User Documentation
User Documentation
Breadcrumbs

Privacy and lifecycle

ICAP distinguishes between removing a resource and purging personal data. Choose the operation that matches your retention policy, and keep an authoritative record of the decision in your own compliance process.

Remove

Removing an identity, visitor, visit, credential, access unit, card type, configuration record, or role is generally a soft delete. The resource is no longer available through ordinary get and list calls, but stored lifecycle metadata remains. There is no restore endpoint.

Remove assignments deliberately when changing access. Removing an assignment does not delete the referenced credential, access unit, person, or visit.

Remove operation outcome based on entity overview

Resource

Documented removal behavior

Identity, visitor, visit, card credential, PIN credential, access unit

Soft deletion; normal reads exclude the removed record.

Card type, extension field definition, custom role

Physical removal of the configuration record, subject to applicable dependency checks.

Role assignment

Physical removal; no resource version header.

PACS record

Physical removal of the local configuration record; this does not remove the external PACS or clean up every related reference.

Identity or visitor purge

Scrubs specified personal fields while retaining the documented metadata and related records.

Purge an identity or visitor

ICAP provides purge operations for identities and visitors only. Purge:

  • Clears personal fields held on the primary person record, including names, contact details, photo, external IDs, personal attributes, and custom fields.

  • Removes the person from normal get and list responses.

  • Retains the ICAP identifier, tenant reference, creation/update/deletion/purge metadata, and specified non-personal relationship records.

  • Is irreversible. A second purge of the same record does not act as an idempotent success.

Purge is not a physical database deletion and must not be described as a guarantee that personal data is absent from backups, logs, PACS mappings, or external systems. For PACS-enabled identities, downstream deletion work can be asynchronous; assess downstream system obligations separately.

Before you call purge

  1. Confirm that the request is authorized under your privacy process.

  2. Read the current resource and preserve only the information your process is permitted to retain.

  3. Send the resource's current raw numeric version in If-Match.

  4. Treat a successful 204 No Content as successful ICAP purge, then monitor any related PACS work.

Purge can encounter concurrency or external-integration failures. Do not blindly retry: review the current resource and operational state first. See updates and concurrency and errors and retry behavior.