Erase a direct order (LGPD)

Crypto-shreds one direct order: its intake (every revision’s sealed body and DEK; clientOrderId and externalReference become keyed tokens, the normative keys stay so a resubmission is never a new order), its execution_order revisions and its block rows, in ONE transaction with the audit row (event LGPD_CRYPTO_ELIMINATION, entity EXECUTION_ORDER). If the audit write fails nothing is erased. The execution journal and the result outbox keep their pseudonymous residue (ids and amounts): an append-only accounting and audit record. A human platform-administrator action (direct_order_erasure:erase, never held by M2M): an application token (SBJ-0044) or a tenant-carrying token (SBJ-0045) is refused with 403. 200 outcome noop: already erased (audited again). 404 SBJ-0015: unknown order, or one of an institution this executor does not own. 409 SBJ-0056: not eligible (the purge-eligibility predicate, or a child whose parent is not erased). 409 SBJ-0057: permanent block in force, or its end unreadable. 422 SBJ-0058: reason, ticket or note invalid. 422 SBJ-0059: multi-tenant deployment.

POST /v1/admin/direct/orders/{orderId}/erase

Erase a direct order (LGPD)

cURL

curl --request POST \
  --url https://api.example.com/v1/admin/direct/orders/{orderId}/erase \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "note": "DPO request routed by the institution.",
  "reason": "lgpd-subject-request",
  "ticket": "LGPD-2026-0042"
}
'

200

{
  "erasedAt": "2023-11-07T05:31:56Z",
  "erasedBy": "<string>",
  "orderId": "<string>",
  "outcome": "erased",
  "rows": {
    "dailyAttempt": 123,
    "executionOrder": 123,
    "judicialBlock": 123,
    "permanentBlock": 123
  }
}

Autorizaciones

Authorization · string · header · requerido

JWT bearer token issued by the identity provider.

Parámetros de ruta

orderId · string · requerido

The direct order's identifier (UUID).

Ejemplo:

"0b9b7c2e-4f8a-4d3e-9a51-7c2d1e0f3a44"

Cuerpo

application/json

note · string

Optional note (at most 256 characters, no personal data). Stored sealed in the audit trail; never echoed when refused.

Ejemplo:

"DPO request routed by the institution."

reason · string

Required: lgpd-subject-request (a data subject's request) or retention-purge (retention ended).

Ejemplo:

"lgpd-subject-request"

ticket · string

Required: the request id the erase is filed under (at most 64 characters, no personal data). Stored sealed in the audit trail.

Ejemplo:

"LGPD-2026-0042"

Respuesta

200

application/json

OK

erasedAt · string<date-time> · requerido

Instant of the request (UTC).

erasedBy · string · requerido

Subject of the platform administrator who made the request.

orderId · string · requerido

The direct order's identifier.

outcome · enum<string> · requerido

erased: this request erased the order. noop: it was already erased (audited again).

Opciones disponibles: erased, noop

rows · object · requerido

Rows shredded beyond the intake.

Show child attributes