---
title: "Delete the signed-in user's own account"
method: POST
path: "/v1/account/delete"
tags: ["account"]
---

# Delete the signed-in user's own account

`POST /v1/account/delete`

## Request

- Base URL: `https://api.getmyhotels.com`
- URL: `https://api.getmyhotels.com/v1/account/delete`
- Auth: HTTP bearer

Runs `user.deleteMyAccount`. IRREVERSIBLE. Anonymizes the Better Auth `user` row (name/email/image blanked to `deleted-<id>@anon.local`) and BANS it so sign-in is impossible, hard-deletes the owned personal-data tables (profile, addresses, saved payment methods, travel companions, recently viewed, saved searches, price alerts and watches, notification preferences, notifications, wishlists), revokes every active session, then writes a `gdpr_request` deletion record and a `user.self_deleted` audit entry. Bookings, reviews, support tickets and the audit log are deliberately KEPT for legal and accounting retention — they now point at the anonymized row. Requires `{ "confirm": "DELETE MY ACCOUNT" }` verbatim; anything else is a 400. Refuses non-`customer` roles with 403 FORBIDDEN — staff and admin accounts go through admin offboarding so access can be handed over first.

## Request body

- object
  - `confirm` 'DELETE MY ACCOUNT', required

## Response `200`

Success

- unknown

## Other responses

- `400`: Request validation failed or the router rejected the input
- `401`: Missing or invalid bearer session token
- `426`: Reported X-GMH-App-Version is below the supported minimum — the app must update
- `500`: Unexpected server error (opaque; details stay in logs)

---

[API](https://skmtc.dev/getmyhotels/apis/getmyhotels-rest-api.md) · [All operations](https://skmtc.dev/getmyhotels/apis/getmyhotels-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/getmyhotels/apis/getmyhotels-rest-api/revisions/cba24a9c13f0?raw)