---
title: "DELETE /api/v1/pki/ca/internal/{caName}"
method: DELETE
path: "/api/v1/pki/ca/internal/{caName}"
tags: ["PKI Certificate Authorities"]
---

# DELETE /api/v1/pki/ca/internal/{caName}

`DELETE /api/v1/pki/ca/internal/{caName}`

## Path parameters

- `caName` string, required

## Request body

- object
  - `projectId` string, uuid, required

## Response `200`

Default Response

- object
  - `projectId` string, required
  - `enableDirectIssuance` boolean
  - `name` string, required
  - `id` string, uuid, required
  - `status` 'active' | 'disabled' | 'pending-certificate', required
  - `type` 'internal', required
  - `configuration` object, required
    - `type` 'root' | 'intermediate', required — The type of CA to create.
    - `friendlyName` string — A friendly name for the CA.
    - `commonName` string — The common name (CN) for the CA.
    - `organization` string — The organization (O) for the CA.
    - `ou` string — The organization unit (OU) for the CA.
    - `country` string — The country name (C) for the CA.
    - `province` string — The state of province name for the CA.
    - `locality` string — The locality name for the CA.
    - `notBefore` string — The date and time when the CA becomes valid in YYYY-MM-DDTHH:mm:ss.sssZ format.
    - `notAfter` string — The date and time when the CA expires in YYYY-MM-DDTHH:mm:ss.sssZ format.
    - `maxPathLength` number, nullable — The maximum number of intermediate CAs that may follow this CA in the certificate / CA chain. A maxPathLength of -1 implies no path limit on the chain.
    - `keyAlgorithm` 'RSA_2048' | 'RSA_3072' | 'RSA_4096' | 'EC_prime256v1' | 'EC_secp384r1' | 'EC_secp521r1' | 'ML-DSA-44' | 'ML-DSA-65' | 'ML-DSA-87' | 'SLH-DSA-SHA2-128f' | 'SLH-DSA-SHA2-128s' | 'SLH-DSA-SHA2-192f' | 'SLH-DSA-SHA2-192s' | 'SLH-DSA-SHA2-256f' | 'SLH-DSA-SHA2-256s' | 'SLH-DSA-SHAKE-128f' | 'SLH-DSA-SHAKE-128s' | 'SLH-DSA-SHAKE-192f' | 'SLH-DSA-SHAKE-192s' | 'SLH-DSA-SHAKE-256f' | 'SLH-DSA-SHAKE-256s', required — The type of public key algorithm and size, in bits, of the key pair for the CA; when you create an intermediate CA, you must use a key algorithm supported by the parent CA.
    - `keySource` 'infisical' | 'hsm' — Where the CA's signing key is generated and stored. 'infisical' keeps the key in Infisical's KMS; 'hsm' generates and stores the key in the HSM reached through the specified HSM Connector.
    - `hsmConnectorId` string, uuid — The ID of the HSM Connector to generate and store the CA's signing key in. Required when keySource is 'hsm'.
    - `hsmKeyLabel` string — The label of the CA's signing key on the HSM. Not user-supplied: it is the HSM Connector's configured key name prefix followed by a per-CA label built from the CA name and a random 5-character suffix (ca-<name>-<slug>).
    - `dn` string, nullable
    - `parentCaId` string, uuid, nullable
    - `serialNumber` string, nullable
    - `activeCaCertId` string, uuid, nullable
    - `crlDistributionPointUrls` string[] — Additional CRL Distribution Point URLs (HTTP/HTTPS) embedded in every certificate issued by this CA. Up to 4 URLs; the Infisical-managed CRL endpoint is included by default unless disabled.
    - `disableManagedCrlDistributionPointUrl` boolean — When set to true, the Infisical-managed CRL endpoint URL will not be embedded in certificates issued by this CA. Only custom CRL Distribution Point URLs (if any) will be included.

## Other responses

- `400` — Default Response
- `401` — Default Response
- `403` — Default Response
- `404` — Default Response
- `422` — Default Response
- `500` — Default Response

---

[API](https://skmtc.net/infisical/apis/infisical-api.md) · [All operations](https://skmtc.net/infisical/apis/infisical-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/infisical/infisical-api/versions/f10a4f8c1d41/schema)