---
title: "Cancel My Account Delete"
method: POST
path: "/api/account/delete/cancel"
tags: ["Account and billing"]
---

# Cancel My Account Delete

`POST /api/account/delete/cancel`

## Request

- Base URL: `https://epw.tools`
- URL: `https://epw.tools/api/account/delete/cancel`
- Auth: none declared. Required headers: `X-API-Key`

Reverse a pending soft-delete.  Only succeeds inside the grace
window (otherwise the row has already been hard-deleted and the
api_key itself is gone, so the call gets a 401 from validate_key).

Because a soft-deleted key is in the blocklist, ``validate_key``
returns None.  We therefore bypass it here and authenticate by
looking the key up by its HMAC ``key_lookup`` directly — the only
operation a blocked key can perform.

Round-3 hostile-review T1-28 — defense-in-depth: explicit
``_check_csrf_origin`` call.  Cancel is reversible/idempotent
but we still gate browsers on Origin/Referer to deny attackers
the cheap signal of "key X is in the grace window".

## Headers

- `X-API-Key` string, required

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/epw/apis/epw-tools-api.md) · [All operations](https://skmtc.dev/epw/apis/epw-tools-api/llms.txt) · [OpenAPI document](https://skmtc.dev/epw/apis/epw-tools-api/revisions/e6b60fc7a6d7?raw)