POST /api/fleet/agents/{agentId}/unenroll
Api key auth Basic auth

Spaces method and path for this operation:

post /s/{space_id}/api/fleet/agents/{agentId}/unenroll

Refer to Spaces for more information.

Unenroll a specific agent. By default, the agent stops sending data and its API keys are invalidated after it acknowledges the unenroll action. To invalidate the API keys immediately, use revoke. Force unenroll in the UI sends revoke: true.

[Required authorization] Route required privileges: fleet-agents-all.

Headers

  • kbn-xsrf string Required

    A required header to protect against CSRF attacks

Path parameters

  • agentId string Required

    The agent ID

    Minimum length is 0.

application/json

Body

  • force boolean

    Unenrolls the agent even if it is enrolled in a hosted agent policy or is a managed agent. Does not revoke API keys immediately. To do so, also set revoke.

  • revoke boolean

    Immediately invalidates the API keys of the agent without notifying it. The agent keeps running and can still send data to outputs not covered by the invalidated keys, such as Kafka and Logstash. Remote Elasticsearch keys are invalidated by Fleet Server on a best-effort basis. This action cannot be undone. Use it only for offline or compromised agents.

Responses

  • 200 application/json

    Successful response

  • 400 application/json

    Bad Request

POST /api/fleet/agents/{agentId}/unenroll 
curl \
 --request POST 'https://localhost:5601/api/fleet/agents/{agentId}/unenroll' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --header "kbn-xsrf: true" \
 --data '{
  "revoke": false
}'
Request example
Unenroll an agent, optionally revoking the enrollment API key 
{
  "revoke": false
}
Response examples (200)
Agent successfully unenrolled 
{}
Response examples (400)
Example of a generic error response 
{
  "error": "Bad Request",
  "message": "An error message describing what went wrong",
  "statusCode": 400
}