---
title: "Confirm account deletion via email-link token"
method: POST
path: "/v1/account/deletion-confirm"
tags: ["Account"]
---

# Confirm account deletion via email-link token

`POST /v1/account/deletion-confirm`

## Request

- Base URL: `https://api.zindex.ai`
- URL: `https://api.zindex.ai/v1/account/deletion-confirm`
- Auth: none declared

Token-authenticated: the token from the email link is the authorization, so no session cookie is needed. Validates the token, cancels any Stripe subscription and deletes the Stripe customer record, then closes the account at once, removing the user record, every API key, every connected app with its tokens, every diagram in the personal workspace with all its revisions (their stored images follow within a day), the problem reports and feedback the account made, the share links it made in its personal workspace, the personal workspace, operational telemetry that references the account (request logs, monthly render counts, plan-change history) and the audit log's record of access to its diagrams. Team workspaces the person is alone in are deleted the same way, their subscriptions canceled; the person leaves every other team workspace, and the diagrams they made there stay with it, attributed to a former member. From each team workspace they pay for, their card is removed before anything is deleted, its billing contact moves to the remaining owner who joined first, and its owners are asked by email to add a card (the preflight's teams.leaving[].youPay). A deletion log keeps, by ID, the fact that the account and each of its diagrams were deleted, without their contents. Backup snapshots holding the data age out within 30 days. Stripe keeps its own billing records under its privacy policy.

## Request body

- object
  - `token` string, required: The plaintext token from the confirmation email.

## Response `200`

The account is deleted, as the description lists. status is always deleted.

- object
  - `status` 'deleted'

## Other responses

- `400`: INVALID_REQUEST: the body isn't JSON, or token is missing.
- `409`: LAST_OWNER: someone joined a team workspace the person owns alone since the request, so it would lose its last owner; blocking lists it. Nothing was deleted.
- `410`: TOKEN_INVALID: the token is invalid, already used or expired. Ask for a new link from Settings.
- `429`: RATE_LIMITED: over the request rate limit (see Rate Limiting). Wait retryAfter seconds (also the Retry-After header), then try again.
- `502`: BILLING_UNAVAILABLE: Stripe couldn't cancel a subscription or remove the person's card from a team workspace they pay for. Nothing was deleted; the account and its subscriptions are unchanged. Owner may retry.

## Changes

- **2026-10-20** `1d21bd5bbf8e`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/zindex/apis/zindex-api/changes/v1/account/deletion-confirm/post.md)

---

[API](https://skmtc.dev/zindex/apis/zindex-api.md) · [All operations](https://skmtc.dev/zindex/apis/zindex-api/llms.txt) · [OpenAPI document](https://skmtc.dev/zindex/apis/zindex-api/revisions/1d21bd5bbf8e?raw)