Uninstall

Uninstall the product.

Syntax

Method ID

#define WAAPI_MID_COMMON_UNINSTALL 40000

JSON Input Structure

{
  "input": {
    "method": 40000,
    "signature": number,
    "type": string,
    "timeout": number,
    "plugin": object
  }
}

Input Properties

Parameter	Type	Description
`type`	string	'native' for uninstalls using the native uninstaller or 'auto' for managed uninstalls.
`timeout`	number	(optional) A timeout value in seconds that can be set to this method call. Default value is 1800 (30 minutes).
`plugin`	object	(optional) A json object string, which is an entry in the 'plugins' array returned from the GetPlugins method call on the same product. This will instead uninstall the specified plugin for the product, rather than the product itself. NOTE: this parameter is ignored when type does not equal 'auto'.

JSON Output Structure

{
  "result": {
    "method": 40000,
    "code": number,
    "timing": number,
    "timestamp": string
  }
}

Output Properties

Property	Type	Description
`result.method`	number	The method ID that generated this result.
`result.code`	number	The result code. See Result Codes.
`result.timing`	number	The measured time for the method call in milliseconds.
`result.timestamp`	string	The timestamp in seconds of when the call was made.

Result Codes

These codes are returned by both the auto and native uninstall modes. The Type column indicates which mode(s) can produce each code.

Success

Code	Constant	Type	Meaning	Recommended Action
`0`	`WAAPI_OK`	Both	The product was successfully uninstalled and is no longer detected on the system.	No action required.
`10`	`WAAPI_OK_RESTART_TO_ENABLE`	`auto`	Uninstall completed successfully. A system reboot is required to finish the cleanup.	Prompt the user to restart the system. The product will be fully gone after the reboot.

Input and Configuration Errors

These are returned before any uninstall attempt is made. They indicate a problem in how the API was called.

Code	Constant	Type	Meaning	Recommended Action
`-5`	`WAAPI_ERROR_NOT_INITIALIZED`	Both	The removal SDK has not been initialized. `Uninstall` was called before the module was set up.	Ensure the SDK is fully initialized before invoking the `Uninstall` method.
`-20`	`WAAPI_ERROR_INVALID_INPUT_ARGS`	Both	The input JSON is missing a required field (`input`, `method`, or `signature`), or contains an invalid `timeout` value (negative).	Validate the input JSON against the API specification before calling.
`-21`	`WAAPI_ERROR_INVALID_JSON`	Both	The input string could not be parsed as valid JSON.	Verify that the JSON payload is well-formed and correctly encoded.

Authorization and Security Errors

Code	Constant	Type	Meaning	Recommended Action
`-10`	`WAAPI_ERROR_COMPONENT_TAMPERED`	Both	The removal component failed a security integrity check, or the target product's self-protection mechanism blocked the uninstall attempt. Two distinct cases: (1) SDK integrity — the internal removal binary has an invalid or missing digital signature; (2) Product self-protection — the product's tamper protection prevented removal (e.g. CrowdStrike requires a maintenance token; Palo Alto Networks and Sophos block the uninstaller at the OS level).	For case (1), ensure the SDK binaries have not been modified or tampered with. For case (2), disable the product's self-protection or supply the required maintenance credentials before retrying.
`-22`	`WAAPI_ERROR_ACCESS_DENIED`	Both	The calling process is not running with administrator privileges.	Relaunch the calling application with elevated (administrator) privileges. This is required for all uninstall operations.

Product-Specific Errors

These codes indicate a condition related to the target product itself.

Code	Constant	Type	Meaning	Recommended Action
`-12`	`WAAPI_ERROR_COMPONENT_METHOD_NOT_IMPLEMENTED`	`auto`	The specified product is not supported by the current version of the Removal Module.	Check whether a newer version of the Removal Module is available. If the product should be supported, raise a support request with OPSWAT.
`-64`	`WAAPI_ERROR_PASSWORD_REQUIRED`	`auto`	The product requires a password to uninstall and none was provided.	Supply the password in the `credential.secret` field of the input JSON and retry.
`-19`	`WAAPI_ERROR_INVALID_CREDENTIALS`	`auto`	The credentials supplied were rejected by the product.	Verify the username and password are correct, then retry.
`-23`	`WAAPI_ERROR_INVALID_STATE`	`auto`	The product is in a state that prevents uninstall. Two known cases: (1) An upgrade or installation of the product is currently in progress (e.g. CrowdStrike: detected when the installer service process is still running); (2) A system reboot is pending from a previous operation and must be completed before uninstall can proceed (e.g. Virgin Media Security).	For case (1), wait for the ongoing upgrade or installation to complete, then retry. For case (2), reboot the system and retry.
`-28`	`WAAPI_ERROR_NOT_FOUND`	Both	`auto`: A required registry key or resource for the product could not be located during the uninstall sequence. This typically means the product is not fully installed or has already been partially removed (e.g. SentinelOne: the service registry entry is missing). `native`: No uninstall entry was found in the Windows registry for the specified product. The product may not be installed or may have been removed without cleaning up its registry entries.	`auto`: Verify the product is still installed and its installation is intact. If the product is no longer detected on the system, the removal goal may already be met. `native`: Confirm the product is installed and has a valid uninstall entry registered in the system.
`-65`	`WAAPI_ERROR_CAPTCHA_REQUIRED`	`auto`	The product's uninstaller requires CAPTCHA verification, which cannot be completed automatically.	Silent removal is not possible for this product. Direct the user to uninstall manually through the product's own interface or control panel.
`-95`	`WAAPI_ERROR_UNINSTALL_UNVALIDATED_VERSION`	`auto`	The installed version of the product is outside the range validated by OPSWAT. The uninstall was attempted but did not succeed.	Check whether a newer version of the Removal Module supports this product version. If the product must be removed, uninstall it manually or contact OPSWAT support.
`-96`	`WAAPI_ERROR_FAILED_TO_GET_PRODUCT_VERSION`	`auto`	The removal engine could not determine the installed version of the product. The version is required before proceeding with removal.	Verify the product is fully installed and its version information is accessible in the system registry. If the issue persists, contact OPSWAT support with diagnostic logs.

Execution and System Errors

These codes indicate a failure during the uninstall attempt itself.

Code	Constant	Type	Meaning	Recommended Action
`-1`	`WAAPI_ERROR_GENERAL`	`auto`	The uninstall attempt ran but did not succeed. The product may still be present on the system.	Retry with verified credentials and elevated privileges. If the issue persists, collect diagnostic logs and contact support.
`-17`	`WAAPI_ERROR_NO_CONNECTION`	Both	`auto`: The internal removal process could not be started, or communication with it was lost. `native`: The uninstall command returned by `GetUninstallString` could not be launched.	`auto`: Ensure the application is running with administrator privileges. Check that no security policy or endpoint protection is blocking process creation. Retry the operation. `native`: Ensure the application has sufficient privileges to launch processes and that the uninstall command path is accessible.
`-27`	`WAAPI_ERROR_NATIVE_API`	`auto`	A system-level error occurred during the uninstall sequence. This includes Windows API call failures or an inability to execute the required removal operation.	Review the Windows event log for related system errors. If the error persists, contact support with diagnostic logs.
`-40`	`WAAPI_ERROR_UNINSTALL_TIMEOUT`	`auto`	The uninstall operation did not complete within the allowed time (default: 30 minutes). The product's uninstaller may be hanging, waiting for a user interaction prompt, or blocked by a running process.	Check whether the product's uninstaller process is still running or hung. Terminate it if necessary, then retry. If the uninstaller requires user interaction, ensure a desktop session is active. Increasing the `timeout` value (in seconds) may help for products that are slow but not hung.
`-57`	`WAAPI_ERROR_IN_USE`	`auto`	A temporary file required by the removal engine is locked by another process.	Wait for any in-progress removal operation to finish, then retry. If the lock persists, a system reboot may be needed to release the file.

Quick Reference

Code	Constant	Type	Description
`0`	`WAAPI_OK`	Both	Success
`10`	`WAAPI_OK_RESTART_TO_ENABLE`	`auto`	Success, reboot required
`-1`	`WAAPI_ERROR_GENERAL`	`auto`	Uninstall failed (generic)
`-5`	`WAAPI_ERROR_NOT_INITIALIZED`	Both	SDK not initialized
`-10`	`WAAPI_ERROR_COMPONENT_TAMPERED`	Both	Security check failed
`-12`	`WAAPI_ERROR_COMPONENT_METHOD_NOT_IMPLEMENTED`	`auto`	Product not supported
`-17`	`WAAPI_ERROR_NO_CONNECTION`	Both	Process launch / communication error
`-19`	`WAAPI_ERROR_INVALID_CREDENTIALS`	`auto`	Invalid credentials
`-20`	`WAAPI_ERROR_INVALID_INPUT_ARGS`	Both	Invalid input
`-21`	`WAAPI_ERROR_INVALID_JSON`	Both	Malformed JSON
`-22`	`WAAPI_ERROR_ACCESS_DENIED`	Both	Administrator privileges required
`-23`	`WAAPI_ERROR_INVALID_STATE`	`auto`	Invalid product state
`-27`	`WAAPI_ERROR_NATIVE_API`	`auto`	Windows system API error
`-28`	`WAAPI_ERROR_NOT_FOUND`	Both	Required resource / uninstall entry not found
`-40`	`WAAPI_ERROR_UNINSTALL_TIMEOUT`	`auto`	Operation timed out
`-57`	`WAAPI_ERROR_IN_USE`	`auto`	Temporary file locked
`-64`	`WAAPI_ERROR_PASSWORD_REQUIRED`	`auto`	Password required
`-65`	`WAAPI_ERROR_CAPTCHA_REQUIRED`	`auto`	CAPTCHA required, manual removal only
`-95`	`WAAPI_ERROR_UNINSTALL_UNVALIDATED_VERSION`	`auto`	Product version not validated by OPSWAT
`-96`	`WAAPI_ERROR_FAILED_TO_GET_PRODUCT_VERSION`	`auto`	Could not determine installed product version

note

Other codes may be returned. See the full Result Codes reference for the complete list.

Remarks

Overview

The Uninstall method returns an integer status code on every call. Callers must inspect this value to determine the outcome and take the appropriate action. The Result Codes section below lists every documented return value, its meaning, and the recommended response.

Uninstall Types

The Uninstall method supports two modes of operation, controlled by the type field in the input JSON.

`auto`

The removal engine takes full control of the uninstall process. It identifies the product, selects the appropriate removal strategy, and executes the uninstall silently without user interaction. This is the recommended mode for automated and policy-driven scenarios.

Credentials can be passed via credential.username and credential.secret for products that require authentication before removal.
A timeout value (in seconds) controls the maximum time allowed for the operation. If timeout is 0 or not provided, the engine applies a default timeout of 30 minutes.
On success, the engine verifies that the product is no longer detected before returning.

`native`

The engine calls GetUninstallString (ID: 106, constant: WAAPI_MID_COMMON_GET_UNINSTALL_STRING) to retrieve the uninstall command registered by the product in the system, then launches it directly. No further action is taken; the engine does not monitor, control, or verify the outcome of the launched process. Callers who prefer more control can achieve the same result by calling GetUninstallString directly and executing the returned command themselves.

Any error code returned by GetUninstallString is passed through directly to the caller without modification. If the launch succeeds, the return code is always 0 (WAAPI_OK) regardless of the vendor uninstaller's own exit code.
The behavior, UI, and outcome depend entirely on the vendor's uninstaller. Silent execution is not guaranteed; some uninstallers may display a user interface or require user interaction.

Important Notes

Code 10 is a successful outcome. The product has been fully removed from the system; the reboot is needed only to complete file and registry cleanup. A re-detection scan after the reboot will confirm the product is gone.
Code -22 is the most common cause of failure in non-elevated integrations. The calling process must hold administrator privileges. This is a system requirement, not a configuration option.
Code -65 cannot be resolved programmatically. Products that require CAPTCHA must be uninstalled manually by the end user.
Code -17 covers a range of internal process errors. If it occurs repeatedly, ensure no endpoint protection software is interfering with process creation or inter-process communication.

For any questions, error codes not listed here, or issues that cannot be resolved through the recommended actions above, do not hesitate to contact OPSWAT support. Please provide the diagnostic log generated during the removal attempt to help us assist you more efficiently.

Legacy Lua Engine Error Codes

The Removal Module includes a legacy scripting layer (the Lua-based removal engine) that defines its own internal set of error codes, separate from the API return codes documented in Result Codes. These codes are referred to as ARAPI codes and originate from a different layer of the system.

Key points to be aware of:

ARAPI codes are internal to the Lua engine and are not part of the public API surface documented in this reference.
Some ARAPI numeric values coincide with WAAPI values but carry entirely different meanings. The table below lists all known conflicts.
Under normal integration, ARAPI codes do not reach the caller. This document covers only the codes that are returned at the API boundary.

If the Uninstall function returns one of the numeric codes below, the value may originate from the Lua engine layer. In such cases, contact OPSWAT support with the full diagnostic log for accurate interpretation.

Value	ARAPI (Lua engine)	WAAPI (public API)
`-3`	`ARAPI_ERROR_NOT_FOUND` — No Lua script found for the product	`WAAPI_ERROR_LICENSE_MISMATCH` — License mismatch
`-7`	`ARAPI_ERROR_DECRYPTO` — Script decryption failed	`WAAPI_ERROR_COMPONENT_NOT_LICENSED` — Component not licensed
`-8`	`ARAPI_ERROR_LOAD_SCRIPT` — Script could not be loaded	`WAAPI_ERROR_COMPONENT_LICENSE_EXPIRED` — Component license expired
`-9`	`ARAPI_ERROR_OLD_ENGINE` — Engine version too old for the script	`WAAPI_ERROR_COMPONENT_NOT_DEPLOYED` — Component not deployed
`-11`	`ARAPI_ERROR_UNINSTALL_TIMEOUT` — Lua uninstall thread timed out	`WAAPI_ERROR_COMPONENT_METHOD_NOT_SUPPORTED` — Method not supported
`-12`	`ARAPI_ERROR_ACCESS_DENIED` — OS access denied inside Lua script	`WAAPI_ERROR_COMPONENT_METHOD_NOT_IMPLEMENTED` — No uninstall handler found
`-13`	`ARAPI_ERROR_INVALID_PARAM` — Invalid parameter inside Lua script	`WAAPI_ERROR_DATABASE_MISSING` — Database missing
`-14`	`ARAPI_ERROR_NEED_PASSWORD` — Password required (Lua script)	`WAAPI_ERROR_DATABASE_CORRUPTED` — Database corrupted
`-17`	`ARAPI_ERROR_NO_PRIVILEGE` — Insufficient privilege inside Lua script	`WAAPI_ERROR_NO_CONNECTION` — Process/IPC failure

Examples

Examples will be added here demonstrating the usage of this method.

Syntax​

Method ID​

JSON Input Structure​

Input Properties​

JSON Output Structure​

Output Properties​

Result Codes​

Success​

Input and Configuration Errors​

Authorization and Security Errors​

Product-Specific Errors​

Execution and System Errors​

Quick Reference​

Remarks​

Overview​

Uninstall Types​

auto​

native​

Important Notes​

Legacy Lua Engine Error Codes​

Examples​

See Also​