Skip to main content
Delete all agents or a list of them based on optional criteria.
External DocumentationTo learn more, visit the Wazuh Server documentation.

​
Basic Parameters

ParameterDescription
Agent IDsA comma-separated list, without any whitespace before or after the commas, of agents IDs to delete. Use all to delete all agents.
PrettySelect to show results in human-readable format.
PurgeSelect to permanently delete an agent from the key store.
QueryA query to filter the results by.

For example: status=active
StatusA comma-separated list, without any whitespace before or after the commas, of statuses to filter the agents by.

Options:
- all
- active
- pending
- never_connected
- disconnected
Wait For CompleteSelect to disable timeout response.

​
Advanced Parameters

ParameterDescription
Agent Register IPFilter by the IP used when registering the agent.
GroupFilter by the group of the agent.
IPFilter by the IP used by the agent to communicate with the manager.

Note: If it’s not available, it will have the same value as Register IP.
ManagerFilter by manager hostname to which the agents are connected to.
Node NameFilter by the node name.
OS NameFilter by the operating system name of the agent.
OS PlatformFilter by the operating system platform of the agent.
OS VersionFilter by the operating system version of the agent.
Older ThanFilter agents based on the time elapsed since their last keep-alive signal. You can specify the time using seconds (s), minutes (m), hours (h), or days (d).

For example: 7d, 10s, or simply 10 (which defaults to seconds).
VersionFilter by agents version using one of the following formats: X.Y.Z, vX.Y.Z, wazuh X.Y.Z or wazuh vX.Y.Z.

For example: 4.4.0

​
Example Output

{
	"data": {
		"affected_items": [
			"001",
			"002",
			"003"
		],
		"total_affected_items": 3,
		"total_failed_items": 0,
		"failed_items": []
	},
	"message": "All selected agents were deleted",
	"error": 0
}

​
Workflow Library Example

Remove Agents with Wazuh Server and Send Results Via Email
Workflow LibraryPreview this Workflow on desktop
⌘I