Erases the stored card or bank account details behind a token.

POST /api/tokens/{id}/redact deprecated

No permission required.

The token record itself is kept, so this is how to honour a deletion request when the record still has to exist. Deactivate only blocks future use and leaves the details stored; delete is refused while any transaction references the token. Redaction is the third answer: the card number, the cardholder name, the bank account and routing numbers, the MICR values, the writer's identification details and any stored processor or network token are erased, while the last four, the card brand, the expiry, the customer and merchant, and the record's own history are kept, so transactions taken on the token still read back the card they were taken on. This cannot be undone. A redacted token can no longer be charged, reactivated or regenerated: a charge against it is refused exactly as one against a deactivated token is, and reactivate and regenerate answer with a coded conflict. Redacting an already redacted token changes nothing and returns the same state, so a retry is safe.

Try this in the console

Example request

Every block below sends the same request. Replace {{BASE_URL}} with the address of the API you are calling and {{API_KEY}} with your own key.

The request body is a RedactPaymentTokenInput. See the Request body section below for its fields.

cURL PowerShell TypeScript C# Python

cURL

curl -X POST "{{BASE_URL}}/api/tokens/{id}/redact" \
  -H "api-key: {{API_KEY}}" \
  -H "Content-Type: application/json" \
  -d '{
  "reason": ""
}'

PowerShell

$headers = @{
    'api-key' = '{{API_KEY}}'
}

$body = @'
{
  "reason": ""
}
'@

$response = Invoke-RestMethod -Method POST -Uri '{{BASE_URL}}/api/tokens/{id}/redact' `
    -Headers $headers -ContentType 'application/json' -Body $body

npm install @winkpg/winkpg-api

TypeScript (SDK)

import { Configuration, TokensApi } from '@winkpg/winkpg-api';

const api = new TokensApi(new Configuration({
  basePath: '{{BASE_URL}}',
  apiKey: '{{API_KEY}}',
}));

const { data } = await api.tokensRedact("3fa85f64-5717-4562-b3fc-2c963f66afa6", {
  "reason": ""
});

TypeScript (raw HTTP)

const response = await fetch('{{BASE_URL}}/api/tokens/{id}/redact', {
  method: 'POST',
  headers: {
    "api-key": "{{API_KEY}}",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "reason": ""
  }),
});

const data = await response.json();

dotnet add package WinkPg.Api.Client

C# (SDK)

using WinkPg.Api.Client.Api;
using WinkPg.Api.Client.Client;
using System.Text.Json;

var config = new Configuration { BasePath = "{{BASE_URL}}" };
config.AddApiKey("api-key", "{{API_KEY}}");

var api = new TokensApi(config);
var body = JsonSerializer.Deserialize<RedactPaymentTokenInput>("""
    {
      "reason": ""
    }
    """);

var result = await api.TokensRedactAsync(Guid.Parse("3fa85f64-5717-4562-b3fc-2c963f66afa6"), body);

C# (raw HTTP)

using System.Text;

using var http = new HttpClient { BaseAddress = new Uri("{{BASE_URL}}") };

var request = new HttpRequestMessage(new HttpMethod("POST"), "/api/tokens/{id}/redact");
request.Headers.Add("api-key", "{{API_KEY}}");

request.Content = new StringContent("""
    {
      "reason": ""
    }
    """, Encoding.UTF8, "application/json");

var response = await http.SendAsync(request);
response.EnsureSuccessStatusCode();
var json = await response.Content.ReadAsStringAsync();

pip install winkpg-api

Python (SDK)

import winkpg_api

configuration = winkpg_api.Configuration(host="{{BASE_URL}}")
configuration.api_key["ApiKey"] = "{{API_KEY}}"

with winkpg_api.ApiClient(configuration) as client:
    api = winkpg_api.TokensApi(client)
    body = winkpg_api.RedactPaymentTokenInput.from_dict({
      "reason": ""
    })
    result = api.tokens_redact("3fa85f64-5717-4562-b3fc-2c963f66afa6", body)

pip install requests

Python (raw HTTP)

import requests

headers = {
    "api-key": "{{API_KEY}}",
    "Content-Type": "application/json",
}

body = {
  "reason": ""
}

response = requests.request(
    "POST",
    "{{BASE_URL}}/api/tokens/{id}/redact",
    headers=headers,
    json=body,
)
response.raise_for_status()
data = response.json()

Parameters

Name	In	Type	Description
`id` required	path	string (uuid)	The token to redact.
`suppressNulls` required	query	boolean	If true, omit properties with null values.

Request body

application/json , required

Field	Type	Description
`reason` required	string	Why the stored details are being erased, for example the account deletion request this fulfils. Required, and recorded on the token and in the audit trail. It is stored in the clear, so do not put card, bank account or other sensitive values in it. nullable

This request body has no documented fields.