Elastic Agent actions

Bulk unenroll agents

Spaces method and path for this operation:

<div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agents/bulk_unenroll</span></div>

Refer to Spaces for more information.

Unenroll multiple agents, optionally revoking their enrollment API keys.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.

post/api/fleet/agents/bulk_unenroll

Request

  • Base URL
    https://localhost:5601
  • URL
    https://localhost:5601/api/fleet/agents/bulk_unenroll
  • Auth
    • API key in header Authorization
    • or HTTP basic

Headers

kbn-xsrfstring required
Example:true

A required header to protect against CSRF attacks

Request body

batchSizenumber
dryRunboolean
forceboolean

Unenrolls hosted agents too

includeInactiveboolean

When passing agents by KQL query, unenrolls inactive agents too

revokeboolean

Revokes API keys of agents

Response

Successful response

OR

Changes

No operation changes recorded.