Docs
OverviewGuidesZero & MCPAPI referenceChangelog
Auth

Delete Account

Delete your account: memberships, sessions, API keys and personal notifications go with it; what you created in workspaces stays, attributed to nobody. 409 `{code: "sole_owner", workspaces}` while you are the only owner of a workspace (make someone else an owner, or schedule its deletion, first). Needs the current password and your email typed as `confirm`. The refresh cookie is cleared.

API key access

Not available to API keys or connected apps: only a signed-in person can call this route.
POST/api/v1/auth/account/delete

Authorization

AuthorizationBearer <token>

Access token from /api/v1/auth/login, or an API key (ro_pat_..., RO-176) from /api/v1/workspaces/current/api-keys: the key implies its workspace and needs the route's scope. MCP connectors (/api/v1/mcp only) may use an OAuth access token (ro_oat_..., RO-284).

In: header

Request Body

password?string | null

The current password (required when the account has one).

Lengthlength <= 256
confirmstring

The account's email address, typed to confirm.

Length1 <= length <= 320

Response Body

curl -X POST "http://localhost:8000/api/v1/auth/account/delete" \  -H "Content-Type: application/json" \  -d '{    "confirm": "string"  }'
Empty
Empty
Empty
Empty
{
  "detail": [
    {
      "loc": [
        "string"
      ],
      "msg": "string",
      "type": "string",
      "input": null,
      "ctx": {}
    }
  ]
}
Empty

Change Password

Change the password (argon2id). Every access token issued before stops at once (the current session gets a new one from `/auth/refresh`). By default every other session and connected app (OAuth) is signed out; the current one (its refresh cookie) stays. A wrong current password is a 400 and counts against the login rate limit (429 with `Retry-After` past it).

List Sessions

Your active sessions (one per sign-in), most recently used first, with the device's user agent and a coarse network. `current` marks this browser's (from the refresh cookie).