Erase a direct order (LGPD)
Crypto-shreds one direct order: its intake (every revision’s sealed body and DEK; clientOrderId and externalReference become keyed tokens, the normative keys stay so a resubmission is never a new order), its execution_order revisions and its block rows, in ONE transaction with the audit row (event LGPD_CRYPTO_ELIMINATION, entity EXECUTION_ORDER). If the audit write fails nothing is erased. The execution journal and the result outbox keep their pseudonymous residue (ids and amounts): an append-only accounting and audit record. A human platform-administrator action (direct_order_erasure:erase, never held by M2M): an application token (SBJ-0044) or a tenant-carrying token (SBJ-0045) is refused with 403. 200 outcome noop: already erased (audited again). 404 SBJ-0015: unknown order, or one of an institution this executor does not own. 409 SBJ-0056: not eligible (the purge-eligibility predicate, or a child whose parent is not erased). 409 SBJ-0057: permanent block in force, or its end unreadable. 422 SBJ-0058: reason, ticket or note invalid. 422 SBJ-0059: multi-tenant deployment.
Authorizations
JWT bearer token issued by the identity provider.
Path Parameters
The direct order's identifier (UUID).
"0b9b7c2e-4f8a-4d3e-9a51-7c2d1e0f3a44"
Body
Optional note (at most 256 characters, no personal data). Stored sealed in the audit trail; never echoed when refused.
"DPO request routed by the institution."
Required: lgpd-subject-request (a data subject's request) or retention-purge (retention ended).
"lgpd-subject-request"
Required: the request id the erase is filed under (at most 64 characters, no personal data). Stored sealed in the audit trail.
"LGPD-2026-0042"
Response
OK
Instant of the request (UTC).
Subject of the platform administrator who made the request.
The direct order's identifier.
erased: this request erased the order. noop: it was already erased (audited again).
erased, noop Rows shredded beyond the intake.

