---
title: "Soft-delete a tool"
method: POST
path: "/tools/{name}/deprecate"
tags: ["Tools"]
---

# Soft-delete a tool

`POST /tools/{name}/deprecate`

## Request

- Base URL: `https://api.mnemom.ai/v1`
- URL: `https://api.mnemom.ai/v1/tools/{name}/deprecate`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-Mnemom-Api-Key`

**Authorization: platform admin only.** Allowed callers: a Mnemom staff session (JWT or cookie whose role is `mnemom_staff`), or an API key carrying the `admin:platform` scope whose owner is re-verified as Mnemom staff on every request. Everyone else gets 403 `Admin access required` — that includes org owners and org admins of any tenant, ordinary users, and API keys without `admin:platform` (or whose owner is no longer staff). The `BearerAuth` / `ApiKeyAuth` schemes say how the caller authenticates, not who is allowed; the platform-admin check runs before the body is read, so a non-admin never reaches validation. An unauthenticated call gets 401.

Sets deprecated_at to the current time. Idempotent: re-deprecating an already-deprecated tool returns the existing row without an UPDATE. Idempotency-Key required (400 when absent; 409 while a request with the same key is still in flight; 422 when the key was already used for a different request).

## Headers

- `Idempotency-Key` string, required

## Response `200`

Tool marked deprecated (or already deprecated).

- object
  - `name` string, required: Globally unique tool name. Convention: `<connector>_<verb>_<noun>` (e.g. `campfire_create_chart_account`). Org-scoped tools use the reserved `org:<id>:` prefix.
  - `display_name` string, nullable
  - `description` string, nullable
  - `class` 'read' | 'internal_write' | 'consequential_internal_write' | 'consequential_external_write' | 'comms_internal' | 'comms_external' | 'engineering_attestation' | 'governance_write', required: 8-entry action class taxonomy per mnemom-contracts/tool-manifest/v1.yaml. V7 gateway hooks bind on this for class-scoped enforcement.
  - `domain` 'financial' | 'engineering' | 'intelligence' | 'growth' | 'operations' | 'governance' | 'comms' | 'identity' | 'security', required: 9-entry domain taxonomy. Used by domain-scoped value declarations like policy_attentiveness(domain: financial).
  - `schema` object, nullable: OpenAPI fragment / JSON Schema for the tool parameters. Populated when the tool is imported via OpenAPI spec.
  - `source_connector` string, nullable
  - `deprecated_at` string, date-time, nullable
  - `content_hash` string, nullable
  - `version` integer, required
  - `created_at` string, date-time, required
  - `updated_at` string, date-time, required

## Other responses

- `400`: Bad request
- `401`: Authentication required
- `403`: The caller is authenticated but is not a platform admin (Mnemom staff, or an `admin:platform` API key whose owner is still staff). Returned to every other caller, whatever their role in any org.
- `404`: Resource not found
- `409`: Resource conflict — the request cannot proceed because of a current state conflict (e.g., resource already exists, version mismatch, in-flight idempotency key with a different body).
- `422`: Request was well-formed but semantically invalid (e.g., business-rule validation failure, malformed YAML inside a JSON payload).
- `429`: Rate-limit exceeded. The global per-IP limiter (100 requests/minute, applied to every `/v1/*` route) rejected this request. Back off until the window resets — `Retry-After` carries the cooldown in seconds and `X-RateLimit-Reset` the absolute reset time.
- `500`: Server error — request was well-formed but the server failed to fulfill it. Typically a downstream dependency (DB / RPC / external API) returned an unexpected error.

---

[API](https://skmtc.dev/mnemom/apis/mnemom-api.md) · [All operations](https://skmtc.dev/mnemom/apis/mnemom-api/llms.txt) · [OpenAPI document](https://skmtc.dev/mnemom/apis/mnemom-api/revisions/274b7a6ea182?raw)