On this pageThe rule
The rule
The API never removes a record. Any DELETE request made with an API key is refused with 403, whatever the key’s scopes:
{"error": "method_not_allowed_for_api_keys"}Why
Under Regulation (EU) 2023/1542, a battery passport has to remain available for ten years (Art. 77). The identifier printed on the battery must keep resolving, and what the passport claimed has to stay answerable long after it was published. An integration that can delete passports can also break that obligation by accident — a sync job with a bad filter, a test script pointed at production.
So deletion is a deliberate act by a person, not something a machine does. It happens in the app, by a signed-in user, and is written to the audit trail with who did it and when.
What to do instead
| You want to… | Do this |
|---|---|
| Correct a value on a model | PATCH /models/{id} with the corrected fields. The change is recorded in the audit trail. |
| Record that a battery was recycled | POST /passports/{id}/recycle. The passport ceases and the resolver answers 410. |
| Mark many batteries as waste or recycled | POST /passports/bulk-lifecycle with event waste or recycle. |
| Remove something created by mistake | Delete it in the app, signed in. Every deletion is written to the audit trail. |
| Stop an integration from writing | Revoke its key in the app. Nothing it wrote is removed. |
| Stop webhook deliveries | PATCH /webhooks/{id} with enabled: false. The endpoint and its delivery log are kept. |
Recycling a battery
When a battery is recycled its passport ceases to exist (Art. 77(8)). Recording it is a write, not a delete: the passport moves to WASTE and its lifecycle state to CEASED_RECYCLED, a status change is appended to the history, and from then on the public resolver answers 410 Gone — so anyone scanning the code learns the battery was recycled rather than that the passport is missing.
curl -X POST "https://dppapi-production.up.railway.app/v1/passports/cm1q8y0bq0006l70fx9y8z7w6/recycle" \-H "Authorization: Bearer $DPP_API_KEY" \-H "Content-Type: application/json" \-d '{"note": "Received by recycler, certificate R-2031-0042"}'The body is optional; note (up to 500 characters) is kept on the history entry.