Authenticate with an Organization Admin User API key, sent in the skyfire-api-key header. Keys belonging to Organization Admins are accepted; a MEMBER key, or any Agent API key, is rejected with 401.

The group is resolved within your own organization; an unknown group returns 404. A user who has never been enrolled in the group returns 404.

What happens

1. The enrollment is closed and the instance agent is deactivated. Its API keys stop authenticating immediately.
2. Every card enrolled on the instance is removed at the card network.
3. The instance's wallet is kept, so any remaining balance stays reachable for recovery. Funds are never swept automatically.

The response is 204 No Content. Unenrolling works whether or not the group is active.

The deactivated instance keeps appearing in Get Agent Group Agents when includeUnenrolled=true, with enrolled: false and status: "inactive". It cannot be reactivated through the agent update endpoint; re-enrolling the user mints a fresh instance instead.

Repeating the call

DELETE is safe to repeat. The instance is deactivated before cards are removed, so a failure at the card network leaves the keys dead rather than the agent live. Calling again for an already unenrolled user finishes any card removal that did not complete and returns 204.