# Delete a secret

## `DELETE /v1/projects/{projectId}/secrets/{secretName}`

Permanently deletes a secret by name.

### Path parameters

- `projectId` (integer, required): The ID of the project
- `secretName` (string, required): The name of the secret

### Header parameters

- `Authorization` (string, required): `Bearer <token>`. [Authentication](https://spice.ai/docs/cloud/api/management#authentication) lists the tokens it accepts.
- `X-Org-Name` (string, optional): The organization to act on, by handle. Omit it to act on the organization the credential is bound to; sending it blank is a 400, not the same as omitting it. A user credential may name any organization its owner belongs to; a machine credential is pinned to its own. A portal session token is bound to none, so it must send this header on every route but `GET /v1/orgs` (400 `org_assertion_required` otherwise). Pattern: `^[A-Za-z0-9._-]{1,255}$`.

### Example request

```bash
curl -X DELETE "https://api.spice.ai/v1/projects/<projectId>/secrets/<secretName>" \
  -H "Authorization: Bearer <token>"
```

```http
DELETE /v1/projects/<projectId>/secrets/<secretName> HTTP/1.1
Host: api.spice.ai
Authorization: Bearer <token>
```

### Responses

**204 No Content**

Secret deleted successfully

**400 Bad Request**

Invalid project ID

**401 Unauthorized**

Unauthorized

**403 Forbidden**

Insufficient scope

**404 Not Found**

Project or secret not found

**500 Internal Server Error**

Internal server error

## `DELETE /v1/orgs/{orgId}/projects/{projectId}/secrets/{secretName}`

The org is `orgId` in the path. Permanently deletes a secret by name.

### Path parameters

- `orgId` (integer, required): The org id from GET /v1/orgs. Minimum: `1`.
- `projectId` (integer, required): The ID of the project
- `secretName` (string, required): The name of the secret

### Header parameters

- `Authorization` (string, required): `Bearer <token>`. [Authentication](https://spice.ai/docs/cloud/api/management#authentication) lists the tokens it accepts.
- `X-Org-Name` (string, optional): When present, X-Org-Name must name the same org as orgId. Otherwise the request returns org\_path\_mismatch (400). Pattern: `^[A-Za-z0-9._-]{1,255}$`.

### Example request

```bash
curl -X DELETE "https://api.spice.ai/v1/orgs/<orgId>/projects/<projectId>/secrets/<secretName>" \
  -H "Authorization: Bearer <token>"
```

```http
DELETE /v1/orgs/<orgId>/projects/<projectId>/secrets/<secretName> HTTP/1.1
Host: api.spice.ai
Authorization: Bearer <token>
```

### Responses

**204 No Content**

Secret deleted successfully

**400 Bad Request**

Invalid project ID. orgId is not a valid org id (`invalid_org_id`), or X-Org-Name does not name that org (`org_path_mismatch`).

**401 Unauthorized**

Unauthorized

**403 Forbidden**

Insufficient scope. The caller is not a member of the org (`org_forbidden`). A machine credential named a different org (`org_assertion_mismatch`). The org is deleted (`org_deleted`).

**404 Not Found**

Project or secret not found

**500 Internal Server Error**

Internal server error

## `DELETE /v1/apps/{appId}/secrets/{secretName}` (deprecated)

Legacy alias of `/v1/projects/{projectId}/secrets/{secretName}` — projects were previously called apps. Permanently deletes a secret by name.

### Path parameters

- `appId` (integer, required): The ID of the project
- `secretName` (string, required): The name of the secret

### Header parameters

- `Authorization` (string, required): `Bearer <token>`. [Authentication](https://spice.ai/docs/cloud/api/management#authentication) lists the tokens it accepts.
- `X-Org-Name` (string, optional): The organization to act on, by handle. Omit it to act on the organization the credential is bound to; sending it blank is a 400, not the same as omitting it. A user credential may name any organization its owner belongs to; a machine credential is pinned to its own. A portal session token is bound to none, so it must send this header on every route but `GET /v1/orgs` (400 `org_assertion_required` otherwise). Pattern: `^[A-Za-z0-9._-]{1,255}$`.

### Example request

```bash
curl -X DELETE "https://api.spice.ai/v1/apps/<appId>/secrets/<secretName>" \
  -H "Authorization: Bearer <token>"
```

```http
DELETE /v1/apps/<appId>/secrets/<secretName> HTTP/1.1
Host: api.spice.ai
Authorization: Bearer <token>
```

### Responses

**204 No Content**

Secret deleted successfully

**400 Bad Request**

Invalid project ID

**401 Unauthorized**

Unauthorized

**403 Forbidden**

Insufficient scope

**404 Not Found**

Project or secret not found

**500 Internal Server Error**

Internal server error

OpenAPI: [api.spice.ai/openapi.json](https://api.spice.ai/openapi.json)