> ## Documentation Index
> Fetch the complete documentation index at: https://developers.pcibooking.net/llms.txt
> Use this file to discover all available pages before exploring further.

# Delete File from sFTP or FTPS

> Delete a file on an sFTP or FTPS server through PCI Booking, for example a source file that contained card data.

<Card title="File Transfer Tokenization Guide" icon="book" href="/capture-cards/file-transfer-tokenization">
  Tokenize card data in files on sFTP and FTPS servers
</Card>

Deletes a file on a third party's sFTP or FTPS server, with PCI Booking connecting to the server for you. A typical use is right after [Tokenize from sFTP](/api-reference/tokenize-cards/tokenize-from-sftp): PCI Booking has tokenized the file, but the original file with the real card data is still on the server. Deleting it through PCI Booking removes it without your own systems connecting to the server or handling the card data.

Use `/api/sftp/` for an sFTP server and `/api/ftps/` for an FTPS server. FTPS connections use explicit TLS; implicit TLS (port 990) is not supported.

## Error Responses

| Code    | HTTP Status | Condition                                                                                                                              |
| ------- | ----------- | -------------------------------------------------------------------------------------------------------------------------------------- |
| none    | `401`       | The access token or session token is missing or not valid. The response body is empty.                                                 |
| `-125`  | `400`       | Invalid server address format (more than one colon), or the `Authorization` header does not contain valid Basic credentials.           |
| `-1003` | `401`       | Login to the remote server failed (wrong username or password).                                                                        |
| `-160`  | `404`       | PCI Booking could not connect to the remote server, or the server could not delete the file. `moreInfo` contains the server's message. |

## Parameter Constraints

* **serverAddress**: `hostname` or `hostname:port`. Only one colon is allowed. Without a port, PCI Booking connects on port 22. Most FTPS servers listen on port 21, so for FTPS you will usually add `:21`.
* **Authorization header**: Basic credentials (`username:password`) for the remote server.

## Parameters

### Authentication

<Warning>
  This is a browser-facing endpoint. Use one of the authentication methods below instead of the API key shown above.
</Warning>

<ParamField query="accessToken" type="string">
  Recommended. A long-lived token for browser-side calls. [How to generate](/getting-started/authentication#access-token).
</ParamField>

<ParamField query="sessionToken" type="string">
  Alternative. Valid for 5 minutes. [How to generate](/api-reference/general/start-temporary-session).
</ParamField>

If both are provided, the session token takes precedence.

### Path Parameters

<ParamField path="serverAddress" type="string" required>
  The server address: an IP address or domain name, optionally followed by a colon and the port. For example: `sftp.gateway.com` or `ftps.gateway.com:21`.
</ParamField>

<ParamField path="filePath" type="string" required>
  The path of the file to delete on the server, including folders and the file name. For example: `outgoing/reservations/2026-09-25.xml`.
</ParamField>

### Headers

<ParamField header="Authorization" type="string" required>
  Basic credentials for the remote server, in the form `Basic base64(username:password)`. These are the credentials of the sFTP or FTPS server, not your PCI Booking credentials.
</ParamField>

<RequestExample>
  ```bash curl theme={null}
  curl -X DELETE "https://service.pcibooking.net/api/sftp/sftp.gateway.com/outgoing/reservations/2026-09-25.xml?accessToken=your-access-token" \
    -H "Authorization: Basic dXNlcm5hbWU6cGFzc3dvcmQ="
  ```

  ```javascript Node.js theme={null}
  const response = await fetch(
    'https://service.pcibooking.net/api/sftp/sftp.gateway.com/outgoing/reservations/2026-09-25.xml?accessToken=your-access-token',
    {
      method: 'DELETE',
      headers: { 'Authorization': 'Basic dXNlcm5hbWU6cGFzc3dvcmQ=' }
    }
  );

  console.log(response.status); // 204 when the file was deleted
  ```

  ```python Python theme={null}
  import requests

  response = requests.delete(
      'https://service.pcibooking.net/api/sftp/sftp.gateway.com/outgoing/reservations/2026-09-25.xml',
      params={'accessToken': 'your-access-token'},
      auth=('username', 'password')  # credentials of the sFTP server
  )

  print(response.status_code)  # 204 when the file was deleted
  ```
</RequestExample>

## Response

**204** - The file was deleted. There is no response body. This call is not billed.

<ResponseExample>
  ```text 204 theme={null}
  File deleted. No content returned.
  ```

  ```text 401 theme={null}
  Empty response body.
  Authentication failed: the API key, session token or access token is missing or was not accepted.
  See "Authentication and Permission Failures" on the Error Handling page.
  ```
</ResponseExample>