# Some agent API keys get invalidated then deleted

**URL:** <https://discuss.elastic.co/t/some-agent-api-keys-get-invalidated-then-deleted/383631>\
**Category:** Elastic Agent\
**Created:** [November 25, 2025, 4:00am UTC](https://discuss.elastic.co/t/some-agent-api-keys-get-invalidated-then-deleted/383631 "2025-11-25T04:00:50Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)\
**Post date:** [November 25, 2025, 4:00am UTC](https://discuss.elastic.co/t/some-agent-api-keys-get-invalidated-then-deleted/383631/1 "2025-11-25T04:00:50Z")

</div>

I noticed errors “Unable to authenticate - apikey not found”. For a few apikeys. They are frequently repeated. This is an Elastic cloud hosted stack.

These seem to have started with the prior version update, then more with the last version update. I then found that after the upgrade, the errors are for revoked keys, then they become missing after several days.

I found a Fleet FORCE\_UNENROLL action that seems to have happened during the last upgrade.

I’m working a case with support, but has anyone seen anything like his? Would any process in an upgrade unenroll agents? Would anything delete revoked API keys?

I turned on audit for over an hour and found 60+ IP’s with anonymous access denied errors, which I think relate to he missing key errors. They are probably mostly Windows workstation agents.