# Retire signing key

> Retire a secondary key without promoting it.

Source: https://sndr.sh/docs/cranl/webhooks/retire-signing-key

`POST https://api.sndr.sh/api/cranl/v1/webhooks/{id}/signing-keys/{key_id}/retire`

Retire a secondary key without promoting it. The primary key cannot be retired; promote a replacement instead.

Scope: `send`

**Path parameters**

- `id` (string, required): Webhook ID (wh_...).
- `key_id` (string, required): Secondary key ID (whk_...).

**Request**

```bash
curl -X POST 'https://api.sndr.sh/api/cranl/v1/webhooks/wh_2a7d4e9c-6b1/signing-keys/whk_61d0a9c7-5e4/retire' \
  -H 'Authorization: Bearer sndr_your_access_token'
```

**Response** (200)

```json
{
  "id":     "whk_61d0a9c7-5e4",
  "status": "retired"
}
```

**Errors**

- `unauthenticated` (401): Missing or invalid Bearer token.
- `token_expired` (401): Access token expired — exchange the refresh token for a new pair.
- `token_revoked` (401): Token was explicitly revoked.
- `insufficient_scope` (403): Token is missing the send scope.
- `not_found` (404): Resource does not exist or belongs to a different account.
- `conflict` (409): The key is not a secondary key (it is the primary or already retired).