Delete FI Data

​

Overview

• Comply with data retention policies and regulatory requirements that mandate deletion of customer data after specific time periods
• Honor customer requests to delete their financial information under data protection regulations such as GDPR or India’s Digital Personal Data Protection Act
• Clean up data after completing processing workflows such as loan underwriting, credit assessment, or investment advisory services
• Free up storage resources by removing financial data that is no longer needed for operational purposes
• Ensure that revoked or expired consents no longer have associated financial data stored in the system

​

Authentication

​

Required Headers

​

Request

​

Endpoint

DELETE {{Base_URL}}/fidata

​

Request Body Parameters

​

Request Example

{
  "consentId": "3c92001e-57ea-4320-bbb8-66d524bfb435"
}

​

Response

​

Success Response (200 OK)

​

Response Fields

​

Response Example

{
  "status": "success",
  "ver": "1.15.0",
  "data": {
    "status": "SUCCESS",
    "message": "FI data deleted successfully"
  }
}

​

Error Responses

​

Authentication Errors

​

401 Unauthorized - Invalid Headers

{
  "ver": "1.21.0",
  "timestamp": "2025-10-01T11:58:00.111Z",
  "errorCode": "Unauthorized",
  "errorMsg": "Invalid headers"
}

• One or more required headers (client_id, client_secret, organisationId, appIdentifier) are missing from the request
• The header values contain typos or incorrect credential information
• The credentials have expired or been rotated in the FinPro admin portal without updating your application
• Using UAT credentials against a production endpoint or vice versa

• Verify all required headers are included in the DELETE request
• Cross-check header values against credentials provided in your FinPro admin portal
• Ensure you are using credentials from the correct environment (UAT vs Production)
• If credentials were recently rotated, update your application configuration with the new values

​

Validation Errors

​

Consent Not Found

• Verify the consentId matches the ID from a successfully approved consent in your system
• Ensure the consent belongs to your organization and was not created under a different FIU
• Check if the consent was previously deleted or never successfully created

​

Usage Notes

​

Data Deletion Scope

• All Financial Information (FI) artefacts fetched from Financial Information Providers (FIPs) for this consent
• Decrypted JSON, XML, and any other formatted representations of the financial data
• Linked account information including masked account numbers and FIP-specific references
• Any derived or processed data stored by FinPro related to this consent’s financial information

• The consent record itself, which remains for audit and compliance purposes
• Webhook event logs and consent lifecycle history
• Customer profile information or VUA details
• Data that you have already downloaded and stored in your own systems

​

Irreversible Operation

• The financial data cannot be recovered from FinPro’s systems
• You will need to initiate a new consent and data fetch to obtain the information again
• Customers will need to re-approve consent through the Account Aggregator flow
• There is no “soft delete” or temporary retention period—deletion is immediate and complete

• You have completed all necessary processing of the financial data
• The data has been exported or archived in your systems if required for future reference
• The deletion aligns with your data retention policies and compliance requirements

​

Best Practices for Data Lifecycle Management

1. Automated deletion workflows: Implement scheduled jobs that automatically delete FI data after the retention period specified in your privacy policy or consent terms expires.
2. Consent expiry handling: When you receive a CONSENT_EXPIRED webhook notification, trigger a deletion workflow to remove the associated financial data within a reasonable timeframe.
3. Customer-initiated deletion: Provide customers with a self-service option to request deletion of their financial data, which should trigger this API call after appropriate verification.
4. Audit logging: Maintain logs of all deletion operations in your systems, recording the consentId, timestamp, reason for deletion, and the user or process that initiated it.
5. Retention policy alignment: Configure your deletion workflows to align with your organization’s data retention policies, regulatory requirements, and the data life parameters configured in your consent templates.
6. Error handling: Implement retry logic with exponential backoff for deletion requests that fail due to transient errors, but also log failures that require manual investigation.

​

Regulatory Compliance Considerations

• RBI Account Aggregator Guidelines: Financial data should be retained only for the duration specified in the consent and deleted thereafter unless otherwise required by law.
• Digital Personal Data Protection Act (DPDPA): Customers have the right to request deletion of their personal data, and organizations must comply within reasonable timeframes.
• Internal Compliance Policies: Many financial institutions have internal data governance policies that specify maximum retention periods for customer financial data.

​

Handling Bulk Deletions

• Implement batch processing with appropriate rate limiting to avoid overwhelming the API
• Process deletions in parallel where possible, but respect the API rate limits
• Implement comprehensive error handling to track which deletions succeeded and which failed
• Consider spreading bulk deletions over time to minimize system load
• Maintain detailed logs of bulk deletion operations for audit purposes

​

Rate Limiting

• Rate limit headers are included in every response to help you track your usage
• X-RateLimit-Limit: The maximum number of requests allowed in the time window
• X-RateLimit-Remaining: The number of requests remaining in the current window
• X-RateLimit-Reset: The Unix timestamp when the rate limit window resets

​

Related APIs

• Get FI Data - Retrieve financial information before deletion
• Consent Status - Check consent status and validity
• Consent Revoke - Revoke an active consent