self-serve

Deletes the caller's account, per app: a verified key revokes every key of the identity behind it that carries the same label (each MapMap app labels its own key), and, when no other active key remains on the identity, deletes the account itself and erases its email, IP addresses and user agents. An unverified (`provisional`) key revokes only itself, and deletes the account only when it is the account's sole key: anyone who types an address can mint one, so it never speaks for the account. On the store-review identity any key deletes only itself, because that address is not a secret (security check M3). Idempotent: a retry with the same, now revoked, key answers 200 with `already_deleted`.

Authority is the key itself, presented as Authorization: Bearer snk_…. Refused for operator keys (403), OAuth access tokens (403: a connected app must not be able to delete the account it was granted), maps-scoped browser keys (403, by the scope classifier) and a key in ?api_key= (400: the key is revoked by this call, but it should not land in access logs on the way).

delete/v1/keys/self

Request

  • Base URL: https://api.mapmap.ai
  • URL: https://api.mapmap.ai/v1/keys/self
  • Auth: HTTP bearer

Response

Deleted (or already deleted by an earlier call with this key): a verified key revokes the keys sharing its label, and when no other active key remains the account's personal data is erased too; an unverified key revokes only itself, and erases the account only when it is its sole key. The body lists what was erased, what is kept and how many keys remain; for an unverified key (key_verified: false) it is the same whichever happened, with email_erased, keys_remaining and forfeited_credit_pence null

already_deletedboolean required

true when this was a retry with a key the endpoint had already revoked; nothing was changed by this call.

deletedboolean required

Always true on a 200: the calling key is revoked. A verified key takes every key of its account that carries the same label (the same app) with it; an unverified key only itself.

email_erasedboolean nullable

Whether the account's email address was erased. false while another active key remains on the account (see keys_remaining), and for the store-review identity (see review_identity).

null when the calling key was unverified. Such a key may have been requested by anyone who typed the address, so the answer must not tell it whether anyone else holds a key there: the response is the same whether the account was kept or, the key being the only one ever issued for the address, erased with it. message and retained state both possibilities.

erasedstring[] required

What was erased.

forfeited_credit_penceinteger nullable

Prepaid credit left on the account when it was deleted, in pence. It is not refunded by this endpoint. null when the calling key was unverified, for the reason given under email_erased.

key_verifiedboolean required

Whether the calling key was verified. A verified key speaks for its account and is told what happened to it; an unverified key speaks only for itself and is not (see email_erased).

keys_remaininginteger nullable

Active keys still on the account after this call: another MapMap app's key, or keys created with a different label. Deletion by a verified key is per app, so the account and its email are erased only when this is 0. null when the calling key was unverified, for the reason given under email_erased.

keys_revokedinteger required

Keys revoked by this call (0 on a retry).

messagestring required

One sentence for a person.

retainedstring[] required

What is kept, and why.

review_identityboolean required

true for the App Review identity: the account, its email and its review label are kept so the reviewer can sign up again with the same address and get the same verified key, and its IP addresses and user agents are erased. A key on it deletes only itself (its address is not a secret, so a key minted by someone else must not be able to revoke the reviewer's); keys_remaining counts the others.

Changes

No recorded changes to this operation across all 1 revision of this API.