--- title: Delete IPsec Tunnel --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api/go) [Magic Transit](https://developers.cloudflare.com/api/go/resources/magic_transit) [IPSEC Tunnels](https://developers.cloudflare.com/api/go/resources/magic_transit/subresources/ipsec_tunnels) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Delete IPsec Tunnel client.MagicTransit.IPSECTunnels.Delete(ctx, ipsecTunnelID, params) (\*[IPSECTunnelDeleteResponse](), error) DELETE/accounts/{account\_id}/magic/ipsec\_tunnels/{ipsec\_tunnel\_id} Disables and removes a specific static IPsec Tunnel associated with an account. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes. ##### Security
API Token The preferred authorization scheme for interacting with the Cloudflare API. Create a token. **Example:**Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY
API Email + API Key The previous authorization scheme for interacting with the Cloudflare API, used in conjunction with a Global API key. **Example:**X-Auth-Email: user@example.com The previous authorization scheme for interacting with the Cloudflare API. When possible, use API tokens instead of Global API keys. **Example:**X-Auth-Key: 144c9defac04969c7bfad8efaa8ea194
##### Accepted Permissions (at least one required) `Magic WAN Write``Magic Transit Write` ##### ParametersExpand Collapse ipsecTunnelID string Identifier maxLength32 [Link to this property](<#(resource)%20magic_transit.ipsec_tunnels%20%3E%20(method)%20delete%20%3E%20(params)%20default%20%3E%20(param)%20ipsec_tunnel_id%20%3E%20(schema)>)
params IPSECTunnelDeleteParams AccountID param.Field\[string] Path param: Identifier maxLength32 Link to this property XMagicNewHcTarget param.Field\[bool]Optional Header param: If true, the health check target in the response body will be presented using the new object format. Defaults to false. Link to this property
[Link to this property](<#(resource)%20magic_transit.ipsec_tunnels%20%3E%20(method)%20delete%20%3E%20(params)%20default>) ##### ReturnsExpand Collapse
type IPSECTunnelDeleteResponse struct{…} Deleted boolOptional Link to this property
DeletedIPSECTunnel IPSECTunnelDeleteResponseDeletedIPSECTunnelOptional ID string Identifier maxLength32 Link to this property CloudflareEndpoint string The IP address assigned to the Cloudflare side of the IPsec tunnel. Link to this property InterfaceAddress string A 31-bit prefix (/31 in CIDR notation) supporting two hosts, one for each side of the tunnel. Select the subnet from the following private IP space: 10.0.0.0–10.255.255.255, 172.16.0.0–172.31.255.255, 192.168.0.0–192.168.255.255. Link to this property Name string The name of the IPsec tunnel. The name cannot share a name with other tunnels. Link to this property AllowNullCipher boolOptional When true, the tunnel can use a null-cipher (ENCR_NULL) in the ESP tunnel (Phase 2). Link to this property AutomaticReturnRouting boolOptional True if automatic stateful return routing should be enabled for a tunnel, false otherwise. Requires the coupler_integration account flag to be enabled; requests setting this to true without that flag will be rejected. Link to this property
BGP IPSECTunnelDeleteResponseDeletedIPSECTunnelBGPOptional CustomerASN int64 ASN used on the customer end of the BGP session formatint32 minimum0 Link to this property ExportFilterID stringOptional ID of the BGP filter profile applied to routes advertised to the customer. Link to this property ExtraPrefixes \[]stringOptional Prefixes in this list will be advertised to the customer device, in addition to the routes in the Magic routing table. Link to this property ImportFilterID stringOptional ID of the BGP filter profile applied to routes received from the customer. Link to this property Md5Key stringOptional MD5 key to use for session authentication. Note that *this is not a security measure*. MD5 is not a valid security mechanism, and the key is not treated as a secret value. This is *only* supported for preventing misconfiguration, not for defending against malicious attacks. The MD5 key, if set, must be of non-zero length and consist only of the following types of character: - ASCII alphanumerics: [a-zA-Z0-9] - Special characters in the set '!@#$%^&*()+[]{}<>/.,;:_-~= |\` In other words, MD5 keys may contain any printable ASCII character aside from newline (0x0A), quotation mark ("), vertical tab (0x0B), carriage return (0x0D), tab (0x09), form feed (0x0C), and the question mark (?). Requests specifying an MD5 key with one or more of these disallowed characters will be rejected. Link to this property
Link to this property
BGPStatus IPSECTunnelDeleteResponseDeletedIPSECTunnelBGPStatusOptional
State IPSECTunnelDeleteResponseDeletedIPSECTunnelBGPStatusState One of the following: const IPSECTunnelDeleteResponseDeletedIPSECTunnelBGPStatusStateBGPDown IPSECTunnelDeleteResponseDeletedIPSECTunnelBGPStatusState = "BGP\_DOWN" Link to this property const IPSECTunnelDeleteResponseDeletedIPSECTunnelBGPStatusStateBGPUp IPSECTunnelDeleteResponseDeletedIPSECTunnelBGPStatusState = "BGP\_UP" Link to this property const IPSECTunnelDeleteResponseDeletedIPSECTunnelBGPStatusStateBGPEstablishing IPSECTunnelDeleteResponseDeletedIPSECTunnelBGPStatusState = "BGP\_ESTABLISHING" Link to this property
Link to this property TCPEstablished bool Link to this property UpdatedAt Time formatdate-time Link to this property BGPState stringOptional Link to this property CfSpeakerIP stringOptional formatipv4 Link to this property CfSpeakerPort int64Optional maximum65535 minimum1 Link to this property CustomerSpeakerIP stringOptional formatipv4 Link to this property CustomerSpeakerPort int64Optional maximum65535 minimum1 Link to this property
Link to this property CreatedOn TimeOptional The date and time the tunnel was created. formatdate-time Link to this property
CustomRemoteIdentities IPSECTunnelDeleteResponseDeletedIPSECTunnelCustomRemoteIdentitiesOptional FqdnID stringOptional A custom IKE ID of type FQDN that may be used to identity the IPsec tunnel. The generated IKE IDs can still be used even if this custom value is specified. Must be of the form <custom label>.<account ID>.custom.ipsec.cloudflare.com. This custom ID does not need to be unique. Two IPsec tunnels may have the same custom fqdn\_id. However, if another IPsec tunnel has the same value then the two tunnels cannot have the same cloudflare\_endpoint. Link to this property
Link to this property CustomerEndpoint stringOptional The IP address assigned to the customer side of the IPsec tunnel. Not required, but must be set for proactive traceroutes to work. Link to this property Description stringOptional An optional description forthe IPsec tunnel. Link to this property
HealthCheck IPSECTunnelDeleteResponseDeletedIPSECTunnelHealthCheckOptional
Direction IPSECTunnelDeleteResponseDeletedIPSECTunnelHealthCheckDirectionOptional The direction of the flow of the healthcheck. Either unidirectional, where the probe comes to you via the tunnel and the result comes back to Cloudflare via the open Internet, or bidirectional where both the probe and result come and go via the tunnel. One of the following: const IPSECTunnelDeleteResponseDeletedIPSECTunnelHealthCheckDirectionUnidirectional IPSECTunnelDeleteResponseDeletedIPSECTunnelHealthCheckDirection = "unidirectional" Link to this property const IPSECTunnelDeleteResponseDeletedIPSECTunnelHealthCheckDirectionBidirectional IPSECTunnelDeleteResponseDeletedIPSECTunnelHealthCheckDirection = "bidirectional" Link to this property
Link to this property Enabled boolOptional Determines whether to run healthchecks for a tunnel. Link to this property
Rate HealthCheckRateOptional How frequent the health check is run. The default value is mid. One of the following: const HealthCheckRateLow HealthCheckRate = "low" Link to this property const HealthCheckRateMid HealthCheckRate = "mid" Link to this property const HealthCheckRateHigh HealthCheckRate = "high" Link to this property
Link to this property
Target IPSECTunnelDeleteResponseDeletedIPSECTunnelHealthCheckTargetUnionOptional The destination address in a request type health check. After the healthcheck is decapsulated at the customer end of the tunnel, the ICMP echo will be forwarded to this address. This field defaults to customer_gre_endpoint address. This field is ignored for bidirectional healthchecks as the interface\_address (not assigned to the Cloudflare side of the tunnel) is used as the target. Must be in object form if the x-magic-new-hc-target header is set to true and string form if x-magic-new-hc-target is absent or set to false. One of the following:
type IPSECTunnelDeleteResponseDeletedIPSECTunnelHealthCheckTargetMagicHealthCheckTarget struct{…} The destination address in a request type health check. After the healthcheck is decapsulated at the customer end of the tunnel, the ICMP echo will be forwarded to this address. This field defaults to customer_gre_endpoint address. This field is ignored for bidirectional healthchecks as the interface\_address (not assigned to the Cloudflare side of the tunnel) is used as the target. Effective stringOptional The effective health check target. If ‘saved’ is empty, then this field will be populated with the calculated default value on GET requests. Ignored in POST, PUT, and PATCH requests. Link to this property Saved stringOptional The saved health check target. Setting the value to the empty string indicates that the calculated default value will be used. Link to this property
Link to this property UnionString Link to this property
Link to this property
Type HealthCheckTypeOptional The type of healthcheck to run, reply or request. The default value is reply. One of the following: const HealthCheckTypeReply HealthCheckType = "reply" Link to this property const HealthCheckTypeRequest HealthCheckType = "request" Link to this property
Link to this property
Link to this property InterfaceAddress6 stringOptional A 127 bit IPV6 prefix from within the virtual\_subnet6 prefix space with the address being the first IP of the subnet and not same as the address of virtual\_subnet6. Eg if virtual\_subnet6 is 2606:54c1:7:0:a9fe:12d2::/127 , interface\_address6 could be 2606:54c1:7:0:a9fe:12d2:1:200/127 Link to this property ModifiedOn TimeOptional The date and time the tunnel was last modified. formatdate-time Link to this property
PSKMetadata PSKMetadataOptional The PSK metadata that includes when the PSK was generated. LastGeneratedOn TimeOptional The date and time the tunnel was last modified. formatdate-time Link to this property
Link to this property ReplayProtection boolOptional If true, then IPsec replay protection will be supported in the Cloudflare-to-customer direction. Link to this property
Link to this property
[Link to this property](<#(resource)%20magic_transit.ipsec_tunnels%20%3E%20(model)%20IPSECTunnelDeleteResponse%20%3E%20(schema)>) ### Delete IPsec Tunnel Go HTTPTypeScriptPythonGoTerraform ``` package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/magic_transit" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) ipsecTunnel, err := client.MagicTransit.IPSECTunnels.Delete( context.TODO(), "023e105f4ecef8ad9ca31a8372d0c353", magic_transit.IPSECTunnelDeleteParams{ AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", ipsecTunnel.Deleted) } ``` 200 example ``` { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "result": { "deleted": true, "deleted_ipsec_tunnel": { "id": "c4a7362d577a6c3019a474fd6f485821", "cloudflare_endpoint": "203.0.113.1", "interface_address": "192.0.2.0/31", "name": "IPsec_1", "allow_null_cipher": true, "automatic_return_routing": true, "bgp": { "customer_asn": 0, "export_filter_id": "a1b2c3d4e5f647890a1b2c3d4e5f6789", "extra_prefixes": [ "string" ], "import_filter_id": "a1b2c3d4e5f647890a1b2c3d4e5f6789", "md5_key": "md5_key" }, "bgp_status": { "state": "BGP_DOWN", "tcp_established": true, "updated_at": "2019-12-27T18:11:19.117Z", "bgp_state": "bgp_state", "cf_speaker_ip": "192.168.1.1", "cf_speaker_port": 1, "customer_speaker_ip": "192.168.1.1", "customer_speaker_port": 1 }, "created_on": "2017-06-14T00:00:00Z", "custom_remote_identities": { "fqdn_id": "fqdn_id" }, "customer_endpoint": "203.0.113.1", "description": "Tunnel for ISP X", "health_check": { "direction": "bidirectional", "enabled": true, "rate": "low", "target": { "effective": "203.0.113.1", "saved": "203.0.113.1" }, "type": "request" }, "interface_address6": "2606:54c1:7:0:a9fe:12d2:1:200/127", "modified_on": "2017-06-14T05:20:00Z", "psk_metadata": { "last_generated_on": "2017-06-14T05:20:00Z" }, "replay_protection": false } }, "success": true } ``` ##### Returns Examples 200 example ``` { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "result": { "deleted": true, "deleted_ipsec_tunnel": { "id": "c4a7362d577a6c3019a474fd6f485821", "cloudflare_endpoint": "203.0.113.1", "interface_address": "192.0.2.0/31", "name": "IPsec_1", "allow_null_cipher": true, "automatic_return_routing": true, "bgp": { "customer_asn": 0, "export_filter_id": "a1b2c3d4e5f647890a1b2c3d4e5f6789", "extra_prefixes": [ "string" ], "import_filter_id": "a1b2c3d4e5f647890a1b2c3d4e5f6789", "md5_key": "md5_key" }, "bgp_status": { "state": "BGP_DOWN", "tcp_established": true, "updated_at": "2019-12-27T18:11:19.117Z", "bgp_state": "bgp_state", "cf_speaker_ip": "192.168.1.1", "cf_speaker_port": 1, "customer_speaker_ip": "192.168.1.1", "customer_speaker_port": 1 }, "created_on": "2017-06-14T00:00:00Z", "custom_remote_identities": { "fqdn_id": "fqdn_id" }, "customer_endpoint": "203.0.113.1", "description": "Tunnel for ISP X", "health_check": { "direction": "bidirectional", "enabled": true, "rate": "low", "target": { "effective": "203.0.113.1", "saved": "203.0.113.1" }, "type": "request" }, "interface_address6": "2606:54c1:7:0:a9fe:12d2:1:200/127", "modified_on": "2017-06-14T05:20:00Z", "psk_metadata": { "last_generated_on": "2017-06-14T05:20:00Z" }, "replay_protection": false } }, "success": true } ```