# Delete an IdP signing certificate from a connection

`DELETE /v1/connections/{connection_id}/certificates/{certificate_id}` · permission `connections:write`

Deletes a signing certificate of the identity provider from an enterprise SAML connection. The deletion takes effect immediately: from then on the certificate verifies no signature, it is no longer listed and it cannot be added again. Deleting a certificate that is already deleted also returns `204`.

The last certificate that is currently valid cannot be deleted, because the connection would then reject every sign-in; [add](add.md) the new certificate first. The request takes no `If-Match` header. Deletions are audited as `connection.idp_certificate_retired`.

## Request

| Field | Type | Required | Description |
|---|---|---|---|
| `connection_id` | path | yes | Enterprise SAML connection ID (`conn_…`). |
| `certificate_id` | path | yes | Certificate ID (`conncert_…`) from [List certificates](list.md). |

## Response

`204 No Content`.

## Errors

| HTTP | code | When |
|---|---|---|
| 404 | `not_found` | The connection or the certificate does not exist in this environment, the ID is malformed, or the connection is not an enterprise connection. |
| 409 | `conflict` | The connection is not a SAML connection, or the certificate is the last one that is currently valid. |
| 401 | `unauthenticated` | The credential is missing, invalid or revoked. |
| 403 | `insufficient_permissions` | The credential lacks the required permission. |
| 429 | `rate_limited` | The rate limit was exceeded; retry after the `Retry-After` period. |
| 503 | `service_unavailable` | A dependency is temporarily unavailable; retry after the `Retry-After` period. |

## Example

```bash
curl -X DELETE "https://api.eu.keenauth.com/v1/connections/conn_01j9xp6q0r1s5t7v9w1x3y5z7b/certificates/conncert_01j9xq2m4n6p8r0s2t4v6w8y0a" \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY"
```

```bash
keenauth connections certificates delete conn_01j9xp6q0r1s5t7v9w1x3y5z7b conncert_01j9xq2m4n6p8r0s2t4v6w8y0a
```