---
title: "Delete Secret"
method: DELETE
path: "/api/v1/config/secrets/{name}"
tags: ["secrets"]
---

# Delete Secret

`DELETE /api/v1/config/secrets/{name}`

## Request

- Base URL: `https://memory.kagura-ai.com` (the document declares no server; this is the origin it was published from)
- URL: `https://memory.kagura-ai.com/api/v1/config/secrets/{name}`
- Auth: none declared

Owner-only hard-delete of a secret + its versions/grants (#1153).

Delete is **cleanup, not a security control**: it removes superseded
ciphertext at rest but does NOT un-share a value a recipient already fetched,
nor rotate the still-live upstream credential. Rotate the upstream key first,
then delete (the UI confirmation warns about this). A ``delete`` entry is
appended to the tamper-evident audit chain before removal, and the audit
history of the deleted secret survives (the log is FK-decoupled), so
``audit/verify`` still passes afterwards.

``{name:path}`` so slash-containing names (e.g. ``cloudflare/api-token``) are
addressable. Owner-only mirrors the pubkey trust-gate ops (approve/revoke):
a non-owner (incl. a non-owner admin), member, or viewer is rejected 403.

## Path parameters

- `name` string, required

## Headers

- `authorization` string, nullable

## Response `204`

Successful Response

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/kagura-ai/apis/kagura-memory-cloud.md) · [All operations](https://skmtc.dev/kagura-ai/apis/kagura-memory-cloud/llms.txt) · [OpenAPI document](https://skmtc.dev/kagura-ai/apis/kagura-memory-cloud/revisions/aa9df1a21db9?raw)