Account

Delete account (GDPR erasure)

Schedules the whole account — every intake, file, secret, API key and user on it — for permanent deletion. Dashboard session only: this can never be called with an API key, and only a user with the owner role may call it.

This is a two-phase erasure, not an instant one. Calling it immediately: revokes every session and API key on the account, so nobody can log in or call the API afterwards; cancels any active Stripe subscription; and takes the client portal offline for every intake on the account. It does not delete any data yet. The account and its data are permanently removed once the grace period in purge_at elapses (see docs/privacy.md §5) — until then, contact support to abort. Because this call revokes the very session that made it, this response is the last thing you will get back from the API for this account.

An account created via Google sign-in has no password; supply the account's own email address as confirm instead of a password in that case.

post/v1/account/delete

Request

  • Base URL: https://api.briefgate.dev
  • URL: https://api.briefgate.dev/v1/account/delete
  • Auth: HTTP bearer

Request body

passwordstring

Required and verified when the account has a password. Omit for a Google-only account (use confirm instead).

confirmstring required

The literal string "DELETE" for a password account (a second, distinct confirmation on top of the password), or the account's own email address for a Google-only account (which has no password to check).

Response

Account marked for deletion.

status'pending_deletion'
deleted_atstring date-time
purge_atstring date-time

When the data is actually and permanently removed.

messagestring

Changes

No recorded changes to this operation across all 1 revision of this API.