VUZDevelopers

Soft delete a document

DELETE
/documents/{id}

Performs a soft delete on a document. IMPORTANT: This operation has different implications based on document status.

DRAFT Documents:

  • Soft delete allowed
  • Document marked with deletedAt timestamp
  • No longer appears in queries
  • Can be recovered by database administrator
  • No impact on numbering sequences
  • No tax compliance concerns

ISSUED Documents:

  • Deletion NOT recommended - use CANCEL status instead
  • Issued documents should remain in system for audit trail
  • Israeli tax law requires preserving issued invoices
  • Consider using status transition to CANCELED instead
  • Soft delete still possible but creates compliance risk

CANCELED Documents:

  • Soft delete allowed but not recommended
  • Better to keep canceled documents for complete audit trail
  • Document number preserved even after soft delete

Recommended Workflow:

  1. DRAFT documents: Can be safely soft deleted if no longer needed
  2. ISSUED documents: Use CANCEL status transition, not soft delete
  3. CANCELED documents: Keep for audit trail, avoid soft delete

Multi-Tenant Security: Only users who own the business that created this document can delete it.

Why Soft Delete?: Soft delete (setting deletedAt timestamp) preserves data for:

  • Audit compliance requirements (7+ years in Israel)
  • Historical financial reporting
  • Legal disputes or investigations
  • Accidental deletion recovery

Permanent Deletion: Permanent deletion requires direct database access and should only be done:

  • After statutory retention period expires
  • By database administrator
  • With proper authorization and documentation

Alternative to Deletion: For issued documents, instead of deleting, transition status from ISSUED to CANCELED via a status update endpoint. This preserves document number and audit trail while marking document as void.

X-Api-Key<token>

Business API key, e.g. vuz_ab12cdef... Created via Settings → Integrations → API Keys. Unlike partner keys, a public API key's STRING does not encode its environment — isolation instead comes from a completely separate sandbox database: a key minted on the Sandbox server (above) only ever reads/writes sandbox data and can never see or affect production, regardless of what the key looks like.

In: header

Path Parameters

id*string

Document unique identifier (UUID)

Response Body

application/json

application/json

application/json

application/json

curl -X DELETE "https://example.com/documents/880e8400-e29b-41d4-a716-446655440000"
{  "message": "Document deleted successfully"}