Delete your user account
The users.delete operation: POST /api/v1/users/me/delete in the REST API and the users_delete tool in the MCP server.
/api/v1/users/me/deleteDeletes your Ownrecord account: your memberships in every organization are removed, your sessions end and your Google or Microsoft sign-in links are removed. Your name and email address are replaced by a pseudonym, so the audit logs of the organizations you worked in still show that an account did what it did, without your personal data. You can sign up again later with the same address; it'll be a new account.
It's refused while you're the only owner of an organization (last_owner, with the organizations in
details.organizations): make someone else its owner, or close it, first. Confirm with your email address.
Who can call it: the signed-in user, for their own account, with a sign-in in the last 15 minutes.
At a glance
- REST:
POST /api/v1/users/me/delete - MCP tool:
users_delete - Operation ID:
users.delete - Scope: Platform
- Permission:
account:write - Risk tier:
security - Dry run: Supported (send
Ownrecord-Dry-Run: true) - Idempotency:
Idempotency-Keyrequired - Modes: Test and live
- Authentication: API key with the
account:writescope - Fresh sign-in: In the console, a sign-in within the last 15 minutes
- Since: M12
Request
Body
A JSON object (Content-Type: application/json):
| Field | Type | Required | Description |
|---|---|---|---|
confirm | string | Yes | Your email address, as confirmation. |
Response
200 OK with a JSON object:
| Field | Type | Description |
|---|---|---|
object | "deleted_user" | |
id | usr_… ID | |
deleted | true | |
memberships | integer | Memberships removed. |
sessions | integer | Sessions ended. |
Examples
Delete my account
POST /api/v1/users/me/delete
Authorization: Bearer or_test_…
Idempotency-Key: 3f1c9a52-7d0e-4b8f-9a61-0c2d5e8b7f14
Content-Type: application/json
{
"confirm": "ana@acme.example"
}
Response (200):
{
"object": "deleted_user",
"id": "usr_01m4tx5nj8emwbyf7y9vcf47xa",
"deleted": true,
"memberships": 2,
"sessions": 1
}
Errors
| Code | HTTP status | When | What to do |
|---|---|---|---|
confirmation_mismatch | 400 | confirm isn't your email address. | Type exactly what the form asks for (the organization's slug, or your email address). |
last_owner | 409 | You're the only owner of an organization (details.organizations). | Make another member an owner first, then change or remove this membership. |
fresh_auth_required | 403 | Your last sign-in is older than 15 minutes. | Sign in again, then repeat the action within 15 minutes. |
permission_denied | 403 | The caller isn't a signed-in user. | Ask an organization owner or admin for a role or scope that allows this action. |
It can also return these common errors: validation_failed, api_version_unsupported, invalid_json, unsupported_media_type, authentication_required, api_key_invalid, resource_not_found, idempotency_key_required, idempotency_key_reused, idempotency_in_progress, rate_limited, internal_error.