Implement DELETE HTTP verb about balanced-api

[mjallday]

The issue that we run into is that once a resource, such as a card, is used for an operation it's very hard to properly perform a DELETE operation on it. If we delete the card, what do we show as the source for the payments associated with that card?

My suggestion is that we remove the vaulted card details (satisfying the requirement of purging the data) while retaining the card name / last_four and mark it deleted. This card would then no longer be returned via a GET on the cards index URI but it would still be able to be returned if you did a GET on the actual URI of the card itself. It would return a deleted_at field which shows the date the DELETE operation was performed.

For other resources the DELETE operation would be similar, a hard delete if there are no dependencies, a soft delete (marked deleted and not returned via index operations) if other items depend on it.

[matin]

DELETE api_keys already works. Create an issue per resource, so there can be separate discussions. The ramification of deleting an instance of a different resource varies

[matin]

This is being done in the ach branch and should be ported back.

[aac]

Is this still a WIP? We'd like to be able to delete accounts and cards via API.

[chadwhitacre]

My suggestion is that we remove the vaulted card details (satisfying the requirement of purging the data) while retaining the card name / last_four and mark it deleted.

This would be acceptable.

[quellhorst]

👍

[matin]

DELETE should be supported on the following resources

Cards

DELETE will act as an unstore operation

Bank Accounts

This is supported on /v1/bank_accounts but not on /v1/marketplaces/:marketplace_id/bank_accounts. The later is going to be deprecated once the Customers resource is introduced.

Holds

A DELETE will be overloaded to void the hold, which will be the equivalent of setting is_void = true. The account object will still exist for further reference, but it's more clear to use a DELETE on a hold than updating the is_void field. By making this change, it also becomes possible to deprecate is_void and introduce voided_at.

[mahmoudimus]

I propose we allow DELETE of accounts/customers if they have no transactions associated to them. There's a pretty good use case that some customers are experiencing where they're creating test accounts in production marketplaces that are never used and email us to delete them via support. We should support this.

[matin]

@mahmoudimus +1

[mrtrosen]

@mahmoudimus +1 We have had issues on our end where we create a bank account, and have an error, that caused the bank account to not be associated with an account, so there is data laying around that will only get messy later on.

[eblanshey]

@mahmoudimus +1. Deleting accounts if there are no transactions would be great. It would help clean up inactive users and test users.

+1

DELETE is crucial for our customers that are very suspicious of their cards being stored online (as unreasonable as that may be, we're not going to be able to change the culture of our audience)...

[trenton42]

We have had a issue where a merchant does not complete a failed verification, then gives up. This leaves some empty accounts that have no roles, and no other data associated with them.

So +1 on deleting accounts with no transactions associated with them.

[o100ja]

+1 on DELETE for accounts w/o transactions.

I'd like to see this feature at least in TEST marketplaces so that we can develop further functionality more easily and without confusion.

[mjallday]

The customers endpoint implements DELETE, I do not believe we're going to port this back to accounts.

DELETE is implemented for:

• Customers without transactions
• Cards and bank accounts associated under customers. (DELETE in this case will invalidate the card and stop it from being returned via index requests)

[matin]

@mjallday is this done?

[mjallday]

Partially implemented: Works on cards and bank accounts, will not be implemented for accounts, and has not been implemented yet for marketplaces.

[matin]

@remear @cieplak has this been documented properly?

[remear]

It's documented for cards and bank accounts.

It is not yet documented for Customer.

[remear]

It's now documented for Customer. https://docs.balancedpayments.com/current/api.html?language=bash#delete-a-customer

[mjallday]

The example uses the POST verb, not DELETE:

Definition

DELETE https://api.balancedpayments.com/v1/customers/:customer_id

Request

curl https://api.balancedpayments.com/v1/customers/CU4X4fhZ5txOKbKpqTC0fMh9
-u 82be5036022e11e3b844026ba7f8ec28:
-X POST

[remear]

Fixed by balanced/balanced-docs#230

[steveklabnik]

We don't generally encourage deletion, but it's used appropriately now where it should be.