---
title: "Delete OAuth credentials"
method: DELETE
path: "/webhooks_settings/oauth/{webhookOauthId}"
tags: ["Webhooks V2"]
---

# Delete OAuth credentials

`DELETE /webhooks_settings/oauth/{webhookOauthId}`

## Request

- Base URL: `https://api.fireblocks.io/v1`
- URL: `https://api.fireblocks.io/v1/webhooks_settings/oauth/{webhookOauthId}`
- Auth: none declared
- TypeScript: <https://skmtc.dev/fireblocks/apis/fireblocks-api/docs/webhooks_settings/oauth/:webhookOauthId/delete.ts> (a function with typed inputs; its response is checked against the schema)

Deletes an OAuth credential set. By default the delete is refused while the credentials are still in use: if any webhook references them, nothing is deleted and the request fails with `409 Conflict`, naming the reason and listing the ids of the referencing webhooks. This protects a shared credential set from being removed out from under the webhooks that depend on it, since several webhooks may reference the same one.

Pass `forceDelete=true` to delete anyway. That detaches every referencing webhook — it clears each webhook's `webhookOauthId`, it does **not** delete the webhook — then deletes the credential set and returns the deleted resource together with `detachedWebhookIds`. The detached webhooks keep delivering notifications, but without an `Authorization` header, so their endpoints will see unauthenticated deliveries from that point on.

When nothing references the credentials the delete succeeds either way, and `detachedWebhookIds` comes back empty.

**Endpoint Permissions:** Owner, Admin, Non-Signing Admin.

## Path parameters

- `webhookOauthId` string, uuid, required

## Query parameters

- `forceDelete` boolean

## Response `200`

The deleted OAuth credentials, plus the ids of any webhooks that were detached from them

- DeleteWebhookOauthResponse: A stored OAuth 2.0 client credential set, referenced by webhooks through their `webhookOauthId`. Deliveries for a webhook that references one carry `Authorization: Bearer {token}`, using a token fetched from `url` and cached until it expires, so your authorization server sees far fewer token requests than deliveries. Secret material is never returned: `clientSecret` is absent from this schema entirely, and the `customJwtClaims`, `customBodyParams` and `customHeaders` fields are reduced to their names, without the configured values.
  - `id` string, uuid, required: The id of the OAuth credentials. Pass this as a webhook's `webhookOauthId` to attach them.
  - `name` string, required: The label given to this credential set.
  - `clientId` string, required: OAuth client ID used to authenticate with the token endpoint.
  - `url` string, required: Token endpoint URL.
  - `authMethod` string, required: How the client credentials are presented to the token endpoint: `client_secret_basic`, `client_secret_post` or `client_secret_jwt`. Credentials created without this field report `client_secret_basic`, which is what they use.
  - `customJwtClaims` string[]: Names of the additional claims placed in the JWT assertion. Claim values are write-only and are never returned. Absent when no custom claims are configured.
  - `customBodyParams` string[]: Names of the additional parameters added to the token request body. Parameter values are write-only and are never returned. Absent when no custom parameters are configured.
  - `customHeaders` string[]: Names of the additional HTTP headers added to **the token request sent to the authorization server** — not to the webhook delivery, which has its own separate `customHeaders`. Header values are write-only and are never returned. Absent when no custom headers are configured.
  - `webhookMtlsId` string, uuid: The id of the mTLS configuration presented to the token endpoint. Absent when the token request does not use mTLS. Read the certificate from `/v1/webhooks_settings/mtls/{id}`.
  - `createdAt` integer, required: The date and time the OAuth credentials were created, in milliseconds.
  - `updatedAt` integer, required: The date and time the OAuth credentials were last updated, in milliseconds.
  - `detachedWebhookIds` string[], required: Webhooks whose `webhookOauthId` was cleared. The webhooks themselves are not deleted and keep delivering, just without an `Authorization` header. Empty unless `forceDelete=true` detached something.

## Other responses

- `409`: Webhooks still reference these credentials and `forceDelete` was not set. Nothing was deleted. The error message names the reason and the ids of the referencing webhooks — detach or delete those webhooks, or retry with `forceDelete=true`.
- `default`: Error Response

---

[API](https://skmtc.dev/fireblocks/apis/fireblocks-api.md) - [All operations](https://skmtc.dev/fireblocks/apis/fireblocks-api/llms.txt) - [OpenAPI document](https://skmtc.dev/fireblocks/apis/fireblocks-api/revisions/4eba9965659a?raw)