Credit card information cannot be removed from an orderForm via route /api/checkout/pub/orderForm/{orderFormId}/paymentAccount/{accountId}/remove when using appKey/appToken as credentials.

When an appKey with the appropriate permissions submits a request to this route, the API returns an error with status 500: "Attempted to perform an unauthorized operation."

Note that it is not an error with status 403, as is usual for authorization failures.

Currently, there is no workaround.