Get FalconUninstallToken

Get-FalconUninstallToken

SYNOPSIS

Retrieve an uninstallation or maintenance token

DESCRIPTION

Requires 'Sensor update policies: Write', plus related permission(s) for "Include" selection(s).

PARAMETERS

Name	Type	Description	Min	Max	Allowed	Pipeline	PipelineByName
AuditMessage	String	Audit log comment
Include	String[]	Include additional properties			agent_version cid external_ip first_seen hostname last_seen local_ip mac_address os_build os_version platform_name product_type product_type_desc serial_number system_manufacturer system_product_name tags
Id	String	Host identifier				X	X

SYNTAX

Get-FalconUninstallToken [[-AuditMessage] <String>] [[-Include] <String[]>] [-Id] <String> [-WhatIf] [-Confirm] [<CommonParameters>]

REFERENCE

Endpoints

POST /policy/combined/reveal-uninstall-token/v1

falconpy

revealUninstallToken

USAGE

Finding a token for a host

Get-FalconUninstallToken -Id <id>

Finding the maintenance token that applies to any host within a given policy

Get-FalconUninstallToken -Id MAINTENANCE

Create a CSV of all available uninstall tokens

Get-FalconHost -All | Get-FalconUninstallToken -Include hostname | Export-Csv .\token_list.csv -NoTypeInformation

Create a CSV of uninstall tokens using a list of device_ids in a text file

Get-Content .\device_id.txt | Get-FalconUninstallToken | Export-Csv .\token_list.csv -NoTypeInformation

2025-09-19: PSFalcon v2.2.9