Private preview
Redaction API integration guide Private preview
Redact personal data on objects to comply with "right to be forgotten" requests.
Caution
This feature is in private preview and subject to change.
The Redaction API allows you to redact individual resources to remove user access to personal data such as a customer’s name and address. This also redacts data on related objects such as events and request logs.
For each resource type, programmatically search for a list of IDs associated with the target customer, and call the corresponding /redact API endpoint. The redaction process can take up to 7 days to redact all requested data. When the redaction process is in progress, the entity’s redaction.status field is set to processing. When the process completes, the status changes to redacted.
Redaction is irreversible. You can still access redacted objects using the Stripe API and Stripe Dashboard. The string [redacted] or a similar placeholder replaces fields that contain personal data. The metadata field is also redacted. You can’t update redacted objects or use them for any purpose.
The Redaction API is currently available with invite to users. User feedback and usage actively defines the roadmap for the API.
Find objects to redact
The first step is to list all API objects that include customer data to redact.
If you don’t maintain an internal mapping of all Stripe objects associated with a customer in your internal database, you can use the Stripe API, the Stripe Dashboard, or Sigma to find these objects. The list of object types to redact depends on your integration with Stripe. The most common object types to consider are:
- Transactional objects that include customer data (charges, PaymentIntents, VerificationSessions)
- Payment method objects (cards)
- Objects that represent your customers (customer, cardholders)
Store the IDs of objects to redact and move to step 2.
If you map Stripe objects to your own representation of user accounts in your internal database, we recommend that you use this mapping to quickly find all objects to redact.
Find objects with the Stripe Dashboard
In the Stripe Dashboard follow these steps:
- Enter the customer’s personal data (name or email) in the search bar
- Search the results of all objects associated with this name or email address
- Export the object IDs for each object type with the Export button.
Find objects relating to guest customers
There isn’t an API to retrieve guest customers.
Search for the customer (using an identifier like email or name) in the Stripe Dashboard search box and include the string is:guest, then view all results.
is:guest
Find objects relating to Verification Sessions
There isn’t an API to filter for verification sessions based on customer information.
Search for the customer (using an identifier like email or name) in the Stripe Dashboard search box and include the string is:verification_session, then view all results.
is:verification_session
Find objects with the API
Find objects by customer ID
List each object of a given type associated with a customer ID.
Command Line
Select a language
cURL
Stripe CLI
Ruby
Python
PHP
Java
Node.js
Go
.NET
No results
Below are the API commands to use for finding objects associated with a customer ID:
- /v1/charges
- /v1/payment_intents
- /v1/setup_intents
- /the relevant part of the product
Find objects related to cardholders and cards
There are two options for finding and redacting cards and cardholders.
The simplest option is to find and redact the cardholder, which redacts all of the associated cards. Alternatively, you can find all of the card objects associated with the cardholder manually.
List cardholders objects ( /the relevant part of the product) for a customer using their personal data (email address or name)
Command Line
Select a language
cURL
Stripe CLI
Ruby
Python
PHP
Java
Node.js
Go
.NET
No results
List cards ( /the relevant part of the product) belonging to the cardholders from the list above.
Command Line
Select a language
cURL
Stripe CLI
Ruby
Python
PHP
Java
Node.js
Go
.NET
No results
Find objects relating to Radar value list items
Radar users who have entered customer details into their rules need to find associated value list items.
List the Radar value lists ( /the relevant part of the product), and filter for those that contain an identifier for the data subject (for example, the customer’s email address).
Command Line
Select a language
cURL
Stripe CLI
Ruby
Python
PHP
Java
Node.js
Go
.NET
No results
Later redact each of the rsli_... ids in the list_items results.
Redact each object
Build a script to call the /redact endpoint for each object found above.
This asynchronously redacts the object and dependent objects across all product interfaces (the Stripe API, the Stripe Dashboard, and reports). Redaction typically happens within minutes, but can take up to 7 days for certain objects (for example, existing CSV reports).
The redaction API is currently in beta and isn’t yet supported by Stripe’s client libraries. Make the HTTP request directly using curl or a similar tool. When making the curl request you must include the beta version as part of the Stripe-Version header.
Command Line
cURL
The endpoint returns a success (200) or failure (400) response:
{
"id": "pi_xxxxxxxxx",
"description": "[redacted]",
"receipt_email": "[redacted]",
"redaction": {
"status": "processing"
},
...
}
Objects in transitory states can't be redacted
- PaymentIntents in processing states can’t be redacted and return a 400 response (for example, bank debits that have a long success confirm time window). You must wait until the PaymentIntent transitions to succeeded or requires _ payment _ method to redact it
- Refunds in a pending state can’t be redacted. You must also wait for the Refund to succeed or fail before you redact the associated transaction object
- Disputes that are in progress (status is submitted or unsubmitted ) can’t be redacted. You must wait for the dispute to complete before redacting the associated object
Redacted transactions can’t be refunded with the Refunds API. If your customer requests to redact their data and refund a transaction, first refund the payment and then redact the API object. Customers can dispute redacted transactions, so there’s a 90 day dispute window before transactions are eligible for redaction. Stripe by default marks disputes on redacted transactions as lost (Dispute is created with status: 'lost') and you aren’t able to respond to this dispute—this is because responding to disputes requires proving with customer data the legitimacy of the order (for example, user communications, web logs, personal address on shipping label).
Redact a charge
Command Line
cURL
Redact a PaymentIntent
/the relevant part of the product…/redact
Command Line
cURL
Redact a SetupIntent
Command Line
cURL
Redact a Checkout Session
/the relevant part of the product…/redact
Command Line
cURL
Redact a Radar value list item
Command Line
cURL
Redact a VerificationSession
/the relevant part of the product…/redact
Command Line
cURL
In addition to the API, you can redact verification sessions in the Dashboard by choosing Redact from their overflow menu ().
Redact a card
/the relevant part of the product…/redact
Command Line
cURL
Redact a cardholder
/the relevant part of the product…/redact
Command Line
cURL
Redact a guest customer
Guest customer redaction isn’t available through the Stripe API or Dashboard. Contact Support to request redaction for guest customer objects.
Delete each object representing the customer
Delete the Customer.
For this operation to succeed, you must redact all transactional objects associated with the customer.
Redacting Customers with active Subscriptions
Subscription objects don’t store customer PII and therefore can’t be redacted.
When a Customer with an active subscription requests for their data to be redacted, you need to:
- Cancel the subscription: Stripe::Subscription. delete('sub _ xxxxxxxxx')
- Delete the Customer object attached to this Subscription
Invoices created by the Subscription aren’t redacted by this process. See Handling customer deletion requests for how to handle Invoices.