---
title: "Revoke a webhook endpoint"
method: DELETE
path: "/api/webhook-endpoints/{id}"
tags: ["Webhooks"]
---

# Revoke a webhook endpoint

`DELETE /api/webhook-endpoints/{id}`

## Request

- Base URL: `http://localhost:38200`
- URL: `http://localhost:38200/api/webhook-endpoints/{id}`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `token`

Terminal and idempotent — a revoked endpoint never matches the dispatch scan again. There is no un-revoke; register a new endpoint instead.

## Path parameters

- `id` integer, required

## Response `200`

The revoked endpoint.

- WebhookEndpoint: Never includes the encrypted signing secret at rest. `secret` is `null` except on the responses that explicitly reveal it once (create, rotate-secret).
  - `id` integer
  - `tenantId` integer
  - `url` string
  - `description` string, nullable
  - `eventTypes` LifecycleEventType[]: Empty array means "subscribed to every lifecycle event type".
  - `status` 'active' | 'paused' | 'revoked'
  - `secret` string, nullable: Populated only on create and rotate-secret responses.
  - `lastDeliveryAt` string, date-time, nullable
  - `lastDeliveryStatus` string, nullable
  - `lastDeliveryError` string, nullable
  - `createdByUserId` integer, nullable
  - `createdAt` string, date-time
  - `updatedAt` string, date-time

## Other responses

- `400`: Invalid id.
- `401`: Missing or invalid credentials.
- `403`: The caller has no resolvable tenant context.
- `404`: Resource not found (or not visible to the caller).

---

[API](https://skmtc.dev/contextq/apis/contextq-api.md) · [All operations](https://skmtc.dev/contextq/apis/contextq-api/llms.txt) · [OpenAPI document](https://skmtc.dev/contextq/apis/contextq-api/revisions/7afc44056a22?raw)