OK: A successful request.

    Hide response attribute Show response attribute object
    • actionId string Required
  • 400 application/json

    A bad request.

    Hide response attributes Show response attributes object
    • error string
    • errorType string
    • message string Required
    • statusCode number
POST /api/fleet/agents/bulk_unenroll 
curl \ --request POST 'https://localhost:5601/api/fleet/agents/bulk_unenroll' \ --header "Authorization: $API_KEY" \ --header "Content-Type: application/json" \ --header "kbn-xsrf: true" \ --data '{"agents":["string"],"batchSize":42.0,"force":true,"includeInactive":true,"revoke":true}'