---
layout: docs
page_title: Soft delete data
description: >-
   Use soft deletes to control the lifecycle of versioned key/value data in the
   kv v2 plugin.
---

# Soft delete key/value data

Use soft deletes to flag data at a secret path as unavailable while leaving the
data recoverable. You can revert soft deletes as long as the `destroyed` field
is `false` in the metadata.

<Tip title="Assumptions">

- You have [set up a `kv` v2 plugin](/vault/docs/secrets/kv/kv-v2/setup). 
- Your authentication token has `create` and `update` permissions for the `kv`
  v2 plugin.

</Tip>

<Tabs>

<Tab heading="CLI" group="cli">

Use [`vault kv delete`](/vault/docs/command/kv/delete) with the `-versions` flag to
soft delete one or more version of key/value data and set `deletion_time` in the
metadata:

```shell-session
$ vault kv delete               \
   -mount <mount_path>          \
   -versions <target_versions>  \
   <secret_path>
```

For example:

<CodeBlockConfig hideClipboard="true">

```shell-session
$ vault kv delete -mount shared -versions 1,4 dev/square-api

Success! Data deleted (if it existed) at: shared/data/dev/square-api
```

</CodeBlockConfig>

The `deletion_time` metadata field for versions 1 and 4 now has the timestamp
of when Vault marked the versions as deleted:

<CodeBlockConfig hideClipboard="true" highlight="22,31">

```shell-session
$ vault kv metadata get -mount shared dev/square-api

======== Metadata Path ========
shared/metadata/dev/square-api

========== Metadata ==========
Key                     Value
---                     -----
cas_required            false
created_time            2024-11-13T21:51:50.898782695Z
current_version         4
custom_metadata         <nil>
delete_version_after    0s
max_versions            5
oldest_version          0
updated_time            2024-11-14T22:32:42.29534643Z

====== Version 1 ======
Key              Value
---              -----
created_time     2024-11-13T21:51:50.898782695Z
deletion_time    2024-11-15T00:45:04.057772212Z
destroyed        false

...

====== Version 4 ======
Key              Value
---              -----
created_time     2024-11-14T22:32:42.29534643Z
deletion_time    2024-11-15T00:45:04.057772712Z
destroyed        false
```


</CodeBlockConfig>


</Tab>

<Tab heading="GUI" group="gui">

@include 'gui-instructions/plugins/kv/open-overview.mdx'

- Select the **Secret** tab.
- Select the appropriate data version from the **Version** dropdown.
- Click **Delete**.
- Select **Delete this version** to delete the selected version or
  **Delete latest version** to delete the most recent data.
- Click **Confirm**.

![Partial screenshot of the Vault GUI showing the "Delete version?" confirmation modal for data at the path dev/square-api](/img/gui/kv/delete-version.png)

</Tab>

<Tab heading="API" group="api">

Make a `POST` call to
[`/{plugin_mount_path}/delete/{secret_path}`](/vault/api-docs/secret/kv/kv-v2#delete-secret-versions)
with the data versions you want to soft delete:

```shell-session
$ curl                                       \
   --request POST                            \
   --header "X-Vault-Token: ${VAULT_TOKEN}"  \
   --data '{"versions":[<target_versions>]}  \
   ${VAULT_ADDR}/v1/<plugin_mount_path>/delete/<secret_path>
```

For example:

<CodeBlockConfig hideClipboard="true">

```shell-session
$ curl                                       \
    --request POST                           \
    --header "X-Vault-Token: ${VAULT_TOKEN}" \
    --data '{"versions":[5,8]}'              \
    ${VAULT_ADDR}/v1/shared/delete/dev/square-api | jq

```

`/{plugin_mount_path}/delete/{secret_path}` does not return data on success.

</CodeBlockConfig>

</Tab>

</Tabs>