---
title: "Delete My Account"
method: POST
path: "/api/account/delete"
tags: ["Account and billing"]
---

# Delete My Account

`POST /api/account/delete`

## Request

- Base URL: `https://epw.tools`
- URL: `https://epw.tools/api/account/delete`
- Auth: none declared. Required headers: `X-API-Key`

GDPR Article 17 — right-to-erasure, soft-delete with 24 h grace.

Round-3 hostile-review fix T0-5 — the round-2 endpoint did a
synchronous hard-delete which meant a leaked key alone could cause
irreversible loss in one POST.  This version:

  * Sets ``deleted_at = now()`` and adds the key to the Redis
    revocation blocklist (instant authentication failure).
  * Writes an ``account_audit`` row (HMAC lookup, IP, event).
  * Returns 202 with the ``grace_expires_at`` ISO timestamp so the
    UI can surface "you have 24 h to cancel by POST
    /api/account/delete/cancel".
  * Per-key rate limit of 1 init/hour.

  A background worker (``expire_pending_account_deletes`` called by
  ``epwtools-monitor.timer``) hard-deletes rows whose
  ``deleted_at`` is older than ``ACCOUNT_DELETE_GRACE_HOURS``.

  Leaked-key-alone attacker can still initiate but cannot cause
  irreversible loss for 24 h, which is the audit window the user
  now has to notice and POST /cancel.

  Round-3 hostile-review T1-28 — defense-in-depth: explicit
  ``_check_csrf_origin`` call on top of the global middleware so
  this destructive endpoint stays CSRF-protected even if a future
  refactor accidentally adds it to ``_CSRF_EXEMPT_PREFIXES``.

## Headers

- `X-API-Key` string, required

## Request body

- AccountDeleteBody: Confirmation payload for the self-service GDPR deletion endpoint. The user MUST echo back the literal string ``DELETE`` and the email address registered against the key, so a leaked key alone cannot nuke an account — the attacker would also need to know the email.
  - `confirm` string, required
  - `email` string, required

## Response `202`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/epw/apis/epw-tools-api.md) · [All operations](https://skmtc.dev/epw/apis/epw-tools-api/llms.txt) · [OpenAPI document](https://skmtc.dev/epw/apis/epw-tools-api/revisions/e6b60fc7a6d7?raw)