Unenroll an agent

Base URL: https://{kibana_url}

POST /api/fleet/agents/{agentId}/unenroll
POST /s/{space_id}/api/fleet/agents/{agentId}/unenroll

Auth

Unenroll a specific agent. By default, the agent stops sending data and its API keys are invalidated after it acknowledges the unenroll action. To invalidate the API keys immediately, use revoke. Force unenroll in the UI sends revoke: true.

Required privileges

Privileges fleet-agents-all

Path parameters

space_id string optional: An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.
agentId string · min length: 0 required: The agent ID

Header parameters

kbn-xsrf string required: A required header to protect against CSRF attacks

Request body

force boolean: Unenrolls the agent even if it is enrolled in a hosted agent policy or is a managed agent. Does not revoke API keys immediately. To do so, also set revoke.
revoke boolean: Immediately invalidates the API keys of the agent without notifying it. The agent keeps running and can still send data to outputs not covered by the invalidated keys, such as Kafka and Logstash. Remote Elasticsearch keys are invalidated by Fleet Server on a best-effort basis. This action cannot be undone. Use it only for offline or compromised agents.

Responses

200

Successful response

application/json

400

Bad Request