---
title: "Delete a Certificate Authority"
method: DELETE
path: "/iam/v2/certificate-authorities/{id}"
tags: ["Certificate Authorities (iam/v2)"]
---

# Delete a Certificate Authority

`DELETE /iam/v2/certificate-authorities/{id}`

[![General Availability](https://img.shields.io/badge/Lifecycle%20Stage-General%20Availability-%2345c6e8)](#section/Versioning/API-Lifecycle-Policy)

Make a request to delete a certificate authority.

## Path parameters

- `id` string, required

## Response `200`

A Certificate Authority is being deleted.

- object — `CertificateAuthority` objects represent signing certificate authorities in Confluent Cloud. The API allows you to list, create, read, update, and delete your Certificate Authority.
  - `api_version` 'iam/v2', required — APIVersion defines the schema version of this representation of a resource.
  - `kind` 'CertificateAuthority', required — Kind defines the object this REST resource represents.
  - `id` string, required — ID is the "natural identifier" for an object within its scope/namespace; it is normally unique across time but not space. That is, you can assume that the ID will not be reclaimed and reused after an object is deleted ("time"); however, it may collide with IDs for other object `kinds` or objects of the same `kind` within a different scope/namespace ("space").
  - `metadata` object — ObjectMeta is metadata that all persisted resources must have, which includes all objects users must create.
    - `self` string, uri, required — Self is a Uniform Resource Locator (URL) at which an object can be addressed. This URL encodes the service location, API version, and other particulars necessary to locate the resource at a point in time
    - `resource_name` string, uri — Resource Name is a Uniform Resource Identifier (URI) that is globally unique across space and time. It is represented as a Confluent Resource Name
    - `created_at` string, date-time — The date and time at which this object was created. It is represented in RFC3339 format and is in UTC.
    - `updated_at` string, date-time — The date and time at which this object was last updated. It is represented in RFC3339 format and is in UTC.
    - `deleted_at` string, date-time — The date and time at which this object was (or will be) deleted. It is represented in RFC3339 format and is in UTC.
  - `display_name` string, required — The human-readable name of the certificate authority.
  - `description` string, required — A description of the certificate authority.
  - `fingerprints` string[], required — The fingerprints for each certificate in the certificate chain. These are SHA-1 encoded strings that act as unique identifiers for the certificates in the chain.
  - `expiration_dates` string[], required — The expiration dates of certificates in the chain.
  - `serial_numbers` string[], required — The serial numbers for each certificate in the certificate chain.
  - `certificate_chain_filename` string, required — The file name of the uploaded pem file for this certificate authority.
  - `crl_source` string — The source specifies whether the Certificate Revocation List (CRL) is updated from either local file uploaded (LOCAL) or from url of CRL (URL).
  - `crl_url` string, uri — The url from which to fetch the CRL for the certificate authority if crl_source is URL.
  - `crl_updated_at` string, date-time — The timestamp for when CRL was last updated.
  - `state` string, required — The current state of the certificate authority.
  - `require_crl_on_client_certificate` boolean, required — Whether to require CRL validation on client certificates. If `require_crl_on_client_certificate` is true, then a CRL must be configured. At time of mTLS auth, if the client certificate is revoked in the CRL or the client issuer does not match the CRL issuer, certificate verification will fail even if TLS handshake is successful (OpenSSL -crl_check default behavior). If `require_crl_on_client_certificate` is false, this mTLS identity provider cannot configure a new CRL.

## Other responses

- `400` — Bad Request
- `401` — The request lacks valid authentication credentials for this resource.
- `403` — The access credentials were considered insufficient to grant access
- `404` — Not Found
- `429` — Rate Limit Exceeded
- `500` — Oops, something went wrong!

---

[API](https://skmtc.dev/confluent/apis/confluent-cloud-apis.md) · [All operations](https://skmtc.dev/confluent/apis/confluent-cloud-apis/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/confluent/confluent-cloud-apis/revisions/a6a73f98a698/schema)