Bulk revoke or delete enrollment API keys Generally available; added in 9.5.0

POST /api/fleet/enrollment_api_keys/_bulk_delete
Api key auth Basic auth

Spaces method and path for this operation:

post /s/{space_id}/api/fleet/enrollment_api_keys/_bulk_delete

Refer to Spaces for more information.

Revoke or delete multiple enrollment API keys.

[Required authorization] Route required privileges: fleet-agents-all.

Headers

  • kbn-xsrf string Required

    A required header to protect against CSRF attacks

application/json

Body

  • forceDelete boolean

    When false (default), invalidate the API key and mark the token as inactive. When true, also delete the token document.

    Default value is false.

  • includeHidden boolean

    When true, allow deletion of hidden enrollment tokens (managed/agentless policies). Defaults to false.

    Default value is false.

  • kuery string

    KQL query to select enrollment tokens to delete.

  • tokenIds array[string]

    List of enrollment token IDs to delete.

    Not more than 10000 elements.

Responses

  • 200 application/json

    Successful response

    Hide response attributes Show response attributes object
    • action string Required
    • count number Required
    • errorCount number Required
    • successCount number Required
  • 400 application/json

    Bad Request

    Hide response attributes Show response attributes object
    • attributes Required
    • error string
    • errorType string
    • message string Required
    • statusCode number
POST /api/fleet/enrollment_api_keys/_bulk_delete 
curl \
 --request POST 'https://localhost:5601/api/fleet/enrollment_api_keys/_bulk_delete' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --header "kbn-xsrf: true" \
 --data '{"forceDelete":true,"tokenIds":["token-id-1","token-id-2"]}'
Request examples
Bulk delete enrollment API keys by IDs 
{
  "forceDelete": true,
  "tokenIds": [
    "token-id-1",
    "token-id-2"
  ]
}
Bulk delete enrollment API keys by KQL query 
{
  "forceDelete": false,
  "kuery": "policy_id:\"policy-id-1\""
}
Response examples (200)
The enrollment API keys were successfully processed 
{
  "action": "deleted",
  "count": 2,
  "errorCount": 0,
  "successCount": 2
}
Response examples (400)
Example of a generic error response 
{
  "error": "Bad Request",
  "message": "Either tokenIds or kuery must be provided",
  "statusCode": 400
}