# Delete an organization domain

`DELETE /v1/organization-domains/{domain_id}` · permission `organization-domains:write`

Deletes the domain permanently; its capture and SSO routing go with it. The deletion is written to the management audit log and the `organization_domain.deleted` event is published.

## Request

| Field | Type | Required | Description |
|---|---|---|---|
| `domain_id` | path | yes | Organization domain ID (`odm_…`). |
| `If-Match` | header | no | Optional. When sent it must match the `ETag` of the last read (`"<version>"`). |

No request body.

## Response

`204 No Content`.

## Errors

| HTTP | code | When |
|---|---|---|
| 404 | `not_found` | No organization domain with this ID exists in this environment. |
| 412 | `precondition_failed` | `If-Match` was sent and does not match the current version; read the domain again. |
| 401 | `unauthenticated` | The credential is missing, invalid or revoked. |
| 403 | `insufficient_permissions` | The credential lacks the required permission. |
| 429 | `rate_limited` | The rate limit was exceeded; retry after the `Retry-After` period. |
| 503 | `service_unavailable` | A dependency is temporarily unavailable; retry after the `Retry-After` period. |

## Example

```bash
curl -X DELETE https://api.eu.keenauth.com/v1/organization-domains/odm_01j9xk3m7q8r2s4t6v8w0y2z4c \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY"
```