# Users tools

> MCP tools for Users: users_delete, users_sessions_list, users_sessions_revoke, users_sign_ins_list.

- `users_delete`: Delete your user account
- `users_sessions_list`: List where you're signed in
- `users_sessions_revoke`: Sign out of your other sessions
- `users_sign_ins_list`: List your sign-in activity

## `users_delete`

**Delete your user account.** Operation [`users.delete`](https://ownrecord.io/docs/reference/users-delete.md) · Platform level · permission `account:write` · risk tier `security` · since M12

Deletes your Ownrecord account: your memberships in every organization are removed, your sessions end and your
Google or Microsoft sign-in links are removed. Your name and email address are replaced by a pseudonym, so the
audit logs of the organizations you worked in still show that an account did what it did, without your
personal data. You can sign up again later with the same address; it'll be a new account.

It's refused while you're the only owner of an organization (`last_owner`, with the organizations in
`details.organizations`): make someone else its owner, or close it, first. Confirm with your email address.

**Who can call it:** the signed-in user, for their own account, with a sign-in in the last 15 minutes.

Annotations: `readOnlyHint: false` · `destructiveHint: true` · `idempotentHint: false` · `openWorldHint: false`

### Arguments

| Argument          | Type    | Required | Description                                                                                                                                                                                              |
| ----------------- | ------- | -------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `confirm`         | string  | yes      | Your email address, as confirmation. (1–320 characters)                                                                                                                                                  |
| `idempotency_key` | string  | no       | A unique string for this change. Retrying with the same key and arguments never acts twice. When left out, the server generates one and returns it in the result's `idempotency_key`. (1–255 characters) |
| `dry_run`         | boolean | no       | true: check permissions and rules and compute the result, then roll everything back. Nothing is saved. (default `false`)                                                                                 |

- **Idempotency:** the result returns the `idempotency_key` used, yours or one the server generated. Retry with it: a call with the same key and arguments never acts twice (keys are kept for 24 hours).
- **Dry run:** supported. `dry_run: true` checks permissions and rules and computes the result, then rolls everything back.

### Errors

- [`confirmation_mismatch`](https://ownrecord.io/docs/reference/errors.md#confirmation_mismatch): `confirm` isn't your email address.
- [`last_owner`](https://ownrecord.io/docs/reference/errors.md#last_owner): You're the only owner of an organization (`details.organizations`).
- [`fresh_auth_required`](https://ownrecord.io/docs/reference/errors.md#fresh_auth_required): Your last sign-in is older than 15 minutes.
- [`permission_denied`](https://ownrecord.io/docs/reference/errors.md#permission_denied): The caller isn't a signed-in user.

### Example

**Delete my account**

Arguments:

```json
{
  "confirm": "ana@acme.example",
  "idempotency_key": "8d0c5f8e-4b7a-4e43-9b0f-2f6a0c1d9e21"
}
```

Result `output`:

```json
{
  "object": "deleted_user",
  "id": "usr_01m4tx5nj8emwbyf7y9vcf47xa",
  "deleted": true,
  "memberships": 2,
  "sessions": 1
}
```

## `users_sessions_list`

**List where you're signed in.** Operation [`users.sessions.list`](https://ownrecord.io/docs/reference/users-sessions-list.md) · Platform level · permission `account:read` · risk tier `read` · since M13

Lists your active console sessions, newest first: when each started, when you last signed in on it, when it
ends (after 2 hours without activity, and 12 hours after the sign-in at the latest), and the country and
browser of the sign-in. End one, or all but the current one, with `users.sessions.revoke`.

**Who can call it:** the signed-in user, for their own account.

Annotations: `readOnlyHint: true` · `destructiveHint: false` · `idempotentHint: true` · `openWorldHint: false`

### Arguments

This tool takes no arguments.

- **Read-only:** changes nothing; `idempotency_key` is ignored.

### Errors

- [`permission_denied`](https://ownrecord.io/docs/reference/errors.md#permission_denied): The caller isn't a signed-in user.

### Example

**One session**

Arguments:

```json
{}
```

Result `output`:

```json
{
  "object": "list",
  "data": [
    {
      "object": "session",
      "id": "ses_01m4tx5nj8emwbyf7y9vcf47xc",
      "createdAt": "2026-10-30T08:15:00.000Z",
      "lastAuthenticatedAt": "2026-10-30T08:15:00.000Z",
      "idleExpiresAt": "2026-10-30T10:15:00.000Z",
      "expiresAt": "2026-10-30T20:15:00.000Z",
      "country": "HR",
      "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 15_5) AppleWebKit/605.1.15 Version/18.5 Safari/605.1.15"
    }
  ]
}
```

## `users_sessions_revoke`

**Sign out of your other sessions.** Operation [`users.sessions.revoke`](https://ownrecord.io/docs/reference/users-sessions-revoke.md) · Platform level · permission `account:write` · risk tier `security` · since M13

Ends one of your console sessions (`id`), or every session except one (`keep`: the console passes the session
you're using, so this is "sign out everywhere else"). The browsers of the ended sessions are signed out at
their next request. Your sign-in activity shows the change.

**Who can call it:** the signed-in user, for their own sessions, with a sign-in in the last 15 minutes.

Annotations: `readOnlyHint: false` · `destructiveHint: true` · `idempotentHint: true` · `openWorldHint: false`

### Arguments

| Argument          | Type         | Required | Description                                                                                                                                                                                              |
| ----------------- | ------------ | -------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `id`              | ID (`ses_…`) | no       | End this session (`ses_…`).                                                                                                                                                                              |
| `keep`            | ID (`ses_…`) | no       | End every session but this one: the console passes the session you're using.                                                                                                                             |
| `idempotency_key` | string       | no       | A unique string for this change. Retrying with the same key and arguments never acts twice. When left out, the server generates one and returns it in the result's `idempotency_key`. (1–255 characters) |
| `dry_run`         | boolean      | no       | true: check permissions and rules and compute the result, then roll everything back. Nothing is saved. (default `false`)                                                                                 |

- **Idempotency:** the result returns the `idempotency_key` used, yours or one the server generated. Retry with it: a call with the same key and arguments never acts twice (keys are kept for 24 hours).
- **Dry run:** supported. `dry_run: true` checks permissions and rules and computes the result, then rolls everything back.

### Errors

- [`validation_failed`](https://ownrecord.io/docs/reference/errors.md#validation_failed): Neither or both of `id` and `keep` were passed.
- [`session_not_found`](https://ownrecord.io/docs/reference/errors.md#session_not_found): `id` isn't one of your active sessions.
- [`fresh_auth_required`](https://ownrecord.io/docs/reference/errors.md#fresh_auth_required): Your last sign-in is older than 15 minutes.
- [`permission_denied`](https://ownrecord.io/docs/reference/errors.md#permission_denied): The caller isn't a signed-in user.

### Examples

**Sign out everywhere else**

Arguments:

```json
{
  "keep": "ses_01m4tx5nj8emwbyf7y9vcf47xc",
  "idempotency_key": "8d0c5f8e-4b7a-4e43-9b0f-2f6a0c1d9e21"
}
```

Result `output`:

```json
{
  "object": "session_revocation",
  "revoked": 2
}
```

**End one session**

Arguments:

```json
{
  "id": "ses_01m4tx5nj8emwbyf7y9vcf47xd",
  "idempotency_key": "8d0c5f8e-4b7a-4e43-9b0f-2f6a0c1d9e21"
}
```

Result `output`:

```json
{
  "object": "session_revocation",
  "revoked": 1
}
```

## `users_sign_ins_list`

**List your sign-in activity.** Operation [`users.sign_ins.list`](https://ownrecord.io/docs/reference/users-sign-ins-list.md) · Platform level · permission `account:read` · risk tier `read` · since M13

Lists the security events of your account, newest first: sign-ins (`auth.signed_in`, with the method), fresh
sign-ins before a sensitive action (`auth.reauthenticated`), sign-outs, sign-ins that were refused
(`auth.sign_in_refused`, with the reason: a disabled account, too many sign-in codes, …), Google or Microsoft
accounts added as a way to sign in (`auth.identity_linked`), the security emails sent to you about a sign-in from
a network, country or browser your account hadn't used in 90 days or an added sign-in method (`auth.notice_sent`,
with `new_sign_in` or `identity_linked` as the reason) and changes to your account such as ending your other
sessions. Each shows the country, the network (the client address shortened to /24 or /48) and the browser. If
you see a sign-in that wasn't you, end your other sessions (`users.sessions.revoke`) and tell your
organization's owner and Ownrecord support.

**Who can call it:** the signed-in user, for their own account.

Annotations: `readOnlyHint: true` · `destructiveHint: false` · `idempotentHint: true` · `openWorldHint: false`

### Arguments

| Argument | Type    | Required | Description                                          |
| -------- | ------- | -------- | ---------------------------------------------------- |
| `limit`  | integer | no       | How many events, at most 100. (1–100) (default `50`) |

- **Read-only:** changes nothing; `idempotency_key` is ignored.

### Errors

- [`validation_failed`](https://ownrecord.io/docs/reference/errors.md#validation_failed): `limit` is out of range.
- [`permission_denied`](https://ownrecord.io/docs/reference/errors.md#permission_denied): The caller isn't a signed-in user.

### Example

**A sign-in and a refused one**

Arguments:

```json
{
  "limit": 50
}
```

Result `output`:

```json
{
  "object": "list",
  "data": [
    {
      "object": "security_event",
      "id": "aud_01m4tx5nj8emwbyf7y9vcf47xe",
      "at": "2026-10-30T08:15:00.000Z",
      "action": "auth.signed_in",
      "by": "you",
      "method": "google",
      "reason": null,
      "country": "HR",
      "network": "203.0.113.0",
      "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 15_5) AppleWebKit/605.1.15 Version/18.5 Safari/605.1.15"
    },
    {
      "object": "security_event",
      "id": "aud_01m4tx5nj8emwbyf7y9vcf47xf",
      "at": "2026-10-29T17:02:00.000Z",
      "action": "auth.sign_in_refused",
      "by": "system",
      "method": "email",
      "reason": "sign_in_link_rate_limited",
      "country": "DE",
      "network": "198.51.100.0",
      "userAgent": null
    }
  ]
}
```