Skip to content

Delete or export an RP

Both actions are in the RP portal, on the RP's detail page. Both are owner-only and require an AAL2 session with a fresh step-up.

Export the RP's audit bundle

Use Export on the RP detail page. The portal downloads a gzip tar archive containing the RP's verifiable audit bundle.

The same data is available through the management API:

GET /api/v1/rp/rps/{rp_id}/export
GET /api/v1/rp/rps/{rp_id}/export?prev_sth=<RFC3339-timestamp>

prev_sth is optional. If you pass a head timestamp you already hold, the bundle includes a consistency proof from that head to the export head. The response is application/gzip with Cache-Control: no-store.

If the bundle is not ready yet, the API returns 503 export_not_ready — retry shortly. The export contains audit records; it does not contain claim values.

Delete the RP

Deletion is a global teardown, not a local archive:

  1. Every account with a live consent at the RP is logged out (back-channel logout where configured) and its consent sessions are deleted.
  2. The OIDC client is invalidated.
  3. A final verifiable bundle is built before the audit tree is closed.
  4. The registry row becomes a deleted tombstone.
  5. The RP's audit tree is retained. At the retention horizon, the registry row and remaining PII are purged and an rp.purged event is recorded; the audit history survives.

Consequences to state to your users before you delete:

  • access stops for every user of the RP, not just one tenant or account;
  • a deleted RP cannot be restored (re-register it if you need it again);
  • tokens and consents for the RP stop working;
  • the audit trail remains available for compliance.

Deletion is idempotent: repeating it on an already-deleted RP is a no-op. To stop new consents while you decide, use Suspend first; Reinstate reverses a suspension without deleting anything.

API endpoints

Action Endpoint
Suspend POST /api/v1/rp/rps/{rp_id}/suspend
Reinstate POST /api/v1/rp/rps/{rp_id}/reinstate
Delete POST /api/v1/rp/rps/{rp_id}/delete
Export GET /api/v1/rp/rps/{rp_id}/export

These are first-party portal endpoints: they use your portal session (AAL2 + step-up + CSRF header), not the RP's client secret.