Tvarka ATK API Erasure API
The Erasure API from Tvarka ATK API — 3 operation(s) for erasure.
OpenAPI Specification
openapi: 3.2.0
info:
title: Tvarka Atk Erasure API
version: 1.3.0
description: 'Operations tagged Erasure across 3 of this provider''s published API definitions: tvarka-atk-api-auth-openapi.yaml, tvarka-atk-api-openapi-original.json, tvarka-atk-api-sign-openapi.yaml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://atk.tvarka.pro/v1
description: 'Production. Sandbox runs on the same host - provider credentials issued with
environment=sandbox get the identical API against test-card material and are never billed.
'
security:
- basicAuth: []
tags:
- name: Erasure
paths:
/auth/{requestId}/delete:
servers:
- url: https://atk.tvarka.pro/v1
description: 'Production. Sandbox runs on the same host - provider credentials issued with
environment=sandbox get the identical API against test-card material and are never billed.
'
post:
tags:
- Erasure
operationId: deleteAuthRequest
summary: Erase one request on demand (GDPR)
description: 'Basic only, scoped to the caller''s own provider. A non-terminal request is cancelled first,
then its document/result bytes + derived personal data are purged (exactly what the retention
job strips); a de-identified audit row remains. Idempotent.
'
security:
- basicAuth: []
parameters:
- $ref: '#/components/parameters/RequestId'
responses:
'200':
description: Erased.
content:
application/json:
schema:
type: object
properties:
requestId:
type: string
format: uuid
deleted:
type: boolean
'404':
$ref: '#/components/responses/NotFound'
/erasure:
servers:
- url: https://atk.tvarka.pro/v1
description: 'Production. Sandbox runs on the same host - provider credentials issued with
environment=sandbox get the identical API against test-card material and are never billed.
'
post:
tags:
- Erasure
operationId: bulkErasure
summary: Bulk-erase the provider's terminal requests (GDPR)
description: 'Basic only. Purges document/result bytes + derived personal data of every TERMINAL,
not-yet-purged request of the calling provider (auth and sign alike); optional `before`
(ISO-8601) restricts to requests last updated before that moment. In-flight requests are
left untouched - erase them individually if intended.
'
security:
- basicAuth: []
requestBody:
required: false
content:
application/json:
schema:
type: object
properties:
before:
type: string
format: date-time
responses:
'200':
description: Erasure summary.
content:
application/json:
schema:
type: object
properties:
purged:
type: integer
failed:
type: integer
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
'503':
$ref: '#/components/responses/ServiceUnavailable'
/sign/{requestId}/delete:
servers:
- url: https://atk.tvarka.pro/v1
description: 'Production. Sandbox runs on the same host - provider credentials issued with
environment=sandbox get the identical API against test-card material and are never billed.
'
post:
tags:
- Erasure
operationId: deleteSignRequest
summary: Erase one request on demand (GDPR)
description: 'Basic only, scoped to the caller''s own provider. A non-terminal request is cancelled first,
then its document/container bytes + derived personal data are purged (exactly what the
retention job strips); a de-identified audit row remains. Idempotent. Bulk erasure lives on
the base API (`POST /v1/erasure`) and covers sign requests too.
'
security:
- basicAuth: []
parameters:
- $ref: '#/components/parameters/SignRequestId'
responses:
'200':
description: Erased.
content:
application/json:
schema:
type: object
properties:
requestId:
type: string
format: uuid
deleted:
type: boolean
'404':
$ref: '#/components/responses/SignNotFound'
components:
parameters:
RequestId:
name: requestId
in: path
required: true
description: The `requestId` returned by `POST /auth/requests`.
schema:
type: string
format: uuid
SignRequestId:
name: requestId
in: path
required: true
schema:
type: string
format: uuid
responses:
NotFound:
description: Unknown request.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
BadRequest:
description: Malformed input.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
Unauthorized:
description: Missing/invalid credentials or client token.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
ServiceUnavailable:
description: A required remote or erasure service is temporarily unavailable.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
SignNotFound:
description: Unknown request.
content:
application/json:
schema:
$ref: '#/components/schemas/SignError'
schemas:
SignErrorCode:
type: string
description: 'The full stable error-code catalog of the ATK API family (auth + sign + services);
each endpoint returns the subset that applies to it. By HTTP status:
400 invalid_json, missing_field, invalid_field, invalid_webhook_url, invalid_document_ref.
401 invalid_basic_credentials, invalid_client_token, client_token_expired,
operation_token_expired, invalid_download_token.
403 origin_not_allowed, ip_not_allowed, format_not_allowed, document_ref_host_not_allowed,
method_not_allowed, tenant_suspended, tier_forbidden.
404 request_not_found, pairing_not_found, document_not_ready.
409 request_terminal, operation_token_spent, identity_swap, idempotency_conflict,
service_in_progress, pairing_not_available, pairing_already_claimed.
410 pairing_expired. 413 document_too_large.
422 cert_invalid, untrusted_chain, cert_revoked, cert_expired, not_qualified,
cert_purpose_mismatch, signature_invalid, document_hash_mismatch, document_size_mismatch.
429 rate_limited. 500 assembly_failed. 502 document_ref_fetch_failed.
503 erasure_failed, pairing_service_unavailable, service_unavailable.
The catalog can grow in minor versions - fall back to HTTP status semantics
for codes you do not recognize.
'
enum:
- invalid_json
- missing_field
- invalid_field
- invalid_webhook_url
- invalid_document_ref
- invalid_basic_credentials
- invalid_client_token
- client_token_expired
- operation_token_expired
- invalid_download_token
- origin_not_allowed
- ip_not_allowed
- format_not_allowed
- document_ref_host_not_allowed
- method_not_allowed
- tenant_suspended
- tier_forbidden
- request_not_found
- pairing_not_found
- document_not_ready
- request_terminal
- operation_token_spent
- identity_swap
- idempotency_conflict
- service_in_progress
- pairing_not_available
- pairing_already_claimed
- pairing_expired
- document_too_large
- cert_invalid
- untrusted_chain
- cert_revoked
- cert_expired
- not_qualified
- cert_purpose_mismatch
- signature_invalid
- document_hash_mismatch
- document_size_mismatch
- rate_limited
- assembly_failed
- document_ref_fetch_failed
- erasure_failed
- pairing_service_unavailable
- service_unavailable
SignErrorBody:
type: object
required:
- code
- message
properties:
code:
$ref: '#/components/schemas/SignErrorCode'
description: 'Stable machine code. documentRef failures use `invalid_document_ref`,
`document_ref_host_not_allowed`, `document_ref_fetch_failed`,
`document_size_mismatch`, `document_hash_mismatch`, or `document_too_large`.
'
message:
type: string
requestId:
type: string
format: uuid
retryable:
type: boolean
ErrorBody:
type: object
required:
- code
- message
properties:
code:
$ref: '#/components/schemas/ErrorCode'
message:
type: string
requestId:
type: string
format: uuid
retryable:
type: boolean
Error:
type: object
required:
- error
properties:
error:
$ref: '#/components/schemas/ErrorBody'
SignError:
type: object
required:
- error
properties:
error:
$ref: '#/components/schemas/SignErrorBody'
ErrorCode:
type: string
description: 'The full stable error-code catalog of the ATK API family (auth + sign + services);
each endpoint returns the subset that applies to it. By HTTP status:
400 invalid_json, missing_field, invalid_field, invalid_webhook_url, invalid_document_ref.
401 invalid_basic_credentials, invalid_client_token, client_token_expired,
operation_token_expired, invalid_download_token.
403 origin_not_allowed, ip_not_allowed, format_not_allowed, document_ref_host_not_allowed,
method_not_allowed, tenant_suspended, tier_forbidden.
404 request_not_found, pairing_not_found, document_not_ready.
409 request_terminal, operation_token_spent, identity_swap, idempotency_conflict,
service_in_progress, pairing_not_available, pairing_already_claimed.
410 pairing_expired. 413 document_too_large.
422 cert_invalid, untrusted_chain, cert_revoked, cert_expired, not_qualified,
cert_purpose_mismatch, signature_invalid, document_hash_mismatch, document_size_mismatch.
429 rate_limited. 500 assembly_failed. 502 document_ref_fetch_failed.
503 erasure_failed, pairing_service_unavailable, service_unavailable.
The catalog can grow in minor versions - fall back to HTTP status semantics
for codes you do not recognize.
'
enum:
- invalid_json
- missing_field
- invalid_field
- invalid_webhook_url
- invalid_document_ref
- invalid_basic_credentials
- invalid_client_token
- client_token_expired
- operation_token_expired
- invalid_download_token
- origin_not_allowed
- ip_not_allowed
- format_not_allowed
- document_ref_host_not_allowed
- method_not_allowed
- tenant_suspended
- tier_forbidden
- request_not_found
- pairing_not_found
- document_not_ready
- request_terminal
- operation_token_spent
- identity_swap
- idempotency_conflict
- service_in_progress
- pairing_not_available
- pairing_already_claimed
- pairing_expired
- document_too_large
- cert_invalid
- untrusted_chain
- cert_revoked
- cert_expired
- not_qualified
- cert_purpose_mismatch
- signature_invalid
- document_hash_mismatch
- document_size_mismatch
- rate_limited
- assembly_failed
- document_ref_fetch_failed
- erasure_failed
- pairing_service_unavailable
- service_unavailable
securitySchemes:
basicAuth:
type: http
scheme: basic
description: 'Provider server-to-server credentials `keyId:keySecret`. Server-to-server only, also gated by the
provider''s server IP allow-list. Never placed in a browser/mobile client.
'
clientToken:
type: http
scheme: bearer
bearerFormat: JWT
description: 'Short-lived, per-request JWT (`ES256`) minted at request creation, scoped
`{tenant, requestId, purpose, method, allowedOrigins}`. Safe to hand to a browser/mobile client:
it cannot create requests, read tenant data, or touch other requests. For browser clients the API
enforces `Origin` against `allowedOrigins` (rejects cross-origin replay).
'
downloadToken:
type: apiKey
in: query
name: downloadToken
description: One-off token returned with a completed sign result, for fetching the signed document.
externalDocs:
description: Quickstart, SDKs, test data, pricing and lifecycle policy
url: https://atk.tvarka.pro/docs/
x-refined-from:
- tvarka-atk-api-auth-openapi.yaml
- tvarka-atk-api-openapi-original.json
- tvarka-atk-api-sign-openapi.yaml