---
title: "Delete Account"
method: POST
path: "/api/auth/delete-account"
---

# Delete Account

`POST /api/auth/delete-account`

## Request

- Base URL: `https://api.drillflow.de` (the document declares no server; this is the origin it was published from)
- URL: `https://api.drillflow.de/api/auth/delete-account`
- Auth: none declared

Right-to-erasure: password re-auth, then the account and its owned
shares are gone. The session cookie is cleared in the same response.

Cookie-only (C2): an API token must not be able to erase the account it was
minted from.

## Request body

- DeleteAccountRequest: Re-auth for the destructive op — a stolen session alone must not suffice to erase an account. An account without a password re-confirms with Google instead (C7) and sends no password.
  - `password` string

## Response `204`

Successful Response

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/drillflow/apis/drillflow-api.md) · [All operations](https://skmtc.dev/drillflow/apis/drillflow-api/llms.txt) · [OpenAPI document](https://skmtc.dev/drillflow/apis/drillflow-api/revisions/c892102e97b0?raw)