---
title: "Request Account Deletion"
method: POST
path: "/api/auth/account/delete"
---

# Request Account Deletion

`POST /api/auth/account/delete`

Self-service account deletion (cooling-off).

Re-authenticates the caller, then flags the row with a deletion
timestamp. The account is immediately treated as logged-out (see
current_user), but NO data is removed yet — a successful re-login
within ACCOUNT_DELETION_GRACE_DAYS clears the flag (undo). A daily
sweep (_purge_due_deletions) hard-deletes rows past the window; the
Postgres FK CASCADE then removes all owned data, and the sweep also
clears OTP codes and decrements blob ref-counts.

Re-auth path is decided by the account type:
- has a real password  → must supply the correct `password`.
- phone/email-OTP-only → must supply a fresh `code` (requested via
  the existing /api/auth/sms|email/send), verified against the same
  OTP table login uses.

## Headers

- `authorization` string, nullable

## Request body

- DeleteAccountIn
  - `password` string, nullable
  - `code` string, nullable

## Response `200`

Successful Response

- object

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.dev/omicos/apis/omicos-server.md) · [All operations](https://skmtc.dev/omicos/apis/omicos-server/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/omicos/omicos-server/revisions/a00b94573ffe/schema)