Auth

Permanently delete the session's own account

Session-only. email must exactly match (case-insensitive, trimmed) the account's own email — typed confirmation, the same guard the dashboard's delete-account form uses. On success, deletes the account and everything that belongs to it (projects, monitors, destinations, pings, incidents, deliveries, API keys, status pages, sessions and more) and clears this request's session cookie.

The delete target is ALWAYS the session's own user — never a request-supplied id — so there is no IDOR surface here.

An API-key request gets 403 SESSION_ONLY, never 404. Being a write, it also requires the CSRF double-submit header: 403 CSRF_REQUIRED if X-CSRF-Token is missing or does not match the lp_csrf cookie.

post/api/v1/me/delete

Request

  • Base URL: https://app.lastping.dev
  • URL: https://app.lastping.dev/api/v1/me/delete
  • Auth: API key in cookie lp_session

Request body

emailstring email required

Must exactly match (case-insensitive, trimmed) the account's own email address — typed confirmation, the same guard the dashboard's delete-account form uses.

Example request

{
  "email": "owner@example.com"
}

Response

Account deleted. The session cookie has been cleared.

Changes

No recorded changes to this operation across all 2 revisions of this API.