# Delete a management client

`DELETE /v1/management-clients/{application_id}` · permission `management-clients:write`

Deletes the management client record of an application. The application and its credentials are kept. Deleting the application itself (`DELETE /v1/applications/{application_id}`) also removes this record; afterwards this endpoint and `GET` answer `404`. `If-Match` is required: without it the request fails with `428`, and with a version that no longer matches it fails with `412`. Only an API key can call this endpoint.

## Request

| Parameter | In | Description |
|---|---|---|
| `application_id` | path | Application ID (`app_…`). |
| `If-Match` | header | The `ETag` from the last read or write. |

## Response

`204 No Content`

## Errors

| HTTP | code | When |
|---|---|---|
| 403 | `insufficient_permissions` | The credential lacks `management-clients:write`, or it is not an API key. |
| 403 | `permission_escalation` | The record is broader than the calling key. |
| 404 | `not_found` | The application has no record in this environment. |
| 412 | `precondition_failed` | `If-Match` does not match the current version. |
| 428 | `precondition_required` | `If-Match` is missing. |

## Example

```bash
curl -X DELETE https://api.eu.keenauth.com/v1/management-clients/app_01h455vb4pex5vsknk084sn02q \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY" \
  -H 'If-Match: "3f2a9c0d7b1e4a6f8c5d2e1b0a9f8e7d"'
```

CLI: `keenauth management-clients delete app_01h455vb4pex5vsknk084sn02q --if-match '"3f2a9c0d7b1e4a6f8c5d2e1b0a9f8e7d"' --yes`