POSThttps://api.veriko.mx/v1/validations/{id}/purge/prepare

Prepare the permanent deletion of a validation

Audience: public
Auth: API key
Permission: validations:delete

Describes what the permanent deletion of one of your own validations would delete and issues the token with which POST /v1/validations/{id}/purge/execute confirms it. It changes nothing: the validation and its files stay as they were.

DELETE /v1/validations/{id} only removes the validation from the history; the record, the CEP, the extracted data, and the receipt file keep existing. The permanent deletion, in two steps, eliminates them.

The response includes:

confirmation_token: Single-use token, bound to the account and to this validation, that expires in expires_in seconds.
will_delete: What will be deleted: the file, the CEP, the fields with content, and the number of derived records.
will_keep: The fields the tombstone the validation is left as keeps.
cancels_pending_retries: true when there is an open retry cycle, which the deletion cancels.
same_image_validation_ids: Other validations of the account with the same receipt, which are not touched.
irreversible: true always.

Only one of your own validations in a terminal status is accepted. A validation in progress responds with an HTTP status 409 (with purge_validation_in_progress in the body), and one already purged, with an HTTP status 410 (with validation_purged in the body).

The tombstone, what is deleted, and the limitations are in the retention of receipts and data.

Parameters
Parameter	In	Type	Required	Description
`id`*	path	`string (uuid)`	required	Validation UUID.

Request

cURLPython•JavaScript•PHP•

curl -X POST 'https://api.veriko.mx/v1/validations/{id}/purge/prepare' \
  -H 'Authorization: Bearer veriko_••••' \
  -H 'Content-Type: application/json'

Python example — coming soon.

JavaScript example — coming soon.

PHP example — coming soon.

**Response 200**`ValidationPurgePrepareResponse` — Summary of what would be deleted and the confirmation token. The validation did not change.
Field	Type	Description
`data`*	`object`	JSON:API resource of the preparation. Its `id` is the validation's.
`type`*	`string`	Resource type, fixed for this operation. Part of its identity in the JSON:API envelope. Always `validation_purge`. e.g. `validation_purge`
`id`*	`string (uuid)`	Identifier of the validation that would be deleted. e.g. `3fa85f64-5717-4562-b3fc-2c963f66afa6`
`attributes`*	`object`	Summary of the deletion and the confirmation token.
`confirmation_token`*	`string`	Single-use token, bound to the account and to this validation, that `POST /v1/validations/{id}/purge/execute` requires in order to delete. It expires in `expires_in` seconds. e.g. `eyJhZG1pbl9pZCI6Ii4uLiJ9.q1w2e3r4t5y6u7i8o9p0`
`expires_in`*	`integer`	Seconds the token stays valid. e.g. `120`
`irreversible`*	`boolean`	`true` in every response: the deletion cannot be undone. An infrastructure backup does not reverse it for the client. e.g. `true`
`will_delete`*	`object`	What the permanent deletion would delete.
`image`*	`boolean`	`true` when there is a receipt file (image or PDF) that would be deleted. e.g. `true`
`cep`*	`boolean`	`true` when there is a CEP (the XML or the PDF) that would be deleted. e.g. `true`
`stored_data`*	`array`	Validation fields with content that would be emptied. Of `normalized_data`, only the amount is kept. e.g. `["request_data","ocr_result","normalized_data","banxico_result"]`
`retry_attempts`*	`integer`	Number of retry attempts that would be deleted. e.g. `2`
`probe_attempts`*	`integer`	Number of candidate-account probes that would be deleted. e.g. `0`
`webhook_deliveries`*	`integer`	Number of webhook deliveries of this validation whose sent body and receiver response would be removed. The record of each delivery is kept. e.g. `1`
`notifications`*	`integer`	Number of notification deliveries of this validation whose content would be emptied. The notifications in the account inbox would be deleted. e.g. `1`
`idempotency_responses`*	`integer`	Number of stored `Idempotency-Key` responses that would be deleted. e.g. `1`
`audit_traces`*	`boolean`	`true` in every response: the bodies of the audit rows that name the validation would be removed, and the free-form context of its security events would be reduced to ids and codes. e.g. `true`
`will_keep`*	`array`	Fields the tombstone the validation is left as keeps: enough for quota, statistics, finance, and history to keep adding up. e.g. `["id","validation_type","status","banxico_status","amount","created_at","purged_at"]`
`cancels_pending_retries`*	`boolean`	`true` when the validation has an open retry cycle, which the deletion cancels. e.g. `false`
`refunds_quota`*	`boolean`	`false` in every response: the deletion neither refunds quota nor changes what was charged. e.g. `false`
`same_image_validation_ids`*	`array`	Identifiers of other validations of the same account with the same receipt (up to 20). They are not touched: each keeps its own copy of what was extracted and is deleted separately. e.g. `[]`

**Response status codes**`POST /v1/validations/{id}/purge/prepare`
Status	Class	Description	Body
200	`2xx`	Summary of what would be deleted and the confirmation token. The validation did not change.	`ValidationPurgePrepareResponse`
401	`4xx`	Authentication is required or the provided credentials are invalid.	`ErrorResponse`
403	`4xx`	Insufficient permissions.	`ErrorResponse`
404	`4xx`	Validation not found, or not owned by the account (`not_found`).	`ErrorResponse`
409	`4xx`	The validation is still in progress (`queued` or `processing`) and cannot be purged yet (`purge_validation_in_progress`, with the status in `meta.status`).	`ErrorResponse`
410	`4xx`	The validation was purged and this resource no longer exists (`validation_purged`).	`ErrorResponse`
422	`4xx`	Invalid UUID in path (`invalid_uuid`).	`ErrorResponse`
429	`4xx`	Rate limit exceeded	`ErrorResponse`

**Errors from `POST /v1/validations/{id}/purge/prepare`**
Status	Code	Example
401	`unauthorized`	Invalid or missing authentication credentials. Envelope meta.request_id `c4d5e6f7a8b99b8a7f6e5d4c`
403	`permission_denied`	You do not have permission to access this resource. Envelope meta.request_id `d5e6f7a8b9c00c9b8a7f6e5d`
410	`validation_purged`	The validation was purged and this resource no longer exists. Envelope meta.request_id `1a2b3c4d5e6ff6e5d4c3b2a1`
429	`rate_limit_exceeded`	Rate limit exceeded. Try again in 45 seconds. Envelope meta.request_id `f7a8b9c0d1e22e1d0c9b8a7f` Response headers `Retry-After`: integer — Seconds to wait before retrying. Matches the endpoint's rate-limit window (typically 60s for list endpoints, 1-5s for in-flight idempotent operations). `X-RateLimit-Limit`: integer — Configured request cap for this bucket. It is emitted on every 429 and, on the authenticated API, also on successful responses, where it is the per-key cap of the account plan. `X-RateLimit-Remaining`: integer — Requests remaining in the current window. Always 0 at the moment of the 429; on a successful response of the authenticated API it is what is left of the per-key cap. `X-RateLimit-Reset`: integer — Absolute Unix epoch (seconds) when the window resets. Emitted on every 429, alongside Retry-After, and on successful responses of the authenticated API. Per-endpoint overrides exist (e.g. `rate_limited_login`).