Stripe event: customer.subscription.deleted, deprovision now, this is terminal

customer.subscription.deleted: revoke access, close the books

When this event arrives, the subscription has ended. Period.

What to do on receipt

1. Look up your user by the subscription id. Revoke the plan's entitlements: downgrade to free, suspend the account, whatever your offboarding is.
2. Decide data retention per your policy: keep the data for a grace window or delete it. Tell the customer which one you did.
3. Mark the subscription canceled in your records with the timestamp. Keep the record; you will want it for win-back campaigns and for answering "why was I charged" questions.
4. Return 200.

The trap

Deprovisioning on the cancellation request instead of on this event. When a customer cancels with cancel_at_period_end, you get customer.subscription.updated first and deleted only when the paid period actually ends. Cutting access at the request is both wrong (they paid) and a good way to manufacture disputes. The other trap: confusing a paused subscription with a deleted one. Pause is a different state; check pause_collection before you assume.

Checklist

• Subscriptions deleted immediately (no period end) arrive here too. Same handling: the event means it is over now.
• If the customer resubscribes later, that is a new customer.subscription.created with a new id. Do not resurrect the old record; link them by customer.

Stripe's event reference says customer.subscription.deleted occurs whenever a customer's subscription ends. Verified live at https://docs.stripe.com/api/events/types.