---
title: "DELETE /2013-04-01/keysigningkey/{HostedZoneId}/{Name}"
method: DELETE
path: "/2013-04-01/keysigningkey/{HostedZoneId}/{Name}"
---

# DELETE /2013-04-01/keysigningkey/{HostedZoneId}/{Name}

`DELETE /2013-04-01/keysigningkey/{HostedZoneId}/{Name}`

Deletes a key-signing key (KSK). Before you can delete a KSK, you must deactivate it. The KSK must be deactivated before you can delete it regardless of whether the hosted zone is enabled for DNSSEC signing.

You can use [DeactivateKeySigningKey](https://docs.aws.amazon.com/Route53/latest/APIReference/API_DeactivateKeySigningKey.html) to deactivate the key before you delete it.

Use [GetDNSSEC](https://docs.aws.amazon.com/Route53/latest/APIReference/API_GetDNSSEC.html) to verify that the KSK is in an `INACTIVE` status.

## Path parameters

- `HostedZoneId` string, required
- `Name` string, required

## Response `200`

Success

## Other responses

- `480` — ConcurrentModification
- `481` — NoSuchKeySigningKey
- `482` — InvalidKeySigningKeyStatus
- `483` — InvalidSigningStatus
- `484` — InvalidKMSArn
- `485` — InvalidInput

---

[API](https://skmtc.net/aws/apis/route53.md) · [All operations](https://skmtc.net/aws/apis/route53/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/aws/route53/versions/8f06f4790bfa/schema)