FIfireblocks
Webhooks V2

Delete OAuth credentials

Deletes an OAuth credential set. By default the delete is refused while the credentials are still in use: if any webhook references them, nothing is deleted and the request fails with 409 Conflict, naming the reason and listing the ids of the referencing webhooks. This protects a shared credential set from being removed out from under the webhooks that depend on it, since several webhooks may reference the same one.

Pass forceDelete=true to delete anyway. That detaches every referencing webhook — it clears each webhook's webhookOauthId, it does not delete the webhook — then deletes the credential set and returns the deleted resource together with detachedWebhookIds. The detached webhooks keep delivering notifications, but without an Authorization header, so their endpoints will see unauthenticated deliveries from that point on.

When nothing references the credentials the delete succeeds either way, and detachedWebhookIds comes back empty.

Endpoint Permissions: Owner, Admin, Non-Signing Admin.

delete/webhooks_settings/oauth/{webhookOauthId}

Request

Path parameters

webhookOauthIdstring uuid required
Example:44fcead0-7053-4831-a53a-df7fb90d440f

The unique identifier of the OAuth credentials

Query parameters

forceDeleteboolean

Delete the credentials even while webhooks still reference them, detaching those webhooks instead of refusing. Leave it unset, or false, to get a 409 Conflict whenever anything still references the credentials.

Response

The deleted OAuth credentials, plus the ids of any webhooks that were detached from them

idstring uuid required

The id of the OAuth credentials. Pass this as a webhook's webhookOauthId to attach them.

namestring required

The label given to this credential set.

clientIdstring required

OAuth client ID used to authenticate with the token endpoint.

urlstring required

Token endpoint URL.

authMethodstring required

How the client credentials are presented to the token endpoint: client_secret_basic, client_secret_post or client_secret_jwt. Credentials created without this field report client_secret_basic, which is what they use.

customJwtClaimsstring[]

Names of the additional claims placed in the JWT assertion. Claim values are write-only and are never returned. Absent when no custom claims are configured.

customBodyParamsstring[]

Names of the additional parameters added to the token request body. Parameter values are write-only and are never returned. Absent when no custom parameters are configured.

customHeadersstring[]

Names of the additional HTTP headers added to the token request sent to the authorization server — not to the webhook delivery, which has its own separate customHeaders. Header values are write-only and are never returned. Absent when no custom headers are configured.

webhookMtlsIdstring uuid

The id of the mTLS configuration presented to the token endpoint. Absent when the token request does not use mTLS. Read the certificate from /v1/webhooks_settings/mtls/{id}.

createdAtinteger required

The date and time the OAuth credentials were created, in milliseconds.

updatedAtinteger required

The date and time the OAuth credentials were last updated, in milliseconds.

detachedWebhookIdsstring[] required

Webhooks whose webhookOauthId was cleared. The webhooks themselves are not deleted and keep delivering, just without an Authorization header. Empty unless forceDelete=true detached something.

Example response

{
  "id": "123e4567-e89b-12d3-a456-426614174000",
  "name": "Production treasury gateway",
  "clientId": "my-client-id",
  "url": "https://auth.example.com/oauth/token",
  "authMethod": "client_secret_basic",
  "customJwtClaims": [
    "aud",
    "resource"
  ],
  "customBodyParams": [
    "scope"
  ],
  "customHeaders": [
    "X-Api-Key"
  ],
  "webhookMtlsId": "6f1b7c62-0f2e-4f1a-9a5e-9f2b1c3d4e5f",
  "createdAt": 1625097600000,
  "updatedAt": 1625097600000,
  "detachedWebhookIds": [
    "44fcead0-7053-4831-a53a-df7fb90d440f"
  ]
}

Changes

No recorded changes to this operation across all 1 revision of this API.