When a company's contract ends

When a company's contract with Kapi Works ends, Kapi keeps its data for an export window, usually 30 days, and then deletes it. The API gives your integration the deletion date as soon as the end is set.

The Sunset headerCopy Anchor Link

From the moment Kapi sets a company's contract end date, answers to its keys carry two headers, following RFC 8594:

Sunset: Wed, 30 Dec 2026 23:59:59 GMT
Link: <https://docs.kapiworks.com/guides/company-ends>; rel="sunset"

Sunset is the day Kapi deletes the company's data. Link points to this page. Look for them on successful answers. Some errors carry them too, but a 401 and ip_not_allowed do not.

The headers are about this company's data, not about the API. Other companies and the /v1 contract carry on as before.

Kapi staff can move the end or the deletion date, or cancel the end. The headers follow: the date changes, or the headers go away. Read them on every call, not once.

// After any call to the API.
const sunset = response.headers.get("sunset");
if (sunset) {
  // Tell whoever runs this integration, and copy what the company asked you to keep before this date.
  console.warn(`Kapi Works deletes this company's data on ${new Date(sunset).toISOString()}.`);
}

Until the deletion dateCopy Anchor Link

Until the contract ends, nothing changes but the headers.

After the contract ends, until the Sunset date:

• Existing keys keep reading, with the same scopes and limits.
• The company can no longer create keys. If your key expires before the Sunset date, ask the company for a new one before the contract ends.
• The company's owners and admins can still revoke keys. Revocation takes effect on the next call.

When the date comesCopy Anchor Link

Kapi deletes the company's keys first, then all of its records:

• Calls with its keys answer 401 invalid_token, as for any revoked key.
• Its certificate check pages show nothing, as for a code that does not exist.

If Kapi holds the deletion, the API keeps answering after the date, and Sunset shows a date in the past. When the hold ends, Kapi sets a new deletion date at least 72 hours ahead, and the headers show it.

What to doCopy Anchor Link

1. Check every answer for Sunset, and tell whoever runs the integration when it appears.
2. Ask the company what to keep and for how long. The company decides that, not Kapi.
3. Before the Sunset date, make a complete pull of what the company asked you to keep.
4. After the date, stop calling and remove the company's keys from your systems.