[{"data":1,"prerenderedAt":7},["ShallowReactive",2],{"docs-applications\u002Fapp-secrets\u002Fdelete":3,"docs-tabs-applications\u002Fapp-secrets\u002Fdelete":6},{"content":4,"lastmod":5},"## Delete a secret\n\n`DELETE \u002Fv1\u002Fapplications\u002F:id\u002Fsecrets\u002F:name`\n\nDeletes a secret name together with its stored value. A deleted value cannot be restored: set it again on the application card.\n\n## Parameters\n\n| Parameter | Type | Required | Description |\n|----------|-----|:-----:|---------|\n| `id` (path) | string | yes | Application card ID. This is not the ID of an OAuth application or a server. List: [`GET \u002Fv1\u002Fapplications`](\u002Fdocs\u002Fapplications\u002Flist) |\n| `name` (path) | string | yes | Secret name. List: [`GET \u002Fv1\u002Fapplications\u002F:id\u002Fsecrets`](\u002Fdocs\u002Fapplications\u002Fapp-secrets\u002Flist) |\n\n## Examples\n\n### curl — personal key\n\n```bash\ncurl -X DELETE https:\u002F\u002Fvibecode.bitrix24.com\u002Fv1\u002Fapplications\u002Fcmsw806qi0000tdskiw2aegii\u002Fsecrets\u002FPAYMENT_TOKEN \\\n  -H \"X-Api-Key: YOUR_API_KEY\"\n```\n\n### curl — OAuth application\n\n```bash\ncurl -X DELETE https:\u002F\u002Fvibecode.bitrix24.com\u002Fv1\u002Fapplications\u002Fcmsw806qi0000tdskiw2aegii\u002Fsecrets\u002FPAYMENT_TOKEN \\\n  -H \"X-Api-Key: YOUR_APP_KEY\" \\\n  -H \"Authorization: Bearer USER_SESSION_TOKEN\"\n```\n\n### JavaScript — personal key\n\n```javascript\nconst id = 'cmsw806qi0000tdskiw2aegii'\nconst res = await fetch(`https:\u002F\u002Fvibecode.bitrix24.com\u002Fv1\u002Fapplications\u002F${id}\u002Fsecrets\u002FPAYMENT_TOKEN`, {\n  method: 'DELETE',\n  headers: { 'X-Api-Key': 'YOUR_API_KEY' },\n})\nconst { data } = await res.json()\n\nconsole.log('New set:', data.state.desiredRevision, data.state.status)\n```\n\n### JavaScript — OAuth application\n\n```javascript\nconst id = 'cmsw806qi0000tdskiw2aegii'\nconst res = await fetch(`https:\u002F\u002Fvibecode.bitrix24.com\u002Fv1\u002Fapplications\u002F${id}\u002Fsecrets\u002FPAYMENT_TOKEN`, {\n  method: 'DELETE',\n  headers: {\n    'X-Api-Key': 'YOUR_APP_KEY',\n    'Authorization': 'Bearer USER_SESSION_TOKEN',\n  },\n})\nconst { data } = await res.json()\n```\n\n## Response fields\n\nSuccess — HTTP `200`.\n\n| Field | Type | Description |\n|------|-----|---------|\n| `success` | boolean | `true` on success |\n| `data.secret` | null | Always `null`: the name no longer exists |\n| `data.state` | object | State of applying the new set |\n| `data.state.desiredRevision` | number | Number of the current set. Deletion increases it by one |\n| `data.state.appliedRevision` | number | Number of the set the application has confirmed receiving. Catches up with `desiredRevision` once the platform confirms the restart |\n| `data.state.appliedServerId` | string \\| null | ID of the server where the set is applied. Matches `server.id` in [`GET \u002Fv1\u002Fapplications\u002F:id`](\u002Fdocs\u002Fapplications\u002Fget) |\n| `data.state.status` | string | `PENDING` right after deletion. The other values are described under `state.status` on the [List application secrets](\u002Fdocs\u002Fapplications\u002Fapp-secrets\u002Flist) page |\n| `data.state.failureCode` | string \\| null | Failure reason when `FAILED`. The codes are in the \"Failure and retry\" section of [Application secrets](\u002Fdocs\u002Fapplications\u002Fapp-secrets) |\n| `data.state.deliveredNames` | array | Names the platform has already passed to the application, including deleted ones |\n| `data.state.serviceName` | string \\| null | The application's service on a standalone machine, recorded by the platform on deploy. `null` in Galaxy and before such a deploy |\n| `data.state.updatedAt` | string | Time of the last state change, ISO 8601 |\n\n## Response example\n\n```json\n{\n  \"success\": true,\n  \"data\": {\n    \"secret\": null,\n    \"state\": {\n      \"desiredRevision\": 1,\n      \"appliedRevision\": 0,\n      \"appliedServerId\": null,\n      \"status\": \"PENDING\",\n      \"failureCode\": null,\n      \"deliveredNames\": [],\n      \"serviceName\": null,\n      \"updatedAt\": \"2026-10-22T12:46:24.093Z\"\n    }\n  }\n}\n```\n\n## Error response example\n\n404 — the application has no such name:\n\n```json\n{\n  \"success\": false,\n  \"error\": {\n    \"code\": \"SECRET_NOT_FOUND\",\n    \"message\": \"SECRET_NOT_FOUND\"\n  }\n}\n```\n\n## Errors\n\n| HTTP | Code | Description |\n|------|-----|---------|\n| 404 | `SECRET_NOT_FOUND` | The application has no such name, including on a repeated deletion |\n| 404 | `APPLICATION_NOT_FOUND` | The application does not exist or there is no access to it, including an application on a different machine than the one the development member's key is linked to. Or the feature is not enabled for the portal |\n| 400 | `SECRET_INVALID_NAME` | Invalid or reserved name, other than a system secret name |\n| 409 | `SECRET_SYSTEM` | A platform system secret name — `VIBE_AUTH_SECRET`, `VIBE_AUTH_SECRET_PREVIOUS` or `VIBE_AUTH_SECRET_REVOKED`. A system secret cannot be deleted through the API. The answer is the same even if the application has no such secret |\n| 401 | `MISSING_API_KEY` | The `X-Api-Key` header is missing |\n| 401 | `INVALID_API_KEY` | Key not found |\n| 403 | `WRITE_BLOCKED_READONLY_KEY` | A read-only key cannot delete names |\n| 403 | `INFRA_FORBIDDEN_FOR_COWORK_KEY` | A Cowork subscription key with the `vibe:cowork` scope cannot delete names |\n| 403 | `EXTERNAL_COLLABORATOR_KEY_SERVER_MISMATCH` | The external development member's key is not linked to a machine, and the application has no machine either |\n| 403 | `EXTERNAL_COLLABORATOR_NOT_A_MEMBER` | Key of an external development member whose membership on the machine was revoked or has expired |\n| 403 | `PORTAL_COLLABORATOR_NOT_A_MEMBER` | Key of a development team member who is no longer in the machine's team or is not linked to it |\n| 429 | `RATE_LIMIT_EXCEEDED` | The secrets methods limit is 60 requests per minute per user within a portal, shared by the list, create and delete methods and split across replicas. A rejection by the general API request limit comes with the same code. `x-ratelimit-limit` reports the effective limit for the key |\n| 500 | `SECRET_OPERATION_FAILED` | The operation failed. The response does not include the original error |\n\nFull list of common API errors — [Errors](\u002Fdocs\u002Ferrors).\n\n## Known specifics\n\n**Restart without a deploy.** The new set is applied in the background, the same way as after a value is changed on the card: the running application restarts without the deleted value and does not respond while it restarts. A sleeping machine applies the set after it wakes up. Details are in the \"Without a deploy\" section of [Application secrets](\u002Fdocs\u002Fapplications\u002Fapp-secrets).\n\n## See also\n\n- [Application secrets](\u002Fdocs\u002Fapplications\u002Fapp-secrets)\n- [List application secrets](\u002Fdocs\u002Fapplications\u002Fapp-secrets\u002Flist)\n- [Create a secret name](\u002Fdocs\u002Fapplications\u002Fapp-secrets\u002Fcreate)\n- [Application catalog](\u002Fdocs\u002Fapplications)\n","2026-11-05",{},1794739459129]