---
title: "Permanently delete the session's own account"
method: POST
path: "/api/v1/me/delete"
tags: ["Auth"]
---

# Permanently delete the session's own account

`POST /api/v1/me/delete`

## Request

- Base URL: `https://app.lastping.dev`
- URL: `https://app.lastping.dev/api/v1/me/delete`
- Auth: API key in cookie `lp_session`

**Session-only.** `email` must exactly match (case-insensitive,
trimmed) the account's own email — typed confirmation, the same
guard the dashboard's delete-account form uses. On success, deletes
the account and everything that belongs to it (projects, monitors,
destinations, pings, incidents, deliveries, API keys, status pages,
sessions and more) and clears this request's
session cookie.

The delete target is ALWAYS the session's own user — never a
request-supplied id — so there is no IDOR surface here.

An API-key request gets 403 `SESSION_ONLY`, never 404. Being a
write, it also requires the CSRF double-submit header: 403
`CSRF_REQUIRED` if `X-CSRF-Token` is missing or does not match the
`lp_csrf` cookie.

## Request body

- DeleteAccountRequest: Body for POST /api/v1/me/delete.
  - `email` string, email, required: Must exactly match (case-insensitive, trimmed) the account's own email address — typed confirmation, the same guard the dashboard's delete-account form uses.

## Response `204`

Account deleted. The session cookie has been cleared.

## Other responses

- `400`: `EMAIL_MISMATCH` — email did not match the account's own address. Nothing was deleted.
- `403`: The request used an API key rather than a session cookie (`SESSION_ONLY`), or the session request was missing a valid `X-CSRF-Token` header (`CSRF_REQUIRED`).
- `429`: Too many requests. The per-principal fixed-window rate limit has been exceeded. Retry after the number of seconds indicated by the `Retry-After` response header. The problem body's `code` is `RATE_LIMITED`. It names this limiter specifically, so a client can tell it apart from the application-level throttles that also answer 429 with their own codes and their own, much longer, `Retry-After` values (`TEST_PING_RATE_LIMITED`, `TOO_MANY_ATTEMPTS`). Back off globally on `RATE_LIMITED`; back off on the one operation for the others. The principal is the API key for a key-authenticated request and the USER for a browser session, so every tab one person has open shares one budget.

---

[API](https://skmtc.dev/lastping/apis/lastping-management-api.md) · [All operations](https://skmtc.dev/lastping/apis/lastping-management-api/llms.txt) · [OpenAPI document](https://skmtc.dev/lastping/apis/lastping-management-api/revisions/bbc6eda91c46?raw)