Delete a customer (GDPR soft-delete)

Removes a customer. Two modes, selected by the mode query parameter.

mode=soft (THE DEFAULT)

A reversible hide. It does NOT redact anything:

• deleted_at is set and the customer stops appearing in GET /v1/customers
• first_name, last_name, email and phone are RETAINED and still returned by GET /v1/customers/{id}
• status is unchanged, and gdpr_redacted_at stays null
• the transaction ledger is untouched
• re-enrolment is possible

If you are servicing a GDPR erasure request, this mode is NOT sufficient. You must pass ?mode=erase.

mode=erase

Irreversible GDPR erasure:

• personal data (first_name, last_name, email, phone) is unset
• gdpr_redacted_at is stamped
• the transaction ledger is preserved against an anonymised reference, so financial reporting, tax and POS reconciliation still resolve

Wallet passes are NOT revoked on the device

Neither mode removes a pass that the customer has already added to Apple Wallet or Google Wallet. There is no on-device revocation primitive today. voided_card_count counts the platform card records that were deactivated, NOT passes removed from devices.

Both modes emit customer.deleted.

DELETE /v1/customers/{id}

Delete a customer (GDPR soft-delete)

cURL

curl --request DELETE \
  --url https://api.vexioncards.one/v1/customers/{id} \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json'

200

Soft deleted

{
  "id": "cus_yovo5wk634htfojgkzdpmzvu5a",
  "object": "customer",
  "gdpr_redacted_at": null,
  "installed_at": null,
  "referral_stats": null,
  "last_visited_at": null,
  "last_visited_location_id": null,
  "deleted_at": "2026-06-30T00:00:00.000Z",
  "deleted": true,
  "mode": "soft"
}

Authorizations

Authorization · string · header · required

Your secret API key as a Bearer token: Authorization: Bearer vxn_sk_.... Keys are created and scoped in the dashboard - see Authentication.

Headers

Idempotency-Key · string<uuid>

Recommended on PATCH and DELETE for safe retries.

Required string length: 8 - 255

Pattern: ^[A-Za-z0-9_-]{8,255}$

Path Parameters

id · string · required

Customer id with cus_ prefix.

Pattern: ^cus_[A-Za-z0-9]+$

Query Parameters

mode · enum<string> · default: soft

soft (default): set deleted_at and hide the customer. PII is RETAINED and re-enrolment is possible. erase: irreversible GDPR erasure of PII. Neither mode removes a pass already on the customer's device.

Available options: soft, erase

Response

200

application/json

Customer soft-deleted.

id · string

object · enum<string>

Available options: customer

deleted_at · string<date-time>

voided_card_count · integer