Sign in
latestOpenAPI 3.0.32026-08-224982,0272.8 MB

e445c15e5bee

Webhook Keys

Revoke a webhook signing key

Revokes a webhook signing key for an enterprise. This is a soft delete — the key row is preserved for audit purposes but marked as REVOKED.

Revoked keys cannot be used for webhook signature verification. Revocation is irreversible — a new key must be registered to restore access.

Key ID tombstoning: Once a keyId is revoked, it is permanently tombstoned for this enterprise. Attempting to register a new key under the same keyId will return a 400 error, even after revocation. This is intentional security design that prevents key-reuse attacks. Choose a stable, unique keyId from the start (e.g. use a version suffix such as my-key-v2) so that key rotation does not require updating secrets or configuration files that reference the keyId.

Authorization: Caller must be an admin of the specified enterprise.

delete/api/policy/v1/enterprises/{enterpriseId}/webhooks/keys/{keyId}

Path parameters

enterpriseIdstring required

The enterprise ID.

keyIdstring required

The customer-provided key identifier.

Headers

X-BitGo-OTPstring required

OTP code for verification. Required for webhook key management operations.

Response

Key successfully revoked.

successboolean required

Whether the revocation was successful.

keyIdstring required

The customer-provided key identifier that was revoked.

revokedAtstring date-time required

When the key was revoked.

revokedBystring required

User who revoked the key.

Example response

{
  "success": true,
  "keyId": "customer-prod-key-2026",
  "revokedAt": "2026-01-12T15:00:00.000Z",
  "revokedBy": "admin@example.com"
}