> ## Documentation Index > Fetch the complete documentation index at: https://vexioncards.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Archive a card template (soft delete) > Archive a card template (soft delete). Existing customers enrolled in the card keep their wallet passes and continue to earn/redeem; the card is removed from the public catalog and POST /v1/customers with this card_id returns 404. To permanently delete with GDPR right-to-be-forgotten (PII anonymization for enrolled customers), include ?gdpr=true. Returns 409 (code card_has_active_customers) if you pass gdpr=true against a card that is still ACTIVE and has enrolled customers: the irreversible PII cascade is gated behind archive-first. Archive the card (a plain DELETE, which is safe - enrolled customers keep their passes and keep earning), migrate customers as needed, then retry with gdpr=true against the archived card. Side effect: fires card.deleted webhook event with deletion_type ('archived' or 'gdpr_redacted'). Archiving is idempotent: calling DELETE again on an already-archived card returns 200 with the same envelope (deletion_type and archived_at unchanged, and enrolled_customers_count not re-counted), never 404. ## OpenAPI ````yaml /openapi.json delete /v1/cards/{id} openapi: 3.1.0 info: title: VEXiON cards Public API description: >- ## Rate limiting Two independent layers, checked in this order: 1. **Per-IP throttle (pre-authentication).** Applied to every `/v1` request BEFORE the API key is checked, keyed on the caller's IP address: - **600 requests/minute** per IP - a flood ceiling, `429 rate_limit_error` / `rate_limited`. - **20 failed authentications per 15 minutes** per IP - a key-guessing ceiling. Only responses that are `401` (missing/invalid/revoked key) count against this ceiling; a `403` from a valid key that simply lacks a scope does not. `429 rate_limit_error` / `too_many_failed_attempts`. Both ceilings send `Retry-After` (seconds). 2. **Per-key, per-bucket limiter (post-authentication).** Documented per endpoint (see each operation's `429` response and the `rate_limit` field on the API Key resource) - e.g. 60/min default, 120/min for transactions, plus the notification-broadcast and lookup-filter buckets described on their own endpoints. ### Rate-limit response headers Every rate-limited response carries the legacy `X-RateLimit-Limit` / `X-RateLimit-Remaining` / `X-RateLimit-Reset` family (the last is an **epoch timestamp**) AND the IETF standards-track headers, side by side: - `RateLimit-Policy: "";q=;w=` - the static policy for the bucket that was hit. - `RateLimit: "";r=;t=` - live state. **`t` is a DURATION (seconds remaining), not the epoch timestamp `X-RateLimit-Reset` carries - the two are never the same value.** version: 1.0.0 servers: - url: https://api.vexioncards.one description: Production - url: https://migration.api.vexioncards.one description: Sandbox security: - apiKey: [] tags: - name: Customers - name: Cards - name: Transactions - name: Notifications - name: Locations - name: Products - name: API keys - name: Organization - name: Webhook endpoints - name: Events - name: Custom fields - name: Team members - name: Icons paths: /v1/cards/{id}: delete: tags: - Cards summary: Archive a card template (soft delete) description: >- Archive a card template (soft delete). Existing customers enrolled in the card keep their wallet passes and continue to earn/redeem; the card is removed from the public catalog and POST /v1/customers with this card_id returns 404. To permanently delete with GDPR right-to-be-forgotten (PII anonymization for enrolled customers), include ?gdpr=true. Returns 409 (code card_has_active_customers) if you pass gdpr=true against a card that is still ACTIVE and has enrolled customers: the irreversible PII cascade is gated behind archive-first. Archive the card (a plain DELETE, which is safe - enrolled customers keep their passes and keep earning), migrate customers as needed, then retry with gdpr=true against the archived card. Side effect: fires card.deleted webhook event with deletion_type ('archived' or 'gdpr_redacted'). Archiving is idempotent: calling DELETE again on an already-archived card returns 200 with the same envelope (deletion_type and archived_at unchanged, and enrolled_customers_count not re-counted), never 404. operationId: archiveCard parameters: - name: id in: path description: >- Card template identifier. Opaque, server-issued token, e.g. crd_c4zdlocdwajf6wtmnvvkonv4oa. required: true example: crd_sophcrprtvpmmnwxah2lomnkee schema: type: string pattern: ^crd_[A-Za-z0-9]+$ - name: gdpr in: query description: >- If true, permanently anonymizes all enrolled customer PII for this card (GDPR right-to-be-forgotten). Default false (soft archive). required: false example: false schema: type: boolean default: false - name: Idempotency-Key in: header description: Recommended on PATCH and DELETE for safe retries. required: false example: 9b2f4a7e-2c1c-4d3e-9f8b-1234567890ab schema: type: string maxLength: 255 - name: Accept-Language in: header description: >- Preferred language for error messages and localized fields. One of sk, cs, en, de. Defaults to card's default_language. required: false example: sk schema: type: string enum: - sk - cs - en - de default: sk responses: '200': description: Card deleted. content: application/json: schema: type: object properties: id: type: string description: >- The archived card id. Duplicated as `card_id` for symmetry with other deletion-confirmation envelopes. object: type: string enum: - card deleted: type: boolean deletion_type: type: string enum: - archived - gdpr_redacted description: >- `archived` for a plain soft archive, `gdpr_redacted` when `?gdpr=true` also anonymized every enrolled customer. archived_at: type: - integer - 'null' description: >- Unix seconds when the card was first archived. Preserved (not restamped) on a repeat archive. card_id: type: string status: type: string enum: - archived enrolled_customers_count: type: integer description: >- Holders enrolled at the moment of archive. Returned only when `gdpr` is false or omitted. gdpr_redacted_customers_count: type: integer description: >- Customers irreversibly anonymized by this call. Returned only when `gdpr=true`. required: - id - object - deleted - deletion_type - archived_at - card_id - status examples: Archived: summary: Archived value: id: crd_sophcrprtvpmmnwxah2lomnkee object: card deleted: true deletion_type: archived archived_at: 1782604800 card_id: crd_sophcrprtvpmmnwxah2lomnkee status: archived enrolled_customers_count: 42 GDPR redacted: summary: GDPR redacted value: id: crd_sophcrprtvpmmnwxah2lomnkee object: card deleted: true deletion_type: gdpr_redacted archived_at: 1782604800 card_id: crd_sophcrprtvpmmnwxah2lomnkee status: archived gdpr_redacted_customers_count: 42 headers: {} '400': description: Malformed body or missing required field. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: type: invalid_request_error code: invalid_query_parameter message: Invalid value for a query parameter. doc_url: >- https://vexioncards.mintlify.site/api-reference/errors#invalid_query_parameter request_id: req_4d8b1e2f9c3a5 examples: Http 400 default: summary: Http 400 default value: error: type: invalid_request_error code: invalid_query_parameter message: Invalid value for a query parameter. doc_url: >- https://vexioncards.mintlify.site/api-reference/errors#invalid_query_parameter request_id: req_4d8b1e2f9c3a5 headers: {} '401': description: Missing, invalid, revoked, or paused API key. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: type: authentication_error code: missing_api_key message: >- Authorization header is required. Send 'Authorization: Bearer vxn_sk_...'. doc_url: >- https://vexioncards.mintlify.site/api-reference/errors#missing_api_key request_id: req_5f8b2c4a9e1d3 examples: Missing API key: summary: Missing API key value: error: type: authentication_error code: missing_api_key message: >- Authorization header is required. Send 'Authorization: Bearer vxn_sk_...'. doc_url: >- https://vexioncards.mintlify.site/api-reference/errors#missing_api_key request_id: req_5f8b2c4a9e1d3 API key revoked: summary: API key revoked value: error: type: authentication_error code: api_key_revoked message: >- This API key has been revoked. Mint a new key from the dashboard at https://app.vexioncards.one/settings/developers. doc_url: >- https://vexioncards.mintlify.site/api-reference/errors#api_key_revoked request_id: req_dNe22j5AZ8gCQjQe92m23ze866 API key paused: summary: API key paused value: error: type: authentication_error code: api_key_paused message: This API key is paused. Resume it from the dashboard. doc_url: >- https://vexioncards.mintlify.site/api-reference/errors#api_key_paused request_id: req_MMBMtKVGetS4akQsbgxpAPCmcG headers: {} '403': description: API key lacks the required scope. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: type: permission_error code: insufficient_scope message: This API key does not have the cards:write scope. doc_url: >- https://vexioncards.mintlify.site/api-reference/errors#insufficient_scope request_id: req_5f8b2c4a9e1d3 examples: Insufficient scope: summary: Insufficient scope value: error: type: permission_error code: insufficient_scope message: This API key does not have the cards:write scope. doc_url: >- https://vexioncards.mintlify.site/api-reference/errors#insufficient_scope request_id: req_5f8b2c4a9e1d3 headers: {} '404': description: Resource not found in your organization. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: type: not_found_error code: resource_missing message: Card not found. doc_url: >- https://vexioncards.mintlify.site/api-reference/errors#resource_missing request_id: req_5f8b2c4a9e1d3 param: id examples: Card not found: summary: Card not found value: error: type: not_found_error code: resource_missing message: Card not found. doc_url: >- https://vexioncards.mintlify.site/api-reference/errors#resource_missing request_id: req_5f8b2c4a9e1d3 param: id headers: {} '409': description: >- Idempotency-key reuse, balance constraint violated, or already-processed conflict. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: type: invalid_request_error code: idempotency_key_in_use message: >- An earlier request with the same Idempotency-Key is still processing. doc_url: >- https://vexioncards.mintlify.site/api-reference/errors#idempotency_key_in_use request_id: req_3f1e9d7c5b2a4 examples: Http 409 default: summary: Http 409 default value: error: type: invalid_request_error code: idempotency_key_in_use message: >- An earlier request with the same Idempotency-Key is still processing. doc_url: >- https://vexioncards.mintlify.site/api-reference/errors#idempotency_key_in_use request_id: req_3f1e9d7c5b2a4 headers: {} '429': description: Per-minute or per-day rate limit exceeded. Respect Retry-After. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: type: rate_limit_error code: rate_limited message: Too many requests. Try again in 5 seconds. retry_after: 5 doc_url: >- https://vexioncards.mintlify.site/api-reference/errors#rate_limited request_id: req_2c8e4f6a9d1b3 examples: Http 429 default: summary: Http 429 default value: error: type: rate_limit_error code: rate_limited message: Too many requests. Try again in 5 seconds. retry_after: 5 doc_url: >- https://vexioncards.mintlify.site/api-reference/errors#rate_limited request_id: req_2c8e4f6a9d1b3 headers: {} '500': description: Server error. Retry-safe on idempotent calls. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: type: api_error code: internal_error message: An internal error occurred. doc_url: >- https://vexioncards.mintlify.site/api-reference/errors#internal_error request_id: req_5f8b2c4a9e1d3 examples: Http 500 default: summary: Http 500 default value: error: type: api_error code: internal_error message: An internal error occurred. doc_url: >- https://vexioncards.mintlify.site/api-reference/errors#internal_error request_id: req_5f8b2c4a9e1d3 headers: {} deprecated: false components: schemas: Error: type: object required: - error properties: error: type: object required: - type - code - message properties: type: type: string enum: - invalid_request_error - authentication_error - permission_error - not_found_error - rate_limit_error - idempotency_error - api_error code: type: string message: type: string retry_after: type: integer description: >- Seconds to wait before retrying. Present on rate-limit (429) and idempotency-key-in-use (409) errors; mirrors the `Retry-After` HTTP header. Absent on error types that carry no retry guidance. example: 5 param: type: - string - 'null' request_id: type: string doc_url: type: string format: uri field_errors: type: array description: >- Per-field errors on a 422. At most 100 entries: a request with more errors gets the first 100. items: type: object properties: param: type: string code: type: string message: type: string expected_currency: type: string description: >- On `currency_mismatch`: the business currency the request must use. Absent on every other field error. description: >- The error payload: type (category), code (machine-readable), message (human-readable), retry_after (seconds, on rate-limit/idempotency-in-use errors only), param (offending field), request_id, doc_url, field_errors[]. description: >- Standard error envelope. Branch on `error.code`; include `error.request_id` in support requests. See the Errors guide. securitySchemes: apiKey: type: http scheme: bearer description: >- Your secret API key as a Bearer token: `Authorization: Bearer vxn_sk_...`. Keys are created and scoped in the dashboard - see [Authentication](/api-reference/introduction#authentication). ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.