Withdraw a published DPP (Approved -> Withdrawn -> public 410)
POST/api/v1/products/:id/withdraw
Required scope: dpp:withdraw (distinct least-privilege scope — it pulls
already-published content offline). A WRITE (HMAC + Idempotency-Key).
The public DPP flips to HTTP 410 Gone within the cache tick. A
successorProductId is REQUIRED for reasons EndOfLife /
MarketWithdrawal / Supersession. That is a platform continuity rule and
NOT a regulatory one: those three reasons are commercial and assert no
regulatory basis. Recall / Counterfeit carry regulator-notify metadata
(regulatorNotifiedAuthority); under Reg. (EU) 2023/1542 Art. 38(9) a
manufacturer must inform the market surveillance authority immediately
where the battery presents a risk. Per-reason legal bases live in
src/lib/dpp/withdrawal-legal-basis.ts. The successor must be your own
product or a publicly Approved DPP.
Request
Responses
- 200
- 400
- 401
- 403
- 404
- 409
- 422
- 429
- 503
Withdrawn
400 — INVALID_JSON, VALIDATION_ERROR, or IDEMPOTENCY_KEY_REQUIRED.
401 — INVALID_SIGNATURE or SIGNING_NOT_CONFIGURED (or bearer auth failure).
403 — missing scope (FORBIDDEN_SCOPE) or module (FORBIDDEN_MODULE).
404 — not found OR owned by another tenant (NOT_FOUND; IDOR-safe).
Product is not in a withdrawable state (INVALID_STATE).
Successor invalid (SUCCESSOR_INVALID) or demo product (DEMO_PRODUCT).
429 — RATE_LIMITED (per-key limit, reads and writes alike; fails closed,
so a limiter outage also returns 429). A limiter-down 429 is deliberately
indistinguishable from a quota 429. Carries Retry-After (seconds).
Response Headers
Seconds to wait before retrying (429 only).
Per-minute request ceiling for this key's tier.
Requests left in the current window (floored at 0).
Seconds until the window resets.
503 — the API is not enabled on this environment (FEATURE_DISABLED).