Bulk unenroll agents | Kibana Serverless API documentation

Bulk unenroll agents

POST /api/fleet/agents/bulk_unenroll

[Required authorization] Route required privileges: fleet-agents-all.

Headers

kbn-xsrf string Required

A required header to protect against CSRF attacks

application/json

Body

agents array[string] | string Required

Any of:
array-1 array[string] string-2 string

KQL query string, leave empty to action all agents

list of agent IDs
batchSize number
force boolean

Unenrolls hosted agents too
includeInactive boolean

When passing agents by KQL query, unenrolls inactive agents too
revoke boolean

Revokes API keys of agents

Responses

200 application/json
Hide response attribute Show response attribute object
- actionId string Required
400 application/json
Hide response attributes Show response attributes object
- error string
- errorType string
- message string Required
- statusCode number

POST /api/fleet/agents/bulk_unenroll

curl \
 --request POST 'https://<KIBANA_URL>/api/fleet/agents/bulk_unenroll' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --header "kbn-xsrf: true" \
 --data '{"agents":["string"],"batchSize":42.0,"force":true,"includeInactive":true,"revoke":true}'