Appearance
Delete a card (the GDPR / offboarding path)
DELETE
/cards/{id}
The same service call the dashboard's delete makes, so every scrub that path performs — including the single-holder webhook payload scrub — applies here too. Requires an UNRESTRICTED key: a key limited to specific locations is refused with 403 location_scope_unsupported, and shop-wide data is never silently served to it instead. A card is not attributed to a location anywhere in TesserApp — it belongs to a program, and programs belong to the whole shop — so there is no correct subset of cards to serve such a key.
Authorizations
ApiKeyBearer
A shop-scoped API key created in the dashboard and shown exactly once. An MCP tmk_ key presented here returns a 401 that names the mistake.
Type
HTTP (bearer)
Parameters
Header Parameters
Idempotency-Key
Makes a retry safe: a repeat with the same key and body replays the stored response; the same key with a different body is a 409. Keys are remembered for 24h (IDEMPOTENCY_DEDUPE_WINDOW_HOURS). A request without the header is processed normally.
Type
string
Max Length
255Path Parameters
id*
An opaque id. The API never promises an id format.
Type
Requiredstring
Responses
Done. No content.
DELETE
/cards/{id}