# Delete my account

`POST /fapi/v1/me/deletion` · called from the environment's sign-in host

Schedules the deletion of the signed-in user's own account. The account waits for the environment's `self_service_deletion_grace_days` (0–30 days, 14 by default) and is then deleted permanently; with 0 days it is deleted at the next run of the deletion job. Every session, refresh token and access token of the user is revoked at once, including the session that made the request. During the waiting period the user can sign in only through the account portal, and only to cancel the deletion or to request and download an export of their own data.

Requires a recent sign-in: if the session was not verified in the last 5 minutes, or the user has a second factor and the session did not use it, the answer is `401 step_up_required` and nothing changes. Sending the same request again returns the same pending deletion.

A user who is the last active admin of an organization cannot delete their account: the answer is `409 last_org_admin` and nothing changes. Another member must be given the organization's admin role first.

## Request

Headers:

| Header | Required | Description |
| --- | --- | --- |
| `Idp-Client` | yes | SDK identifier. |
| `Origin` | yes | Must be exactly `https://<sign-in host>`. |

Body:

```json
{}
```

## Response

`202 Accepted`:

```json
{"status": "scheduled", "due_at": "2026-11-10T09:30:00Z", "cancellable": true}
```

## Errors

| Status | Code | When |
| --- | --- | --- |
| 401 | `unauthenticated` | No valid session cookie. |
| 401 | `step_up_required` | Sign-in older than 5 minutes, or a second factor is required; the `WWW-Authenticate` header carries `max_age=300` (and `acr_values` when a second factor is required). |
| 403 | `origin_not_allowed` | `Origin` is missing or wrong. |
| 403 | `user_not_active` | The user is blocked or is already being deleted by an administrator. |
| 404 | `not_found` | Self-service deletion is turned off in the environment. |
| 409 | `last_org_admin` | The user is the last active admin of an organization. |
| 503 | `service_unavailable` | The user directory is temporarily unavailable; retry after `Retry-After`. |

## Example

```bash
curl -X POST https://example.keenauth.app/fapi/v1/me/deletion \
  -H "Idp-Client: my-app/1.0.0 (node/22.0.0)" \
  -H "Origin: https://example.keenauth.app" \
  -H "Content-Type: application/json" \
  -d '{}' \
  -b cookies.txt
```

## Personal data

This endpoint carries personal data: end-user profile. [Personal data in the KeenAuth APIs](/docs/policies/personal-data) describes what is stored, how long it is kept and how it is deleted. Do not send special categories of personal data (health, biometric data, religion, political opinions, sexual orientation) in any field.