Redact tenant metadata and party references
Right-of-erasure. Wipes metadata on every transaction,
posting, account, event, and webhook delivery payload owned by
the tenant, and replaces party-reference keys
(counterparty_ref, sender_party_id, recipient_party_id)
with the literal string REDACTED.
Postings, balances, value dates, currencies, and amounts remain.
That is the financial substance retention law requires us to
keep. See docs/decisions/2026-05-27-platform-open-questions.md
(Q6) for the full rationale.
Irreversible. All-or-nothing per tenant.
Auth: requires ledger:write AND a bearer token issued in the
last 5 minutes. A stale token returns 401 fresh_authentication_required.
Authorizations
Same flow; ledger:write is required for any mutation.
Body
Response
Anonymization completed.