# When a company's contract ends

The Sunset header, what keeps working until the deletion date, and what to copy before it.

When a company's contract with Kapi Works ends, Kapi keeps its data for an export window, usually 30 days, and then deletes it. The API gives your integration the deletion date as soon as the end is set.

## The Sunset header

From the moment Kapi sets a company's contract end date, answers to its keys carry two headers, following [RFC 8594](https://www.rfc-editor.org/rfc/rfc8594):

```http
Sunset: Wed, 30 Dec 2026 23:59:59 GMT
Link: <https://docs.kapiworks.com/guides/company-ends>; rel="sunset"
```

`Sunset` is the day Kapi deletes the company's data. `Link` points to this page. Look for them on successful answers. Some errors carry them too, but a `401` and [`ip_not_allowed`](https://docs.kapiworks.com/errors/ip_not_allowed) do not.

The headers are about this company's data, not about the API. Other companies and the `/v1` contract carry on as before.

Kapi staff can move the end or the deletion date, or cancel the end. The headers follow: the date changes, or the headers go away. Read them on every call, not once.

```js
// After any call to the API.
const sunset = response.headers.get("sunset");
if (sunset) {
  // Tell whoever runs this integration, and copy what the company asked you to keep before this date.
  console.warn(`Kapi Works deletes this company's data on ${new Date(sunset).toISOString()}.`);
}
```

## Until the deletion date

Until the contract ends, nothing changes but the headers.

After the contract ends, until the `Sunset` date:

* Existing keys keep reading, with the same scopes and limits.
* The company can no longer create keys. If your key expires before the `Sunset` date, ask the company for a new one before the contract ends.
* The company's owners and admins can still revoke keys. Revocation takes effect on the next call.

## When the date comes

Kapi deletes the company's keys first, then all of its records:

* Calls with its keys answer `401` [`invalid_token`](https://docs.kapiworks.com/errors/invalid_token), as for any revoked key.
* Its certificate check pages show nothing, as for a code that does not exist.

If Kapi holds the deletion, the API keeps answering after the date, and `Sunset` shows a date in the past. When the hold ends, Kapi sets a new deletion date at least 72 hours ahead, and the headers show it.

## What to do

1. Check every answer for `Sunset`, and tell whoever runs the integration when it appears.
2. Ask the company what to keep and for how long. The company decides that, not Kapi.
3. Before the `Sunset` date, make a [complete pull](https://docs.kapiworks.com/guides/sync) of what the company asked you to keep.
4. After the date, stop calling and remove the company's keys from your systems.