Delete my account
POST /fapi/v1/me/deletion · called from the environment's sign-in host
Schedules the deletion of the signed-in user's own account. The account waits for the environment's self_service_deletion_grace_days (0–30 days, 14 by default) and is then deleted permanently; with 0 days it is deleted at the next run of the deletion job. Every session, refresh token and access token of the user is revoked at once, including the session that made the request. During the waiting period the user can sign in only through the account portal, and only to cancel the deletion or to request and download an export of their own data.
Requires a recent sign-in: if the session was not verified in the last 5 minutes, or the user has a second factor and the session did not use it, the answer is 401 step_up_required and nothing changes. Sending the same request again returns the same pending deletion.
A user who is the last active admin of an organization cannot delete their account: the answer is 409 last_org_admin and nothing changes. Another member must be given the organization's admin role first.
Request
Headers:
| Header | Required | Description |
|---|---|---|
Idp-Client |
yes | SDK identifier. |
Origin |
yes | Must be exactly https://<sign-in host>. |
Body:
{}
Response
202 Accepted:
{"status": "scheduled", "due_at": "2026-11-10T09:30:00Z", "cancellable": true}
Errors
| Status | Code | When |
|---|---|---|
| 401 | unauthenticated |
No valid session cookie. |
| 401 | step_up_required |
Sign-in older than 5 minutes, or a second factor is required; the WWW-Authenticate header carries max_age=300 (and acr_values when a second factor is required). |
| 403 | origin_not_allowed |
Origin is missing or wrong. |
| 403 | user_not_active |
The user is blocked or is already being deleted by an administrator. |
| 404 | not_found |
Self-service deletion is turned off in the environment. |
| 409 | last_org_admin |
The user is the last active admin of an organization. |
| 503 | service_unavailable |
The user directory is temporarily unavailable; retry after Retry-After. |
Example
curl -X POST https://example.keenauth.app/fapi/v1/me/deletion \
-H "Idp-Client: my-app/1.0.0 (node/22.0.0)" \
-H "Origin: https://example.keenauth.app" \
-H "Content-Type: application/json" \
-d '{}' \
-b cookies.txt
Personal data
This endpoint carries personal data: end-user profile. Personal data in the KeenAuth APIs describes what is stored, how long it is kept and how it is deleted. Do not send special categories of personal data (health, biometric data, religion, political opinions, sexual orientation) in any field.