Bulk revoke or delete enrollment API keys

Base URL: https://{kibana_url}

POST /api/fleet/enrollment_api_keys/_bulk_delete
POST /s/{space_id}/api/fleet/enrollment_api_keys/_bulk_delete

Auth

Revoke or delete multiple enrollment API keys.

Required privileges

Privileges fleet-agents-all

Path parameters

space_id string optional: An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Header parameters

kbn-xsrf string required: A required header to protect against CSRF attacks

Request body

forceDelete boolean · default: false: When false (default), invalidate the API key and mark the token as inactive. When true, also delete the token document.
includeHidden boolean · default: false: When true, allow deletion of hidden enrollment tokens (managed/agentless policies). Defaults to false.
kuery string: KQL query to select enrollment tokens to delete.
tokenIds string[] · max items: 10000: List of enrollment token IDs to delete.

Responses

Successful response

application/json

action string required
count number required
errorCount number required
successCount number required

Bad Request

application/json

View as Markdown

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Bulk delete enrollment API keys by IDs

Console Kibana Dev Tools

POST kbn:/api/fleet/enrollment_api_keys/_bulk_delete
{
  "forceDelete": true,
  "tokenIds": [
    "token-id-1",
    "token-id-2"
  ]
}

Generated from the API spec

curl Shell

curl -X POST "${KIBANA_URL}/api/fleet/enrollment_api_keys/_bulk_delete" \
  -H "kbn-xsrf: true" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "forceDelete": true,
    "tokenIds": [
      "token-id-1",
      "token-id-2"
    ]
  }'

Generated from the API spec

Response

The enrollment API keys were successfully processed

{
  "action": "deleted",
  "count": 2,
  "errorCount": 0,
  "successCount": 2
}

{
  "error": "Bad Request",
  "message": "Either tokenIds or kuery must be provided",
  "statusCode": 400
}

Request Console 1 / 2 languages

Bulk delete enrollment API keys by KQL query

Console Kibana Dev Tools

POST kbn:/api/fleet/enrollment_api_keys/_bulk_delete
{
  "forceDelete": false,
  "kuery": "policy_id:\u0022policy-id-1\u0022"
}

Generated from the API spec

curl Shell

curl -X POST "${KIBANA_URL}/api/fleet/enrollment_api_keys/_bulk_delete" \
  -H "kbn-xsrf: true" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "forceDelete": false,
    "kuery": "policy_id:\u0022policy-id-1\u0022"
  }'

Generated from the API spec

Response

The enrollment API keys were successfully processed

{
  "action": "deleted",
  "count": 2,
  "errorCount": 0,
  "successCount": 2
}

{
  "error": "Bad Request",
  "message": "Either tokenIds or kuery must be provided",
  "statusCode": 400
}