DELETE /api/admin/hooks/:id (hooks.manage, step-up). Audited hooks.delete.Staff cookie session; permission hooks.manage; fresh password + TOTP step-up (10 minutes). Write requests need same-origin JSON and X-Admin-CSRF from this session.Source snapshot: admin/src/app/api/admin/hooks/[id]/route.ts. This reference describes the current working tree, not proof of deployment. The response service types and validators remain authoritative.