---
title: "Delete an mTLS configuration"
method: DELETE
path: "/webhooks_settings/mtls/{webhookMtlsId}"
tags: ["Webhooks V2"]
---

# Delete an mTLS configuration

`DELETE /webhooks_settings/mtls/{webhookMtlsId}`

## Request

- Base URL: `https://api.fireblocks.io/v1`
- URL: `https://api.fireblocks.io/v1/webhooks_settings/mtls/{webhookMtlsId}`
- Auth: none declared
- TypeScript: <https://skmtc.dev/fireblocks/apis/fireblocks-api/docs/webhooks_settings/mtls/:webhookMtlsId/delete.ts> (a function with typed inputs; its response is checked against the schema)

Deletes an mTLS configuration. By default the delete is refused while the configuration is still in use: if any webhook or OAuth credentials reference it, nothing is deleted and the request fails with `409 Conflict`, naming the reason and listing the ids of what references it. This protects a shared configuration from being removed out from under the webhooks and token requests that depend on it.

Pass `forceDelete=true` to delete anyway. That detaches everything referencing it — it clears `webhookMtlsId` on each webhook and OAuth credentials, it does **not** delete them — then deletes the configuration and returns the deleted resource together with `detachedWebhookIds` and `detachedWebhookOauthIds`. Detached webhooks keep delivering notifications, and detached OAuth credentials keep requesting tokens, but without a client certificate, so an endpoint that requires mTLS will reject them from that point on.

When nothing references the configuration the delete succeeds either way, and both lists come back empty.

**Endpoint Permissions:** Owner, Admin, Non-Signing Admin.

## Path parameters

- `webhookMtlsId` string, uuid, required

## Query parameters

- `forceDelete` boolean

## Response `200`

The deleted mTLS configuration, plus the ids of any webhooks and OAuth credentials that were detached from it

- DeleteWebhookMtlsConfigResponse: A signed client certificate stored for the workspace, and the id a webhook or OAuth credentials set references to use it. Several of them may share one configuration, so replacing the certificate here switches all of them at once.
  - `id` string, uuid, required: The unique identifier of the mTLS configuration, to be set as `webhookMtlsId` on a webhook or on OAuth credentials.
  - `name` string: The label given to this mTLS configuration.
  - `signedCert` string, required: The signed client certificate PEM.
  - `expiresAt` integer, required: When the certificate itself expires, in milliseconds since the epoch.
  - `createdAt` integer, required: When the certificate was uploaded, in milliseconds since the epoch.
  - `updatedAt` integer, required: When this configuration was last changed, in milliseconds since the epoch. Differs from createdAt once the certificate has been replaced or the configuration renamed.
  - `detachedWebhookIds` string[], required: Webhooks whose `webhookMtlsId` was cleared. The webhooks themselves are not deleted and keep delivering, just without a client certificate. Empty unless `forceDelete=true` detached something.
  - `detachedWebhookOauthIds` string[], required: OAuth credentials whose `webhookMtlsId` was cleared. Their token requests continue without a client certificate. Empty unless `forceDelete=true` detached something.

## Other responses

- `409`: Webhooks or OAuth credentials still reference this configuration and `forceDelete` was not set. Nothing was deleted. The error message names the reason and the ids of what references it — detach those webhooks and OAuth credentials, or retry with `forceDelete=true`.
- `default`: Error Response

---

[API](https://skmtc.dev/fireblocks/apis/fireblocks-api.md) - [All operations](https://skmtc.dev/fireblocks/apis/fireblocks-api/llms.txt) - [OpenAPI document](https://skmtc.dev/fireblocks/apis/fireblocks-api/revisions/4eba9965659a?raw)