# Delete secrets

URL: https://docs.hanzo.ai/docs/openapi/kms/delete-kms-secrets-by-wildcard1

> Removes one secret from your org.

`DELETE /v1/kms/secrets/{wildcard1}`

> [KMS →](https://docs.hanzo.ai/docs/openapi/kms) · [All API references →](https://docs.hanzo.ai/docs/openapi) · [Get started →](https://docs.hanzo.ai/docs/guides)

|               |                                                   |
| ------------- | ------------------------------------------------- |
| **Address**   | `https://api.hanzo.ai/v1/kms/secrets/{wildcard1}` |
| **Method**    | `DELETE`                                          |
| **Operation** | `delete_kms_secrets_by_wildcard1`                 |
| **Auth**      | `Authorization: Bearer $HANZO_API_KEY`            |

Removes one secret from your org.

Forgets one secret belonging to the caller's own org and confirms the name and
environment that were removed. Deleting a secret that is not there is a 404,
not a silent success, so a caller can tell a real deletion from a typo.

`secret` is the coordinate beneath the caller's org root, subpath and name
together, and over HTTP it is the trailing path itself. `env` selects the
environment and falls back to the default when omitted. The org comes from the
validated claim, never from the request.

A delete is a WRITE to the grant rule, like the put: destroying a secret is as
consequential as replacing it, and a credential distributed to READ one must
not be able to remove it. It opens only for SuperAdmin holding an access
token, audited, or for a holder a declared WRITE grant covers. Fail-closed
admission, in order: a validated member, well-formed org, master key present,
well-formed address, then the grant — 401/403, 400, 503, 400 and 403, all
decided before any record is touched.

A value this deployment seals on the org's behalf is removed by the app that
holds it, and never here for membership or org admin, whatever the grant
declaration says about enforcement: deleting a wallet's signing key or an MCP
server's credential destroys what the app acts with.

## Request

2 fields.

| Field       | In    | Type   | Required | Description                                                                                                                                 |
| ----------- | ----- | ------ | -------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
| `wildcard1` | path  | string | yes      | Secret is the coordinate beneath the caller's own org root: an optional `/`-separated subpath and then the name, such as `ci/deploy/token`. |
| `env`       | query | string | —        | Env selects the environment to resolve the secret in.                                                                                       |

## Response

| Status    | Body            | Meaning |
| --------- | --------------- | ------- |
| `200`     | kms.kmsRemoved  | ok      |
| `default` | problem-details | refused |

`200` body — 3 fields.

| Field     | In   | Type    | Always | Description                                         |
| --------- | ---- | ------- | ------ | --------------------------------------------------- |
| `deleted` | body | boolean | —      | Deleted is true; a delete confirms by not failing.  |
| `env`     | body | string  | —      | Env is the environment the secret was removed from. |
| `name`    | body | string  | —      | Name is the secret's name.                          |

Failure carries the platform error shape — see [Errors](https://docs.hanzo.ai/docs/errors).

## Examples

**CLI**

```bash
hanzo kms secrets rm <wildcard1>
```

**SDK**

**.ts**

```ts
import { Configuration, KmsApi } from 'hanzoai';

const api = new KmsApi(new Configuration({ accessToken: process.env.HANZO_API_KEY }));
const { data } = await api.deleteKmsSecretsByWildcard1({ wildcard1: 'wildcard1' });
```

**.py**

```python
from hanzoai.cloud import ApiClient, Configuration
from hanzoai.cloud.api import KmsApi

client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"]))
result = KmsApi(client).delete_kms_secrets_by_wildcard1(wildcard1='wildcard1')
```

**.go**

```go
cfg := hanzoai.NewConfiguration()
cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY"))
client := hanzoai.NewAPIClient(cfg)

resp, _, err := client.KmsAPI.DeleteKmsSecretsByWildcard1(context.Background()).Execute()
if err != nil {
	return err
}
```

**.rs**

```rust
use hanzo_client::apis::{configuration::Configuration, kms_api};

let mut cfg = Configuration::new();
cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok();

let result = kms_api::delete_kms_secrets_by_wildcard1(&cfg, Default::default()).await?;
```

**.java**

```java
import ai.hanzo.cloud.ApiClient;
import ai.hanzo.cloud.api.KmsApi;

ApiClient client = new ApiClient();
client.setBearerToken(System.getenv("HANZO_API_KEY"));

var result = new KmsApi(client).deleteKmsSecretsByWildcard1();
```

The method above is the one at the current release of the document. `hanzoai@8.5.914` (npm) and `hanzoai@8.5.914` (PyPI) were generated from an earlier release, where this operation carried a different id, so it spells the method differently — regenerating the clients is what makes the two agree. [SDKs →](https://docs.hanzo.ai/docs/sdks)

**HTTP**

```bash
curl -X DELETE https://api.hanzo.ai/v1/kms/secrets/<wildcard1> \
  -H "Authorization: Bearer $HANZO_API_KEY"
```

**MCP**

MCP reaches **kms** through the `kms` tool, which names its 2 operations with its own verbs — this one among them, under a name only MCP declares. `describe` explains any of them:

```bash
curl -X POST https://api.hanzo.ai/v1/mcp \
  -H "Content-Type: application/json" \
  -d '{
       "jsonrpc": "2.0",
       "id": 1,
       "method": "tools/call",
       "params": {
         "name": "describe",
         "arguments": {
           "op": "get_kms_config"
         }
       }
     }'
```

---

[KMS API](https://docs.hanzo.ai/docs/openapi/kms) · [All Hanzo APIs](https://docs.hanzo.ai/docs/openapi) · [Interactive reference](https://docs.hanzo.ai/docs/openapi/reference)