> ## Documentation Index > Fetch the complete documentation index at: https://vexioncards.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Delete a customer (GDPR soft-delete) > Removes a customer. Two modes, selected by the `mode` query parameter. ## `mode=soft` (THE DEFAULT) A reversible hide. It does NOT redact anything: - `deleted_at` is set and the customer stops appearing in `GET /v1/customers` - `first_name`, `last_name`, `email` and `phone` are RETAINED and still returned by `GET /v1/customers/{id}` - `status` is unchanged, and `gdpr_redacted_at` stays `null` - the transaction ledger is untouched - re-enrolment is possible If you are servicing a GDPR erasure request, this mode is NOT sufficient. You must pass `?mode=erase`. ## `mode=erase` Irreversible GDPR erasure: - personal data (`first_name`, `last_name`, `email`, `phone`) is unset - `gdpr_redacted_at` is stamped - the transaction ledger is preserved against an anonymised reference, so financial reporting, tax and POS reconciliation still resolve ## Wallet passes are NOT revoked on the device Neither mode removes a pass that the customer has already added to Apple Wallet or Google Wallet. There is no on-device revocation primitive today. `voided_card_count` counts the platform card records that were deactivated, NOT passes removed from devices. Both modes emit `customer.deleted`. ## OpenAPI ````yaml /openapi.json delete /v1/customers/{id} openapi: 3.1.0 info: title: VEXiON cards Public API description: >- ## Rate limiting Two independent layers, checked in this order: 1. **Per-IP throttle (pre-authentication).** Applied to every `/v1` request BEFORE the API key is checked, keyed on the caller's IP address: - **600 requests/minute** per IP - a flood ceiling, `429 rate_limit_error` / `rate_limited`. - **20 failed authentications per 15 minutes** per IP - a key-guessing ceiling. Only responses that are `401` (missing/invalid/revoked key) count against this ceiling; a `403` from a valid key that simply lacks a scope does not. `429 rate_limit_error` / `too_many_failed_attempts`. Both ceilings send `Retry-After` (seconds). 2. **Per-key, per-bucket limiter (post-authentication).** Documented per endpoint (see each operation's `429` response and the `rate_limit` field on the API Key resource) - e.g. 60/min default, 120/min for transactions, plus the notification-broadcast and lookup-filter buckets described on their own endpoints. ### Rate-limit response headers Every rate-limited response carries the legacy `X-RateLimit-Limit` / `X-RateLimit-Remaining` / `X-RateLimit-Reset` family (the last is an **epoch timestamp**) AND the IETF standards-track headers, side by side: - `RateLimit-Policy: "";q=;w=` - the static policy for the bucket that was hit. - `RateLimit: "";r=;t=` - live state. **`t` is a DURATION (seconds remaining), not the epoch timestamp `X-RateLimit-Reset` carries - the two are never the same value.** version: 1.0.0 servers: - url: https://api.vexioncards.one description: Production - url: https://migration.api.vexioncards.one description: Sandbox security: - apiKey: [] tags: - name: Customers - name: Cards - name: Transactions - name: Notifications - name: Locations - name: Products - name: API keys - name: Organization - name: Webhook endpoints - name: Events - name: Custom fields - name: Team members - name: Icons paths: /v1/customers/{id}: delete: tags: - Customers summary: Delete a customer (GDPR soft-delete) description: >- Removes a customer. Two modes, selected by the `mode` query parameter. ## `mode=soft` (THE DEFAULT) A reversible hide. It does NOT redact anything: - `deleted_at` is set and the customer stops appearing in `GET /v1/customers` - `first_name`, `last_name`, `email` and `phone` are RETAINED and still returned by `GET /v1/customers/{id}` - `status` is unchanged, and `gdpr_redacted_at` stays `null` - the transaction ledger is untouched - re-enrolment is possible If you are servicing a GDPR erasure request, this mode is NOT sufficient. You must pass `?mode=erase`. ## `mode=erase` Irreversible GDPR erasure: - personal data (`first_name`, `last_name`, `email`, `phone`) is unset - `gdpr_redacted_at` is stamped - the transaction ledger is preserved against an anonymised reference, so financial reporting, tax and POS reconciliation still resolve ## Wallet passes are NOT revoked on the device Neither mode removes a pass that the customer has already added to Apple Wallet or Google Wallet. There is no on-device revocation primitive today. `voided_card_count` counts the platform card records that were deactivated, NOT passes removed from devices. Both modes emit `customer.deleted`. operationId: deleteCustomer parameters: - name: id in: path description: Customer id with cus_ prefix. required: true example: cus_a4f72c91e0bd4185b6c2 schema: type: string pattern: ^cus_[A-Za-z0-9]+$ - name: mode in: query description: >- soft (default): set deleted_at and hide the customer. PII is RETAINED and re-enrolment is possible. erase: irreversible GDPR erasure of PII. Neither mode removes a pass already on the customer's device. required: false example: soft schema: type: string enum: - soft - erase default: soft - name: Idempotency-Key in: header description: Recommended on PATCH and DELETE for safe retries. required: false example: 5f1c2a8b-7e4d-4a91-8c3b-90b2c4d8f3a1 schema: type: string maxLength: 255 format: uuid minLength: 8 pattern: ^[A-Za-z0-9_-]{8,255}$ requestBody: content: application/json: schema: {} responses: '200': description: Customer soft-deleted. content: application/json: schema: type: object properties: id: type: string object: type: string enum: - customer deleted_at: type: string format: date-time voided_card_count: type: integer examples: Soft deleted: summary: Soft deleted value: id: cus_yovo5wk634htfojgkzdpmzvu5a object: customer gdpr_redacted_at: null installed_at: null referral_stats: null last_visited_at: null last_visited_location_id: null deleted_at: '2026-06-30T00:00:00.000Z' deleted: true mode: soft GDPR erased: summary: GDPR erased value: id: cus_yovo5wk634htfojgkzdpmzvu5a object: customer gdpr_redacted_at: null installed_at: null referral_stats: null last_visited_at: null last_visited_location_id: null deleted_at: '2026-06-30T00:00:00.000Z' deleted: true mode: erase erased_at: 1782777600 erased_fields: - email - phone - first_name - last_name - date_of_birth - external_id - custom headers: {} '400': description: Malformed body or missing required field. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: type: invalid_request_error code: invalid_query_parameter message: Invalid value for a query parameter. doc_url: >- https://vexioncards.mintlify.site/api-reference/errors#invalid_query_parameter request_id: req_4d8b1e2f9c3a5 examples: Http 400 default: summary: Http 400 default value: error: type: invalid_request_error code: invalid_query_parameter message: Invalid value for a query parameter. doc_url: >- https://vexioncards.mintlify.site/api-reference/errors#invalid_query_parameter request_id: req_4d8b1e2f9c3a5 headers: {} '401': description: Missing, invalid, revoked, or paused API key. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: type: authentication_error code: missing_api_key message: >- Authorization header is required. Send 'Authorization: Bearer vxn_sk_...'. doc_url: >- https://vexioncards.mintlify.site/api-reference/errors#missing_api_key request_id: req_01jBhZK7G9K0L1M2N3P4Q5R6S7 examples: No API key: summary: No API key value: error: type: authentication_error code: missing_api_key message: >- Authorization header is required. Send 'Authorization: Bearer vxn_sk_...'. doc_url: >- https://vexioncards.mintlify.site/api-reference/errors#missing_api_key request_id: req_01jBhZK7G9K0L1M2N3P4Q5R6S7 API key revoked: summary: API key revoked value: error: type: authentication_error code: api_key_revoked message: >- This API key has been revoked. Mint a new key from the dashboard at https://app.vexioncards.one/settings/developers. doc_url: >- https://vexioncards.mintlify.site/api-reference/errors#api_key_revoked request_id: req_JmvD2EPPb0rnPChE3zcaGqeN5Q API key paused: summary: API key paused value: error: type: authentication_error code: api_key_paused message: This API key is paused. Resume it from the dashboard. doc_url: >- https://vexioncards.mintlify.site/api-reference/errors#api_key_paused request_id: req_H9ZafNwZRQFMS9fxcFWXaCjDPG headers: {} '403': description: API key lacks the required scope. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: type: permission_error code: insufficient_scope message: This API key does not have the customers:write scope. doc_url: >- https://vexioncards.mintlify.site/api-reference/errors#insufficient_scope request_id: req_01jBhZKHH0L1M2N3P4Q5R6S7T8 examples: Insufficient scope: summary: Insufficient scope value: error: type: permission_error code: insufficient_scope message: This API key does not have the customers:write scope. doc_url: >- https://vexioncards.mintlify.site/api-reference/errors#insufficient_scope request_id: req_01jBhZKHH0L1M2N3P4Q5R6S7T8 headers: {} '404': description: Resource not found in your organization. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: type: not_found_error code: resource_missing message: >- Customer 'cus_does_not_exist' was not found in this organization. param: id doc_url: >- https://vexioncards.mintlify.site/api-reference/errors#resource_missing request_id: req_01jBhZKTJ1M2N3P4Q5R6S7T8U9 examples: Customer not found: summary: Customer not found value: error: type: not_found_error code: resource_missing message: >- Customer 'cus_does_not_exist' was not found in this organization. param: id doc_url: >- https://vexioncards.mintlify.site/api-reference/errors#resource_missing request_id: req_01jBhZKTJ1M2N3P4Q5R6S7T8U9 headers: {} '409': description: >- Idempotency-key reuse, balance constraint violated, or already-processed conflict. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: type: invalid_request_error code: idempotency_key_in_use message: >- An earlier request with the same Idempotency-Key is still processing. Retry in a few seconds. doc_url: >- https://vexioncards.mintlify.site/api-reference/errors#idempotency_key_in_use request_id: req_3f1e9d7c5b2a4 examples: Http 409 default: summary: Http 409 default value: error: type: invalid_request_error code: idempotency_key_in_use message: >- An earlier request with the same Idempotency-Key is still processing. Retry in a few seconds. doc_url: >- https://vexioncards.mintlify.site/api-reference/errors#idempotency_key_in_use request_id: req_3f1e9d7c5b2a4 headers: {} '413': description: >- Request body exceeds the 1 MB cap. The body was never parsed, so the request had no effect. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: type: invalid_request_error code: request_too_large message: The request body exceeds the maximum allowed size. doc_url: >- https://vexioncards.mintlify.site/api-reference/errors#request_too_large request_id: req_5f8b2c4a9e1d3 '429': description: Per-minute or per-day rate limit exceeded. Respect Retry-After. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: type: rate_limit_error code: rate_limited message: Too many requests. Try again in 5 seconds. retry_after: 5 doc_url: >- https://vexioncards.mintlify.site/api-reference/errors#rate_limited request_id: req_2c8e4f6a9d1b3 examples: Http 429 default: summary: Http 429 default value: error: type: rate_limit_error code: rate_limited message: Too many requests. Try again in 5 seconds. retry_after: 5 doc_url: >- https://vexioncards.mintlify.site/api-reference/errors#rate_limited request_id: req_2c8e4f6a9d1b3 headers: {} '500': description: Server error. Retry-safe on idempotent calls. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: type: api_error code: internal_error message: >- An internal error occurred. The request may be retried with the same Idempotency-Key. doc_url: >- https://vexioncards.mintlify.site/api-reference/errors#internal_error request_id: req_5f8b2c4a9e1d3 examples: Http 500 default: summary: Http 500 default value: error: type: api_error code: internal_error message: >- An internal error occurred. The request may be retried with the same Idempotency-Key. doc_url: >- https://vexioncards.mintlify.site/api-reference/errors#internal_error request_id: req_5f8b2c4a9e1d3 headers: {} deprecated: false components: schemas: Error: type: object required: - error properties: error: type: object required: - type - code - message properties: type: type: string enum: - invalid_request_error - authentication_error - permission_error - not_found_error - rate_limit_error - idempotency_error - api_error code: type: string message: type: string retry_after: type: integer description: >- Seconds to wait before retrying. Present on rate-limit (429) and idempotency-key-in-use (409) errors; mirrors the `Retry-After` HTTP header. Absent on error types that carry no retry guidance. example: 5 param: type: - string - 'null' request_id: type: string doc_url: type: string format: uri field_errors: type: array description: >- Per-field errors on a 422. At most 100 entries: a request with more errors gets the first 100. items: type: object properties: param: type: string code: type: string message: type: string expected_currency: type: string description: >- On `currency_mismatch`: the business currency the request must use. Absent on every other field error. description: >- The error payload: type (category), code (machine-readable), message (human-readable), retry_after (seconds, on rate-limit/idempotency-in-use errors only), param (offending field), request_id, doc_url, field_errors[]. description: >- Standard error envelope. Branch on `error.code`; include `error.request_id` in support requests. See the Errors guide. securitySchemes: apiKey: type: http scheme: bearer description: >- Your secret API key as a Bearer token: `Authorization: Bearer vxn_sk_...`. Keys are created and scoped in the dashboard - see [Authentication](/api-reference/introduction#authentication). ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.