Delete secrets

DELETE /v1/kms/secrets/{wildcard1}

Removes one secret from your org.

Forgets one secret belonging to the caller's own org and confirms the name and environment that were removed. Deleting a secret that is not there is a 404, not a silent success, so a caller can tell a real deletion from a typo.

secret is the coordinate beneath the caller's org root, subpath and name together, and over HTTP it is the trailing path itself. env selects the environment and falls back to the default when omitted. The org comes from the validated claim, never from the request.

A delete is a WRITE to the grant rule, like the put: destroying a secret is as consequential as replacing it, and a credential distributed to READ one must not be able to remove it. It opens only for SuperAdmin holding an access token, audited, or for a holder a declared WRITE grant covers. Fail-closed admission, in order: a validated member, well-formed org, master key present, well-formed address, then the grant — 401/403, 400, 503, 400 and 403, all decided before any record is touched.

A value this deployment seals on the org's behalf is removed by the app that holds it, and never here for membership or org admin, whatever the grant declaration says about enforcement: deleting a wallet's signing key or an MCP server's credential destroys what the app acts with.

Request

2 fields.

Response

200 body — 3 fields.

Failure carries the platform error shape — see Errors.

Examples

hanzo kms secrets rm <wildcard1>

import { Configuration, KmsApi } from 'hanzoai';

const api = new KmsApi(new Configuration({ accessToken: process.env.HANZO_API_KEY }));
const { data } = await api.deleteKmsSecretsByWildcard1({ wildcard1: 'wildcard1' });

from hanzoai.cloud import ApiClient, Configuration
from hanzoai.cloud.api import KmsApi

client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"]))
result = KmsApi(client).delete_kms_secrets_by_wildcard1(wildcard1='wildcard1')

cfg := hanzoai.NewConfiguration()
cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY"))
client := hanzoai.NewAPIClient(cfg)

resp, _, err := client.KmsAPI.DeleteKmsSecretsByWildcard1(context.Background()).Execute()
if err != nil {
	return err
}

use hanzo_client::apis::{configuration::Configuration, kms_api};

let mut cfg = Configuration::new();
cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok();

let result = kms_api::delete_kms_secrets_by_wildcard1(&cfg, Default::default()).await?;

import ai.hanzo.cloud.ApiClient;
import ai.hanzo.cloud.api.KmsApi;

ApiClient client = new ApiClient();
client.setBearerToken(System.getenv("HANZO_API_KEY"));

var result = new KmsApi(client).deleteKmsSecretsByWildcard1();

curl -X DELETE https://api.hanzo.ai/v1/kms/secrets/<wildcard1> \
  -H "Authorization: Bearer $HANZO_API_KEY"

curl -X POST https://api.hanzo.ai/v1/mcp \
  -H "Content-Type: application/json" \
  -d '{
       "jsonrpc": "2.0",
       "id": 1,
       "method": "tools/call",
       "params": {
         "name": "describe",
         "arguments": {
           "op": "get_kms_config"
         }
       }
     }'

KMS API · All Hanzo APIs · Interactive reference