Create an agent action

Base URL: https://{kibana_url}

POST /api/fleet/agents/{agentId}/actions
POST /s/{space_id}/api/fleet/agents/{agentId}/actions

Auth

Create a new action for a specific agent.

Required privileges

Privileges fleet-agents-all

Path parameters

space_id string optional: An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.
agentId string required: The agent ID

Header parameters

kbn-xsrf string required: A required header to protect against CSRF attacks

Request body

action union anyOf required: Any of:

Responses

Successful response

application/json

item object required

Bad Request

application/json

View as Markdown

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Create a UNENROLL action for an agent

Console Kibana Dev Tools

POST kbn:/api/fleet/agents/AGENT_ID/actions
{
  "action": {
    "type": "UNENROLL"
  }
}

Generated from the API spec

curl Shell

curl -X POST "${KIBANA_URL}/api/fleet/agents/${AGENT_ID}/actions" \
  -H "kbn-xsrf: true" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "action": {
      "type": "UNENROLL"
    }
  }'

Generated from the API spec

Response

Created agent action

{
  "item": {
    "agents": [
      "agent-id-1"
    ],
    "created_at": "2024-01-01T00:00:00.000Z",
    "id": "action-id-1",
    "type": "UNENROLL"
  }
}

{
  "error": "Bad Request",
  "message": "An error message describing what went wrong",
  "statusCode": 400
}