Bulk unenroll agents

View as Markdown
POST /api/fleet/agents/bulk_unenroll
Api key auth Basic auth

Spaces method and path for this operation:

post /s/{space_id}/api/fleet/agents/bulk_unenroll

Refer to Spaces for more information.

Headers

  • kbn-xsrf string Required

    Kibana's anti Cross-Site Request Forgery token. Can be any string value.

application/json

Body

  • agents string | array[string] Required

    One of:
    string-1 string array-2 array[string]

    KQL query string, leave empty to action all agents

    list of agent IDs

  • force boolean

    Unenrolls hosted agents too

  • includeInactive boolean

    When passing agents by KQL query, unenrolls inactive agents too

  • revoke boolean

    Revokes API keys of agents

Responses

  • 200 application/json

    OK

    Hide response attribute Show response attribute object
    • actionId string
  • 400 application/json

    Generic Error

    Hide response attributes Show response attributes object
    • error string
    • message string
    • statusCode number
POST /api/fleet/agents/bulk_unenroll 
curl \ --request POST 'https://localhost:5601/api/fleet/agents/bulk_unenroll' \ --header "Authorization: $API_KEY" \ --header "Content-Type: application/json" \ --header "kbn-xsrf: string" \ --data '{"force":false,"agents":["agent1","agent2"],"revoke":true}'
Request example 
{ "force": false, "agents": [ "agent1", "agent2" ], "revoke": true }