# Delete a connection

`DELETE /v1/connections/{connection_id}` · permission `connections:write`

Deletes a connection. User data is not deleted. `If-Match` is required. If users have identities from an active connection, deletion fails with `connection_in_use`; deactivate the connection first. The connection is also removed from application connection lists. A deleted connection can be restored as `inactive` within 30 days with [`:restore`](restore.md); after that it is deleted permanently.

## Request

| Field | Type | Required | Description |
|---|---|---|---|
| `connection_id` | string | yes | Connection identifier (`conn_…`). |
| `If-Match` | header | yes | The `ETag` of the connection as last read. Missing: `428`; stale: `412`. |

## Response

`204 No Content`, no body.

## Errors

| HTTP | code | When |
|---|---|---|
| 404 | `not_found` | The connection does not exist or belongs to another environment. |
| 409 | `connection_in_use` | Users still have identities from this active connection; deactivate it first. |
| 412 | `precondition_failed` | `If-Match` does not match the current version. |
| 428 | `precondition_required` | The `If-Match` header is missing. |
| 401 | `unauthenticated` | The credential is missing, invalid or revoked. |
| 403 | `insufficient_permissions` | The credential lacks the required permission. |
| 429 | `rate_limited` | The rate limit was exceeded; retry after the `Retry-After` period. |
| 503 | `service_unavailable` | A dependency is temporarily unavailable; retry after the `Retry-After` period. |

## Example

```bash
curl -X DELETE https://api.eu.keenauth.com/v1/connections/conn_0k3v8m1q2x9dz4h7s5t6w0y1ab \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY" \
  -H 'If-Match: "2"'
```