---
title: "Revoke a webhook signing key"
method: DELETE
path: "/api/policy/v1/enterprises/{enterpriseId}/webhooks/keys/{keyId}"
tags: ["Webhook Keys"]
---

# Revoke a webhook signing key

`DELETE /api/policy/v1/enterprises/{enterpriseId}/webhooks/keys/{keyId}`

Revokes a webhook signing key for an enterprise. This is a soft delete — the key
row is preserved for audit purposes but marked as REVOKED.

Revoked keys cannot be used for webhook signature verification.
Revocation is irreversible — a new key must be registered to restore access.

**Key ID tombstoning:** Once a `keyId` is revoked, it is **permanently tombstoned**
for this enterprise. Attempting to register a new key under the same `keyId` will
return a 400 error, even after revocation. This is intentional security design that
prevents key-reuse attacks. Choose a stable, unique `keyId` from the start (e.g.
use a version suffix such as `my-key-v2`) so that key rotation does not require
updating secrets or configuration files that reference the `keyId`.

**Authorization:** Caller must be an admin of the specified enterprise.

## Path parameters

- `enterpriseId` string, required
- `keyId` string, required

## Headers

- `X-BitGo-OTP` string, required

## Response `200`

Key successfully revoked.

- RevokeWebhookKeyResponse — Response after successfully revoking a webhook signing key.
  - `success` boolean, required — Whether the revocation was successful.
  - `keyId` string, required — The customer-provided key identifier that was revoked.
  - `revokedAt` string, date-time, required — When the key was revoked.
  - `revokedBy` string, required — User who revoked the key.

## Other responses

- `401` — Unauthorized
- `403` — Forbidden
- `404` — The specified resource was not found
- `409` — Conflict - The request conflicts with the current state of the resource
- `500` — Server Error - Transient error please try again

---

[API](https://skmtc.net/bitgo/apis/bitgo-api.md) · [All operations](https://skmtc.net/bitgo/apis/bitgo-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/bitgo/bitgo-api/revisions/e445c15e5bee/schema)