---
title: "Erase the caller’s account (GDPR right-to-erasure)"
method: POST
path: "/v1/me/erase"
---

# Erase the caller’s account (GDPR right-to-erasure)

`POST /v1/me/erase`

## Request

- Base URL: `https://api.grundfast.dk`
- URL: `https://api.grundfast.dk/v1/me/erase`
- Auth: API key in cookie `gf_session`

Session-scoped, OWNER-only, irreversible. Anonymizes all personal data (user + customer email/name) and deletes every credential (API keys, sessions, tokens, webhooks); Stripe subscriptions are canceled. Accounting records (usage/billing) are RETAINED under the legal-obligation exemption. Requires a typed confirmation: the body must echo the caller’s own account email. Clears the session on success.

## Request body

- object
  - `confirm` string, required: The caller’s own account email, to confirm intent.

## Response `200`

Erased (or already erased — idempotent)

## Other responses

- `400`: Error
- `401`: Error
- `403`: Error
- `429`: Error

---

[API](https://skmtc.dev/grundfast/apis/grundfast-api.md) · [All operations](https://skmtc.dev/grundfast/apis/grundfast-api/llms.txt) · [OpenAPI document](https://skmtc.dev/grundfast/apis/grundfast-api/revisions/ccef6e299bb5?raw)