---
title: "DELETE /v1/users/me — soft-delete the current user (GDPR right-to-be-forgotten)."
method: DELETE
path: "/v1/users/me"
tags: ["users"]
---

# DELETE /v1/users/me — soft-delete the current user (GDPR right-to-be-forgotten).

`DELETE /v1/users/me`

The user's PII (email, name, password hash, MFA secret, avatar) is cleared
and the row is tombstoned with `deleted_at`. Sessions are invalidated, org
memberships removed, and pending invites issued by this user revoked. Audit
events are preserved.

Requires fresh credential proof: the current password (password-backed
accounts) or a TOTP code (MFA-enabled accounts). At least one must be
supplied; both being valid is fine but a single matching proof is enough.

Returns `409 Conflict` if the user is the sole owner of an organization —
ownership must be transferred first.

## Request body

- DeleteMeRequest — DELETE /v1/users/me — body confirms the destructive action. Provide exactly one credential proof: the current password (for password-backed accounts) or a TOTP code (when MFA is enabled). OAuth-only accounts must enrol in MFA before deletion is permitted.
  - `mfa_code` string, nullable — TOTP code — required when MFA is enabled.
  - `password` string, nullable — Current account password — required for password-backed accounts.

## Response `200`

Account deleted

- MessageResponse — Simple message response for operations without a body.
  - `message` string, required

## Other responses

- `400` — Missing credential proof
- `401` — Invalid password or MFA code
- `409` — Sole owner of an organization

---

[API](https://skmtc.dev/microsandbox/apis/microsandbox-api.md) · [All operations](https://skmtc.dev/microsandbox/apis/microsandbox-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/microsandbox/microsandbox-api/revisions/23f2a45cb09b/schema)