Delete an asset
DELETE/assets/:id
Deletes an asset and returns it with deletedAt set. The asset is only hidden, never destroyed: POST /assets/{assetId}/undelete restores it, and ?showDeleted=true still reads it.
Request
Responses
- 200
- 400
- 401
- 403
- 404
- 409
- 412
- 429
- 503
OK. The deleted asset, deletedAt set (or the replay of an earlier delete).
Response Headers
Strong hash of the asset state.
Bad Request. The Idempotency-Key header is malformed (INVALID_IDEMPOTENCY_KEY).
Unauthorized. Missing, malformed, unknown, revoked, or expired bearer token — or the token owner no longer holds the required entitlement (ENTITLEMENT_LOST). A uniform problem body is returned with a distinct code; no owner/condition detail (no-leak).
Forbidden. The key lacks the assets:write scope (API_TOKEN_SCOPE_DENIED).
Not Found (ASSET_NOT_FOUND). No usable asset with this id belongs to the key's account. An asset of another account, a deleted one (except for DELETE and undelete, which act on it), or one without a stored url returns this SAME uniform 404 (no-leak).
Conflict. A request under this key is still in progress (IDEMPOTENCY_IN_PROGRESS, retry after Retry-After); or the key was already used for a different request (IDEMPOTENCY_KEY_REUSED).
Response Headers
Seconds to wait before retrying — on IDEMPOTENCY_IN_PROGRESS only.
Precondition Failed (PRECONDITION_FAILED). If-Match no longer matches the asset. Nothing was changed; read it again and retry.
Too Many Requests. The per-token sliding window of 60 requests/minute was exceeded. The body is express-rate-limit's DEFAULT plain-text message (NOT the JSON problem+json envelope).
Response Headers
IETF draft-7 rate-limit policy/state (limit, remaining, reset).
Seconds to wait before retrying.
Service Unavailable (WRITES_PAUSED). Writes are paused for this account right now. Nothing was changed and the Idempotency-Key was not consumed, so retry the SAME request after Retry-After. Reads are unaffected.
Response Headers
Seconds to wait before retrying.