# Delete an organization policy

`DELETE /v1/organizations/{org_id}/policies/{policy_kind}` · permission `organizations:write`

Deletes the policy; the organization returns to the environment's value for this kind. The deletion is written to the management audit log and the `organization.updated` event is published.

## Request

| Field | Type | Required | Description |
|---|---|---|---|
| `org_id` | path | yes | Organization ID (`org_…`). |
| `policy_kind` | path | yes | Policy kind: `authentication_methods`, `mfa`, `phishing_resistant`, `sso_enforcement`, `session` or `ip_allowlist`. Any other value returns `404`. |
| `If-Match` | header | yes | Required. The `ETag` of the last read (`"<version>"`). |

No request body.

## Response

`204 No Content`.

## Errors

| HTTP | code | When |
|---|---|---|
| 404 | `not_found` | The organization does not exist, the kind is unknown, or no policy of this kind is written. |
| 412 | `precondition_failed` | `If-Match` does not match the current version; read the policy again. |
| 428 | `precondition_required` | `If-Match` is missing. |
| 401 | `unauthenticated` | The credential is missing, invalid or revoked. |
| 403 | `insufficient_permissions` | The credential lacks the required permission. |
| 429 | `rate_limited` | The rate limit was exceeded; retry after the `Retry-After` period. |
| 503 | `service_unavailable` | A dependency is temporarily unavailable; retry after the `Retry-After` period. |

## Example

```bash
curl -X DELETE https://api.eu.keenauth.com/v1/organizations/org_01j9xk3m7q8r2s4t6v8w0y2z4a/policies/mfa \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY" \
  -H 'If-Match: "1"'
```