Skip to content

Delete your user account

The users.delete operation: POST /api/v1/users/me/delete in the REST API and the users_delete tool in the MCP server.

POST/api/v1/users/me/delete

Deletes your Ownrecord account: your memberships in every organization are removed, your sessions end and your Google or Microsoft sign-in links are removed. Your name and email address are replaced by a pseudonym, so the audit logs of the organizations you worked in still show that an account did what it did, without your personal data. You can sign up again later with the same address; it'll be a new account.

It's refused while you're the only owner of an organization (last_owner, with the organizations in details.organizations): make someone else its owner, or close it, first. Confirm with your email address.

Who can call it: the signed-in user, for their own account, with a sign-in in the last 15 minutes.

At a glance

  • REST: POST /api/v1/users/me/delete
  • MCP tool: users_delete
  • Operation ID: users.delete
  • Scope: Platform
  • Permission: account:write
  • Risk tier: security
  • Dry run: Supported (send Ownrecord-Dry-Run: true)
  • Idempotency: Idempotency-Key required
  • Modes: Test and live
  • Authentication: API key with the account:write scope
  • Fresh sign-in: In the console, a sign-in within the last 15 minutes
  • Since: M12

Request

Body

A JSON object (Content-Type: application/json):

FieldTypeRequiredDescription
confirmstringYesYour email address, as confirmation.

Response

200 OK with a JSON object:

FieldTypeDescription
object"deleted_user"
idusr_… ID
deletedtrue
membershipsintegerMemberships removed.
sessionsintegerSessions ended.

Examples

Delete my account

HTTP
POST /api/v1/users/me/delete
Authorization: Bearer or_test_…
Idempotency-Key: 3f1c9a52-7d0e-4b8f-9a61-0c2d5e8b7f14
Content-Type: application/json

{
  "confirm": "ana@acme.example"
}

Response (200):

JSON
{
  "object": "deleted_user",
  "id": "usr_01m4tx5nj8emwbyf7y9vcf47xa",
  "deleted": true,
  "memberships": 2,
  "sessions": 1
}

Errors

CodeHTTP statusWhenWhat to do
confirmation_mismatch400confirm isn't your email address.Type exactly what the form asks for (the organization's slug, or your email address).
last_owner409You're the only owner of an organization (details.organizations).Make another member an owner first, then change or remove this membership.
fresh_auth_required403Your last sign-in is older than 15 minutes.Sign in again, then repeat the action within 15 minutes.
permission_denied403The caller isn't a signed-in user.Ask an organization owner or admin for a role or scope that allows this action.

It can also return these common errors: validation_failed, api_version_unsupported, invalid_json, unsupported_media_type, authentication_required, api_key_invalid, resource_not_found, idempotency_key_required, idempotency_key_reused, idempotency_in_progress, rate_limited, internal_error.