---
title: "Delete project"
method: DELETE
path: "/api/v1/me/profiles/{profileId}"
tags: ["Profiles"]
---

# Delete project

`DELETE /api/v1/me/profiles/{profileId}`

## Request

- Base URL: `https://api.proof.holdings`
- URL: `https://api.proof.holdings/api/v1/me/profiles/{profileId}`
- Auth: one of:
  - API key in cookie `auth_token`
  - HTTP bearer

Delete a project (a sub-account) — h-implement-proper-deletion, PRJ-1..4. The last project cannot be deleted (`400 cannot_delete_last_profile`). A signed-in session needs a single-use `profile_delete` step-up grant bound to this id (`403 2fa_required`; `reason: target_mismatch` when the grant names other ids). An API key may delete only an EMPTY project — no live keys, no approval setups, no pending requests — and otherwise answers `403 owner_session_required`. What goes: the project's API keys are revoked and their login sessions ended; approval setups PROVABLY the project's own (created with the project named, or by one of its keys) are archived, their pending confirmations declined and their consents revoked; pending requests provably its own are cancelled; its message templates are deleted; its username is RETIRED FOR GOOD. What stays: everything linked to the project only because it was the primary at the time is DETACHED (link removed; branding falls back to the current primary) unless `archive_default_linked` is sent; finished requests, verifications, domains and circles stay as history with the link removed. Deleting the primary is allowed: the oldest remaining project becomes primary and the response names it. Cannot be undone. `GET /me/profiles/{profileId}/deletion-preview` shows the same counts beforehand.

## Path parameters

- `profileId` string, required: Profile ID

## Request body

- object
  - `archive_default_linked` boolean: Also archive the approval setups, and cancel the pending requests, that were linked to this project only because it was the primary when they were created (the dialog's checkbox).

## Response `200`

Project deleted — what went, and which project is primary now

- ProjectDeletedResponse
  - `success` true, required
  - `message` string, required
  - `project` object, required
    - `id` string, required
    - `name` string, required
    - `username` string, nullable, required
  - `was_primary` boolean, required
  - `api_keys_revoked` integer, required
  - `hitl_archived` integer, required
  - `hitl_detached` integer, required
  - `confirmations_denied` integer, required
  - `authorizations_revoked` integer, required
  - `requests_cancelled` integer, required
  - `requests_detached` integer, required
  - `verifications_detached` integer, required
  - `domains_detached` integer, required
  - `circles_detached` integer, required
  - `templates_deleted` integer, required
  - `username_retired` boolean, required: The username is retired for good — it can never be claimed again, by anyone.
  - `new_primary` object, nullable, required: Named when the deleted project is (or was) the primary: the OLDEST remaining project takes over, and messages sent without choosing a project carry its name.
    - `id` string, required
    - `name` string, required

## Other responses

- `400`: `cannot_delete_last_profile` — the last project cannot be deleted; `validation_error`
- `403`: `account_key_required` — this API key is bound to one sub-account; account-level changes need an account-wide key or the dashboard. `owner_session_required` — an API key may delete only an empty project; `2fa_required` — a session needs a `profile_delete` grant bound to this id (`reason: target_mismatch` when the grant names other ids). Nothing was changed
- `404`: Profile not found

---

[API](https://skmtc.dev/proof/apis/proof-holdings-api.md) · [All operations](https://skmtc.dev/proof/apis/proof-holdings-api/llms.txt) · [OpenAPI document](https://skmtc.dev/proof/apis/proof-holdings-api/revisions/6b8d61ee354f?raw)