> ## Documentation Index
> Fetch the complete documentation index at: https://docs.passentry.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Pass Nullification

> Learn how to permanently remove passholder data from a pass while keeping a tombstone record for billing and compliance, and how to reuse External IDs after nullification.

Pass nullification allows you to irreversibly remove all dynamic data from a pass while preserving a tombstone record for billing and auditability. This is useful for GDPR-compliant data removal, deprovisioning users, or freeing up an External ID for reuse.

<Warning>
  Nullification is **irreversible**. Once a pass is nullified, its data cannot be recovered. Make sure this is the intended action before calling the endpoint.
</Warning>

## What happens when a pass is nullified

When you call the [Nullify Pass](/api-reference/v1/passes/nullify-pass) endpoint, the following changes are applied:

* **Status** is set to `nullified`
* **Dynamic fields** (text fields, barcode, NFC, localisation, latest message) are cleared
* **Images** (logo, banner, thumbnail) are purged from the pass
* **Pass design** is replaced with a generic "Deactivated" appearance in grey
* **Wallet state** -- the pass moves to the expired section of the wallet and cannot be restored

The following are **preserved**:

* Pass UUID and serial number
* External ID (`extId`)
* Creation and nullification timestamps
* The pass record itself (for billing quota and audit)

<Note>
  Nullified data is removed from active systems immediately. Encrypted database backups are retained for up to 35 days, and logs referencing the pass data for up to 365 days, after which all remaining copies are permanently deleted.
</Note>

### Wallet appearance

<Tabs>
  <Tab title="Apple">
    The pass appears in the expired passes section with grey colours, empty fields, and a "Deactivated" label. The pass is marked as voided.
  </Tab>

  <Tab title="Google">
    The pass shows a "Deactivated" header with a grey background. All text fields, barcode, and pass-level images are removed. The pass state is set to `INACTIVE`.

    Note that images set at the **template level** (e.g. logo, hero image) are managed by Google and cannot be removed by nullification. These will remain visible on the pass.
  </Tab>
</Tabs>

## API behaviour after nullification

Once a pass is nullified, it is excluded from most API endpoints. Requests to the following endpoints using a nullified pass's UUID or `extId` will return `404 Not Found`:

* [Get Pass](/api-reference/v1/passes/show-pass)
* [Update Pass](/api-reference/v1/passes/update-pass)
* [Send Notification](/api-reference/v1/passes/send-notification)

Attempts to download the pass via its `downloadUrl` will also fail with a pass not found error.

Nullified passes are also excluded from [List Passes](/api-reference/v1/passes/list-passes) results by default. To include them, pass `includeNullified=true` as a query parameter, or filter by `status=nullified`.

The [Nullify Pass](/api-reference/v1/passes/nullify-pass) endpoint remains accessible for already-nullified passes (see [Idempotency](#idempotency)).

## External ID reuse

After nullification, the pass's `extId` is freed for reuse. You can create a new pass with the same `extId` within the same organisation. This is useful when:

* A user wants to switch pass type (e.g. loyalty to event ticket) but their `extId` is tied to a single pass
* A user loses their device and needs a fresh pass reissued under the same identifier
* A pass needs to be deprovisioned and later re-provisioned for the same user

Multiple nullified passes with the same `extId` can coexist -- uniqueness is only enforced across non-nullified passes.

## Billing

Nullified passes **still count towards your billing quota**. Nullification removes data, not the record. If you need to view nullified passes, use the `status` filter on the [List Passes](/api-reference/v1/passes/list-passes) endpoint with `status=nullified`.

## Idempotency

The nullify endpoint is idempotent. Calling it on an already-nullified pass returns `200` with no further changes.