---
title: "Delete Account"
method: POST
path: "/auth/delete-account"
tags: ["auth"]
---

# Delete Account

`POST /auth/delete-account`

## Request

- Base URL: `https://api.casenode.ai`
- URL: `https://api.casenode.ai/auth/delete-account`
- Auth: none declared. Required headers: `authorization`

Permanently delete the authenticated user and all their data.

Password is re-verified. The Stripe customer is deleted first (which cancels
any subscription and removes Stripe-side PII) — if that call fails we abort
before touching the local row so a paid subscription is never left orphaned.

This ordering is deliberate: the remaining non-atomic window is between a
successful Stripe delete and the DB commit. If the commit then fails, the
account survives with its billing already cancelled — recoverable (the user
keeps their account and can re-subscribe, with no ongoing charges). The
inverse ordering would risk a live subscription charging a deleted account,
which is the worse failure, so we accept this direction.

The users row is hard-deleted; FKs cascade to refresh_tokens, api_keys,
email_verification_tokens and citation_validation_reports. daily_usage has no
FK (keyed by subject_id = user_id, by `research_subjects(user_id)` for the
research chat, or by api_key id for keys without a user_id), so it is
cleaned up explicitly.

## Headers

- `authorization` string, required

## Request body

- DeleteAccountRequest
  - `password` string, required

## Response `204`

Successful Response

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/casenode/apis/casenode-api.md) · [All operations](https://skmtc.dev/casenode/apis/casenode-api/llms.txt) · [OpenAPI document](https://skmtc.dev/casenode/apis/casenode-api/revisions/5b2883d19661?raw)