---
title: "Delete User Data"
method: DELETE
path: "/api/v1/billing/data"
tags: ["billing"]
---

# Delete User Data

`DELETE /api/v1/billing/data`

## Request

- Base URL: `https://api.accurecord.io` (the document declares no server; this is the origin it was published from)
- URL: `https://api.accurecord.io/api/v1/billing/data`
- Auth: none declared

Customer-directed deletion of the PHI this API key controls.

Deletes coding traces, coding cache entries, and chart review jobs owned by this
API key, and writes an immutable purge record (see ``record_data_purge``). Audit
and disclosure ledgers are retained — see the retention note below.

⚠ This is **not** a "HIPAA right to deletion", and it must not be described as one.
**HIPAA gives individuals no right to erasure.** 45 CFR grants a right of access
(§164.524), a right to request amendment (§164.526) and a right to an accounting of
disclosures (§164.528) — deletion is not among them. That is a GDPR concept
(Article 17), not a HIPAA one.

What this endpoint actually is: a **covered entity instructing its business
associate to delete data the business associate holds on its behalf**, which is
ordinarily how a BAA works. It is a customer action, not a patient right.

Consequences for whoever maintains this:

* A patient asking us directly to erase their record is **not** entitled to it under
  HIPAA. Such a request belongs with the covered entity, which owns the designated
  record set and decides — unless a specific BAA delegates that response to us.
* Deleting on request is still correct when the customer directs it and no retention
  obligation applies. But an accepted §164.526 amendment must be appended or linked,
  **not** silently overwritten, so the historical record and its audit trail survive.
* Retention here is deliberately per-category (chart reviews 90d, coding traces 365d,
  cache 90d, usage events ~7y for billing/tax), not a blanket six years.
  §164.530(j)(2)'s six years applies to *documentation required by the rule* —
  policies, communications, actions, activities, designations — not to every patient
  record or coding transaction. Do not "simplify" these into one six-year default.

## Headers

- `x-api-key` string, nullable

## Response `200`

Successful Response

- object

## Other responses

- `400`: Malformed or out-of-bounds request — a batch over 50 codes, a file over the upload limit, an unparseable identifier, or a surface that is switched off in this environment (the `cpt_*_disabled` gates are 400, not 403). ⚠ Not interchangeable with 422: 400 is raised BY the handler, 422 by request validation.
- `401`: Missing, malformed, revoked or expired credential. Send the key as `X-API-Key` or `Authorization: Bearer`. `detail` is a string, except the MFA challenge on `/auth/login`, which is `{code: 'mfa_required', message}`.
- `403`: Authenticated but not permitted: the tier does not include the feature, the role is insufficient, or the free tier is paused. Gate-specific bodies use the `{code, message}` shape (`tier_required`, `insufficient_role`). ⚠ The free-tier pause is the ONE error in the service that does not use `detail` at all — its body is `{error: 'free_tier_paused', message}` at the top level. ⚠ Preconditions the caller CAN satisfy (no org, no BAA, PHI mode off) are 412, not 403 — see below.
- `404`: Resource, code, or org-scoped record not found. Note that a record belonging to ANOTHER organization is also a 404, never a 403 — existence is not disclosed across tenants.
- `412`: A precondition on the calling principal is unmet and the caller can fix it: no organization linked to the key (`org_required`), no signed BAA (`baa_required`), PHI mode not activated (`phi_not_activated`), reviewer mode off (`review_mode_disabled`), or the session was never second-factored (`mfa_required`). All use the `{code, message}` shape.
- `422`: Request body or query failed validation. FastAPI's own failures are a LIST of `{loc, msg, type}`; semantic refusals raised by the service are an object (the risk-adjustment endpoints use `{status, ...}`).
- `429`: Rate limit, quota or concurrency cap exceeded. The tier limiter, the per-key chart-review job cap, the anonymous demo cap and the auth/signup limiters all land here; only the tier limiter sets the `X-RateLimit-*` headers.
- `500`: Unhandled server error. The body is `{detail: 'Internal server error', request_id: <id>}` and the same id is on the `X-Request-ID` response header.
- `503`: A dependency this request needed is unavailable — the database, an upstream model provider, or reference data that is present but not READY. Retry is reasonable, except for the risk-adjustment `blocked_pack_not_ready` refusals, which stay 503 until the coefficient pack is actually loaded.

---

[API](https://skmtc.dev/accurecord/apis/icd-10-coding-api.md) · [All operations](https://skmtc.dev/accurecord/apis/icd-10-coding-api/llms.txt) · [OpenAPI document](https://skmtc.dev/accurecord/apis/icd-10-coding-api/revisions/b1e12ce06ba5?raw)