DEL

Revoke a webhook signing key

Revokes a webhook signing key for an enterprise. This is a soft delete — the key row is preserved for audit purposes but marked as REVOKED.

Revoked keys cannot be used for webhook signature verification. Revocation is irreversible — a new key must be registered to restore access.

Key ID tombstoning: Once a keyId is revoked, it is permanently tombstoned for this enterprise. Attempting to register a new key under the same keyId will return a 400 error, even after revocation. This is intentional security design that prevents key-reuse attacks. Choose a stable, unique keyId from the start (e.g. use a version suffix such as my-key-v2) so that key rotation does not require updating secrets or configuration files that reference the keyId.

Authorization: Caller must be an admin of the specified enterprise.

Path Params

enterpriseId string required

The enterprise ID.
keyId string required

The customer-provided key identifier.

Header Params

X-BitGo-OTP string required

OTP code for verification. Required for webhook key management operations.

Responses

200

Key successfully revoked.

Response Body

object

Response after successfully revoking a webhook signing key.

success boolean required

Whether the revocation was successful.
keyId string required

The customer-provided key identifier that was revoked.
revokedAt string date-time required

When the key was revoked.
revokedBy string required

User who revoked the key.

401

Unauthorized

Response Body

object

code string
message string
status integer

403

Forbidden

Response Body

object

code string
message string
status integer

404

The specified resource was not found

Response Body

object

code string
message string
status integer

409

Conflict - The request conflicts with the current state of the resource

Response Body

object

code string
message string
status integer

500

Server Error - Transient error please try again

Response Body

object

code string
message string
status integer

curl --request DELETE \ --url 'https://app.bitgo-test.com/api/policy/v1/enterprises/enterpriseId/webhooks/keys/keyId' \ --header 'accept: application/json' \ --header 'Authorization: Bearer YOUR_ACCESS_TOKEN' \ --header 'X-BitGo-OTP: string'

const url = 'https://app.bitgo-test.com/api/policy/v1/enterprises/enterpriseId/webhooks/keys/keyId'; const options = {method: 'DELETE', headers: {accept: 'application/json', 'Authorization': 'Bearer YOUR_ACCESS_TOKEN', 'X-BitGo-OTP': 'string'}}; fetch(url, options) .then(res => res.json()) .then(json => console.log(json)) .catch(err => console.error(err));

require 'uri' require 'net/http' url = URI("https://app.bitgo-test.com/api/policy/v1/enterprises/enterpriseId/webhooks/keys/keyId") http = Net::HTTP.new(url.host, url.port) http.use_ssl = true request = Net::HTTP::Delete.new(url) request["accept"] = 'application/json' request["Authorization"] = 'Bearer YOUR_ACCESS_TOKEN' request["X-BitGo-OTP"] = 'string' response = http.request(request) puts response.read_body

<?php require_once('vendor/autoload.php'); $client = new \GuzzleHttp\Client(); $response = $client->request('DELETE', 'https://app.bitgo-test.com/api/policy/v1/enterprises/enterpriseId/webhooks/keys/keyId', [ 'headers' => [ 'accept' => 'application/json', 'Authorization' => 'Bearer YOUR_ACCESS_TOKEN', 'X-BitGo-OTP' => 'string', ], ]); echo $response->getBody();

import requests url = "https://app.bitgo-test.com/api/policy/v1/enterprises/enterpriseId/webhooks/keys/keyId" headers = { "accept": "application/json", "Authorization": "Bearer YOUR_ACCESS_TOKEN", "X-BitGo-OTP": "string" } response = requests.delete(url, headers=headers) print(response.text)