I’m able to create cards via the API, but deleting them gives me a 403. It’s only cards I created on my own account, I haven’t shared cards with any other users. I tried the /v1/cards/delete and /v1/cards/remove endpoints, and they both return a 207 response, with a 403 for each card ID passed.
Any ideas? 
Yep sorry, undocumented requirement.
Card memberships must have a status of “disabled” (-2) in order to be removed/deleted. So currently it actually requires 2 API calls to fully remove a card. This was done to ensure cards were not accidentally deleted. So a full curl example would look something like this:
curl -X 'PATCH' 'https://api.supernotes.app/v1/cards/' \
-H 'Api-Key: MY_API_KEY' \
-H 'Content-Type: application/json' -H 'accept: application/json' \
-d '{"d1550efd-fa03-418a-b9b6-3485d210e5a9": {"membership": {"status": -2}}}'
curl -X 'POST' 'https://api.supernotes.app/v1/cards/remove' \
-H 'Api-Key: MY_API_KEY' \
-H 'Content-Type: application/json' -H 'Accept: application/json' \
-d '["d1550efd-fa03-418a-b9b6-3485d210e5a9"]'
We will improve the error message for this in the upcoming 3.0 release and think about if there is a better way to handle this, now that people are using the API more often.