---
title: "Remove one wrap"
method: DELETE
path: "/v1/keys/{key_id}/client-share/{share_id}"
tags: ["Key Custody"]
---

# Remove one wrap

`DELETE /v1/keys/{key_id}/client-share/{share_id}`

## Request

- Base URL: `https://api.1claw.co`
- URL: `https://api.1claw.co/v1/keys/{key_id}/client-share/{share_id}`
- Auth: HTTP bearer

Deletes a single wrap. Wraps tied to a passkey are also removed when
that passkey is deleted. Removing the last wrap of a `client_tss` key
makes the key unrecoverable — the vault holds only its own share.

Owner only, and needs `X-Auth-Confirm`: a single-use re-auth token
from `POST /v1/auth/reauth/complete` with purpose `tss.key.wrap_delete`,
or the account password. Strong factor: once a passkey (usable on this
domain) or TOTP is enrolled, the confirmation must use one of them and
a password is refused. Audited `client_share.deleted`.

## Headers

- `X-Auth-Confirm` string, required

## Response `204`

Wrap removed

## Other responses

- `400`: Invalid request
- `401`: Authentication required or invalid
- `403`: Insufficient permissions
- `404`: Resource not found

---

[API](https://skmtc.dev/1claw/apis/1claw-api.md) · [All operations](https://skmtc.dev/1claw/apis/1claw-api/llms.txt) · [OpenAPI document](https://skmtc.dev/1claw/apis/1claw-api/revisions/5fa0918f3b41?raw)