---
title: "Retire Secret"
method: DELETE
path: "/api/v1/vault/secrets/by-alias/{alias}"
tags: ["vault"]
---

# Retire Secret

`DELETE /api/v1/vault/secrets/by-alias/{alias}`

## Request

- Base URL: `https://core.mnemoverse.com`
- URL: `https://core.mnemoverse.com/api/v1/vault/secrets/by-alias/{alias}`
- Auth: one of:
  - API key in header `X-Api-Key`
  - HTTP bearer

Retire the caller's ACTIVE secret with this alias (Vault step 5, 2026-10-10, owner
decisions: the stored value is overwritten at once, the name becomes free, the row stays
as value-free history). Storage overwrites the sealed value with a one-byte tombstone
(honest retention note: the previous bytes can persist in database history, WAL and backups for their retention period (docs/ops/runbook-erase-user-account.md); they are ciphertext the server cannot open, and no use path can address the row any more),
moves the ref to ``secret:<alias>#retired-<stamp>-<id>`` (outside the alias charset, so
no use path reaches it) and stamps ``metadata.retired_at``. The tenant comes from the
VERIFIED claims. 404 when there is no active secret with that alias; a second call is
therefore a 404 too. The list and the quota count leave retired secrets out.

## Path parameters

- `alias` string, required

## Response `200`

Successful Response

- RetireSecretResponse
  - `alias` string, required
  - `atom_id` string, required
  - `retired_at` string, date-time, required

## Other responses

- `400`: Validation error
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not found
- `422`: Validation Error
- `429`: Rate limited
- `500`: Internal server error
- `503`: Service unavailable

---

[API](https://skmtc.dev/mnemoverse/apis/mnemoverse-core.md) · [All operations](https://skmtc.dev/mnemoverse/apis/mnemoverse-core/llms.txt) · [OpenAPI document](https://skmtc.dev/mnemoverse/apis/mnemoverse-core/revisions/1f5e0048f017?raw)