## Retire a signing secret

**delete** `/v1/webhook_endpoints/{endpoint}/secrets/{secret}`

Retires a signing secret — the second half of a rotation. It stops
signing immediately; signatures already sent are unaffected.

An endpoint's LAST active secret cannot be retired: an endpoint that
could not sign would have to stop delivering, and silently unsigned
webhooks are indistinguishable from forgeries. Add the replacement
first.

### Path Parameters

- `endpoint: string`

- `secret: string`

### Returns

- `SigningSecret object { id, created_at, retired_at, status }`

  One signing secret. Every ACTIVE secret signs every event, and all of the
  signatures ride the one `webhook-signature` header — which is what makes a
  rotation lossless.

  - `id: string`

    The secret's id. Safe to log: it is a handle, not key material.

  - `created_at: string`

  - `retired_at: string`

    When this secret stopped signing. `null` while it is active.

  - `status: string`

    `active` or `retired`. Values grow additively.

### Example

```http
curl https://whatsapp.messages.api.linqapp.com/v1/webhook_endpoints/$ENDPOINT/secrets/$SECRET \
    -X DELETE \
    -H "Authorization: Bearer $LINQ_WHATSAPP_API_KEY"
```

#### Response

```json
{
  "id": "id",
  "created_at": "2019-12-27T18:11:19.117Z",
  "retired_at": "2019-12-27T18:11:19.117Z",
  "status": "status"
}
```