Skip to content

feat(api): add DELETE endpoint for merchant accounts in v2 #8727

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 9 commits into
base: main
Choose a base branch
from
Open

feat(api): add DELETE endpoint for merchant accounts in v2 #8727

wants to merge 9 commits into from

Conversation

inventvenkat
Copy link
Contributor

Summary

  • Added DELETE route to v2 merchant account API endpoints
  • Enables deletion of merchant accounts via DELETE /v2/merchant-accounts/{id}
  • Reuses existing v2 delete handler with proper V2AdminApiAuth authentication
  • Follows established v2 API patterns and conventions

Changes Made

  • Modified crates/router/src/routes/app.rs to add delete route to v2 merchant account scope
  • The v2 delete handler already existed but wasn't exposed via routes

Test Plan

  • Code compiles successfully with v2 features (just check_v2)
  • Verified existing v2 delete handler is properly feature-gated
  • Confirmed route follows v2 API conventions (/v2/merchant-accounts/{id})
  • Manual API testing (requires local setup with v2 features enabled)
  • Integration tests (if applicable)

Related Issue

Fixes #8717

🤖 Generated with Claude Code

@inventvenkat @claude
feat(api): add DELETE endpoint for merchant accounts in v2
f594ca1 
Add delete route to v2 merchant account API endpoints to enable
deletion of merchant accounts via DELETE /v2/merchant-accounts/{id}.
The implementation reuses existing v2 delete handler with proper
authentication and follows v2 API patterns.

Fixes #8717

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
@inventvenkat inventvenkat requested a review from a team as a code owner July 23, 2025 08:40
@semanticdiff-com SemanticDiff.com
Copy link

semanticdiff-com bot commented Jul 23, 2025 •
edited
Loading

Review changes with  SemanticDiff

Changed Files
File Status
  crates/router/src/routes/app.rs  79% smaller
  crates/router/src/services/authentication.rs  19% smaller
  crates/openapi/src/openapi_v2.rs  2% smaller
  api-reference/v2/openapi_spec_v2.json  0% smaller
  crates/openapi/src/routes/merchant_account.rs  0% smaller
  crates/router/src/core/admin.rs  0% smaller
  crates/router/src/core/api_keys.rs  0% smaller
  crates/router/src/routes/admin.rs  0% smaller
  crates/router/src/utils/user.rs  0% smaller

@inventvenkat inventvenkat marked this pull request as draft July 23, 2025 08:46
inventvenkat and others added 2 commits July 23, 2025 15:40
@inventvenkat @claude
feat(api): implement comprehensive v2 merchant deletion functionality
10b2b69 
- Add comprehensive v2 merchant account deletion with proper cleanup
- Implement v2-specific authentication with JWT and Permission::MerchantAccountWrite
- Add systematic deletion of merchant account and key store data
- Include proper config cleanup and API key revocation
- Use robust error handling and logging for audit trail
- Maintain atomicity of core deletion operations

This addresses the missing delete functionality in v2 merchant account management,
ensuring proper cleanup of all merchant-related data while following v2 API patterns.

Fixes #8717

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
@hyperswitch-bot
chore: run formatter
7c4607c
inventvenkat
inventvenkat commented Jul 23, 2025
View reviewed changes
crates/router/src/routes/admin.rs Outdated
auth::auth_type(
&auth::V2AdminApiAuth,
&auth::JWTAuthMerchantFromRoute {
merchant_id: merchant_id.clone(),
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No need of JWTAuth here, only admin api should be able to delete merchants.

crates/router/src/core/admin.rs Outdated
}

// Delete configuration entries
if let Err(err) = db
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No need to delete configuration entries

@inventvenkat @claude
fix: address PR review feedback - simplify auth and remove config del…
9db196b 
…etion

- Remove JWT authentication as per review comment: "No need of JWTAuth here, only admin api should be able to delete merchants"
- Remove configuration deletion logic as per review comment: "No need to delete configuration entries"
- Use simple V2AdminApiAuth for admin-only access
- Simplify payload creation without unnecessary cloning

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
@inventvenkat inventvenkat self-assigned this Jul 23, 2025
@inventvenkat inventvenkat marked this pull request as ready for review July 23, 2025 11:13
@inventvenkat inventvenkat requested a review from a team as a code owner July 23, 2025 11:14
@inventvenkat inventvenkat requested a review from ayush22667 July 23, 2025 11:14
inventvenkat and others added 2 commits July 23, 2025 16:57
@inventvenkat @claude
feat: add OpenAPI specification for v2 merchant account delete endpoint
e591d42 
- Add v2 delete merchant account endpoint specification with proper path: `/v2/merchant-accounts/{id}`
- Include comprehensive response documentation (200, 400, 404, 401)
- Add endpoint to OpenAPI v2 routes for automatic documentation generation
- Use admin API key authentication as per security requirements
- Update generated OpenAPI spec file with new endpoint

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
@inventvenkat @claude
refactor: convert merchant account deletion from hard delete to soft …
0c3e347 
…delete

BREAKING CHANGE: Merchant account deletion now performs soft delete instead of hard delete

- Replace hard deletion with soft delete approach for data preservation
- Merchant account data is preserved in database for audit trails and compliance
- API keys are still revoked for security (making account effectively unusable)
- Comprehensive audit logging for deletion events with timestamps
- Updated OpenAPI documentation to reflect soft delete behavior
- Maintains same API response format for backward compatibility

Benefits:
- Data integrity preserved for audit and compliance requirements
- Better recovery options if deletion was accidental
- Maintains referential integrity with related data
- Security through API key revocation rather than data destruction

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
@hyperswitch-bot hyperswitch-bot bot added the M-api-contract-changes Metadata: This PR involves API contract changes label Jul 23, 2025
@inventvenkat inventvenkat force-pushed the feature/v2-delete-merchant-account branch from d21d514 to 7aa8a68 Compare July 23, 2025 13:08
@inventvenkat inventvenkat requested review from a team as code owners July 23, 2025 13:08
@inventvenkat
security: prevent API key creation for soft-deleted merchants
907bcc4 
    - Update soft delete implementation to mark merchant as deleted in metadata
    - Add validation in API key creation to check merchant deletion status
    - Prevent security gap where soft-deleted merchants could create new API keys
    - Maintain audit trail with deletion timestamp and type

    🤖 Generated with [Claude Code](https://claude.ai/code)

    Co-Authored-By: Claude <noreply@anthropic.com>
@inventvenkat inventvenkat force-pushed the feature/v2-delete-merchant-account branch from 7aa8a68 to 907bcc4 Compare July 23, 2025 13:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@ayush22667 ayush22667 Awaiting requested review from ayush22667

At least 2 approving reviews are required to merge this pull request.

Assignees

@inventvenkat inventvenkat

Labels
M-api-contract-changes Metadata: This PR involves API contract changes
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

[FEATURE] Add delete merchant account endpoint in v2
1 participant
@inventvenkat