FIfireblocks
Webhooks V2

Delete an mTLS configuration

Deletes an mTLS configuration. By default the delete is refused while the configuration is still in use: if any webhook or OAuth credentials reference it, nothing is deleted and the request fails with 409 Conflict, naming the reason and listing the ids of what references it. This protects a shared configuration from being removed out from under the webhooks and token requests that depend on it.

Pass forceDelete=true to delete anyway. That detaches everything referencing it — it clears webhookMtlsId on each webhook and OAuth credentials, it does not delete them — then deletes the configuration and returns the deleted resource together with detachedWebhookIds and detachedWebhookOauthIds. Detached webhooks keep delivering notifications, and detached OAuth credentials keep requesting tokens, but without a client certificate, so an endpoint that requires mTLS will reject them from that point on.

When nothing references the configuration the delete succeeds either way, and both lists come back empty.

Endpoint Permissions: Owner, Admin, Non-Signing Admin.

delete/webhooks_settings/mtls/{webhookMtlsId}

Request

Path parameters

webhookMtlsIdstring uuid required
Example:44fcead0-7053-4831-a53a-df7fb90d440f

The unique identifier of the mTLS configuration

Query parameters

forceDeleteboolean

Delete the configuration even while webhooks or OAuth credentials still reference it, detaching them instead of refusing; their ids are returned in detachedWebhookIds and detachedWebhookOauthIds. Leave it unset, or false, to get a 409 Conflict whenever anything still references the configuration.

Response

The deleted mTLS configuration, plus the ids of any webhooks and OAuth credentials that were detached from it

idstring uuid required

The unique identifier of the mTLS configuration, to be set as webhookMtlsId on a webhook or on OAuth credentials.

namestring

The label given to this mTLS configuration.

signedCertstring required

The signed client certificate PEM.

expiresAtinteger required

When the certificate itself expires, in milliseconds since the epoch.

createdAtinteger required

When the certificate was uploaded, in milliseconds since the epoch.

updatedAtinteger required

When this configuration was last changed, in milliseconds since the epoch. Differs from createdAt once the certificate has been replaced or the configuration renamed.

detachedWebhookIdsstring[] required

Webhooks whose webhookMtlsId was cleared. The webhooks themselves are not deleted and keep delivering, just without a client certificate. Empty unless forceDelete=true detached something.

detachedWebhookOauthIdsstring[] required

OAuth credentials whose webhookMtlsId was cleared. Their token requests continue without a client certificate. Empty unless forceDelete=true detached something.

Example response

{
  "id": "44fcead0-7053-4831-a53a-df7fb90d440f",
  "name": "Production gateway 2026",
  "signedCert": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----",
  "expiresAt": 1726108200000,
  "createdAt": 1694572200000,
  "updatedAt": 1726108200000,
  "detachedWebhookIds": [
    "44fcead0-7053-4831-a53a-df7fb90d440f"
  ],
  "detachedWebhookOauthIds": [
    "6e5daa9a-56cd-4975-ac16-bb9d1b48dff5"
  ]
}

Changes

No recorded changes to this operation across all 1 revision of this API.