---
title: "Admin Apply Deletion Token Migration"
method: POST
path: "/admin/apply_deletion_token_migration"
---

# Admin Apply Deletion Token Migration

`POST /admin/apply_deletion_token_migration`

## Request

- Base URL: `https://api.colourmemory.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.colourmemory.com/admin/apply_deletion_token_migration`
- Auth: none declared

Release-hardening pass (2026-08-06): applies persistent_projects.
migrate_add_deletion_capability_token() to the REAL production
DATABASE_URL. Same mirror-image safety rule as
admin_apply_project_type_migration above (refuses to run if
REHEARSAL_DATABASE_URL is set, to avoid ambiguity about which
database is being targeted).

Purely additive: ADD COLUMN IF NOT EXISTS deletion_token_hash TEXT,
nullable. Touches zero existing rows' data -- every existing project
(anonymous or authenticated) gets deletion_token_hash = NULL, which
can never match any supplied token, so nothing becomes retroactively
deletable by this migration alone. Idempotent, safe to call more than
once. Rehearsed against a throwaway Postgres (see
/admin/project_migration_rehearsal, which now also exercises the full
anonymous deletion-token create/wrong-token/correct-token/pre-
migration-NULL matrix) before this endpoint is ever invoked against
production.

## Headers

- `x-admin-key` string, nullable

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/colourmemory/apis/colour-memory-api.md) · [All operations](https://skmtc.dev/colourmemory/apis/colour-memory-api/llms.txt) · [OpenAPI document](https://skmtc.dev/colourmemory/apis/colour-memory-api/revisions/4ba028f64042?raw)