---
title: "Delete agent (GDPR Art. 17 cascade)"
method: DELETE
path: "/agents/{agent_id}"
tags: ["Agents"]
---

# Delete agent (GDPR Art. 17 cascade)

`DELETE /agents/{agent_id}`

## Request

- Base URL: `https://api.mnemom.ai/v1`
- URL: `https://api.mnemom.ai/v1/agents/{agent_id}`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-Mnemom-Api-Key`

Tombstone an agent and asynchronously cascade deletion across all agent-owned records (traces, integrity checkpoints, drift alerts, reclassifications, etc.) per ADR-021. The request returns `202 Accepted` immediately with a `deletion_request_id`; poll [GET /v1/agents/{agent_id}/deletion-status](/api-reference/endpoint/get-agents-agent-id-deletion-status) or subscribe to the deletion webhook for cascade progress.

Idempotent: re-DELETE on a tombstoned agent returns the existing `deletion_request_id` with the current status.

Authorized for an org owner/admin of the agent's org OR the agent's creator (while still a member of that org). A caller who is not a member of the agent's org gets the same 404 as a missing agent (no existence oracle); an org member who is neither owner/admin nor the creator gets 403.

## Path parameters

- `agent_id` string, required

## Response `202`

Deletion accepted; cascade will run asynchronously

- object
  - `deletion_request_id` string, required: Stable identifier for this deletion request; pass to deletion-status to poll progress.
  - `status` 'received' | 'tombstoned' | 'phase_1_complete' | 'phase_2_complete' | 'phase_3_complete' | 'phase_4_complete' | 'phase_5_complete' | 'phase_6_complete' | 'phase_7_complete' | 'kv_cleared' | 'pseudonymized' | 'complete' | 'failed', required: Initial state of a fresh delete is `tombstoned` (the synchronous part); the async cascade advances it through `phase_1_complete` … `phase_7_complete` → `kv_cleared` → `pseudonymized` → `complete` (or `failed`). An idempotent re-DELETE echoes the current status, so any of these may appear.
  - `requested_at` string, date-time, required
  - `completed_at` string, date-time, nullable: Set once the async cascade finishes. `null` while in flight.

## Other responses

- `400`: Bad request
- `401`: Authentication required
- `403`: Forbidden
- `404`: Resource not found
- `429`: Rate-limit exceeded. The global per-IP limiter (100 requests/minute, applied to every `/v1/*` route) rejected this request. Back off until the window resets — `Retry-After` carries the cooldown in seconds and `X-RateLimit-Reset` the absolute reset time.
- `500`: Server error — request was well-formed but the server failed to fulfill it. Typically a downstream dependency (DB / RPC / external API) returned an unexpected error.

---

[API](https://skmtc.dev/mnemom/apis/mnemom-api.md) · [All operations](https://skmtc.dev/mnemom/apis/mnemom-api/llms.txt) · [OpenAPI document](https://skmtc.dev/mnemom/apis/mnemom-api/revisions/274b7a6ea182?raw)