Delete Tenant

Required role: owner.

Delete a tenant that holds nothing. Its members lose the membership, and a login that still resolves this tenant's name simply re-creates it, empty.

The tenant must hold no pipelines, API keys or OIDC trust relationships; otherwise the request fails with a conflict. Everything tenant-scoped cascades on this delete, so the emptiness rule is what keeps a mistyped identifier from taking a live tenant's pipelines with it. Delete those resources first if you mean to.