> ## Documentation Index
> Fetch the complete documentation index at: https://spoome-docs-account-deletion.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Restore Account

> Cancel a pending account deletion during the grace period.

Two mutually exclusive proofs: ``email`` + ``password`` validates the
account credentials, ``restore_token`` consumes the one-shot link from
the deletion notice email (the only path for OAuth-only accounts).
Either flips the account back to ACTIVE, clears the purge deadline,
and sends a cancellation notice to the account address. Only works
while the account is PENDING_DELETION. The hard boundary is the
erasure sweep claiming the account (typically within minutes of the
``purge_after`` deadline from ``DELETE /api/v1/me``), so a restore in
the window between the deadline and the claim still succeeds; once
erasure has started, restore is refused for good.

**Authentication**: Not required (public endpoint)

**Rate Limits**: 3/hour

**Security**: Returns a uniform 403 for wrong credentials, unknown
email, invalid or spent tokens, and accounts not pending deletion —
prevents account enumeration and state probing.



## OpenAPI

````yaml /openapi-v1.json post /auth/restore
openapi: 3.1.0
info:
  title: spoo.me
  description: >-
    REST API for spoo.me — free and open-source URL shortening service serving
    400k+ redirects/day.


    Authenticate using either:

    - **API Key**: `Authorization: Bearer spoo_<your_key>`

    - **JWT Token**: `Authorization: Bearer <jwt>` (obtained via /auth/login)

    - **Session Cookie**: `access_token` cookie (set automatically on login)
  contact:
    name: spoo.me
    url: https://spoo.me/contact
    email: support@spoo.me
  license:
    name: AGPL-3.0
    url: https://github.com/spoo-me/spoo/blob/main/LICENSE
  version: 1.0.0
servers:
  - url: https://spoo.me
    description: Production
security:
  - ApiKeyAuth: []
  - JWTAuth: []
tags:
  - name: URL Shortening
    description: Create new shortened URLs
  - name: Link Management
    description: List, update, and delete your shortened URLs
  - name: Statistics
    description: Click analytics and data export
  - name: API Keys
    description: Create and manage API keys for programmatic access
  - name: Authentication
    description: Login, register, password management, and email verification
  - name: OAuth
    description: OAuth provider login, linking, and unlinking
  - name: System
    description: Health checks and server metrics
paths:
  /auth/restore:
    post:
      tags:
        - Authentication
      summary: Restore Account
      description: |-
        Cancel a pending account deletion during the grace period.

        Two mutually exclusive proofs: ``email`` + ``password`` validates the
        account credentials, ``restore_token`` consumes the one-shot link from
        the deletion notice email (the only path for OAuth-only accounts).
        Either flips the account back to ACTIVE, clears the purge deadline,
        and sends a cancellation notice to the account address. Only works
        while the account is PENDING_DELETION. The hard boundary is the
        erasure sweep claiming the account (typically within minutes of the
        ``purge_after`` deadline from ``DELETE /api/v1/me``), so a restore in
        the window between the deadline and the claim still succeeds; once
        erasure has started, restore is refused for good.

        **Authentication**: Not required (public endpoint)

        **Rate Limits**: 3/hour

        **Security**: Returns a uniform 403 for wrong credentials, unknown
        email, invalid or spent tokens, and accounts not pending deletion —
        prevents account enumeration and state probing.
      operationId: restoreAccount
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RestoreAccountRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MessageResponse'
        '400':
          description: Bad Request — invalid parameters
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '401':
          description: Unauthorized — missing or invalid credentials
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '403':
          description: >-
            Forbidden — invalid credentials, unknown email or token, or account
            is not pending deletion
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
        '429':
          description: Rate limit exceeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security: []
components:
  schemas:
    RestoreAccountRequest:
      properties:
        email:
          anyOf:
            - type: string
              format: email
            - type: 'null'
          title: Email
          description: Account email address (credential restore)
          examples:
            - user@example.com
        password:
          anyOf:
            - type: string
              maxLength: 255
            - type: 'null'
          title: Password
          description: Account password (credential restore)
          examples:
            - MySecurePass123!
        restore_token:
          anyOf:
            - type: string
              maxLength: 128
              minLength: 16
            - type: 'null'
          title: Restore Token
          description: >-
            One-shot restore token from the deletion notice email (token restore
            — OAuth-only accounts)
      type: object
      title: RestoreAccountRequest
      description: |-
        Request body for POST /auth/restore.

        Exactly one restore proof: ``email`` + ``password`` for accounts with
        a password, or ``restore_token`` (the one-shot token from the
        deletion notice email — the only path for OAuth-only accounts).
        Mixing or omitting both is a validation error, not a 403.
    MessageResponse:
      properties:
        success:
          type: boolean
          title: Success
        message:
          anyOf:
            - type: string
            - type: 'null'
          title: Message
      type: object
      required:
        - success
      title: MessageResponse
      description: Generic success/message response returned by several endpoints.
    ErrorResponse:
      properties:
        error:
          type: string
          title: Error
        code:
          type: string
          title: Code
        field:
          anyOf:
            - type: string
            - type: 'null'
          title: Field
        details:
          anyOf:
            - {}
            - type: 'null'
          title: Details
      type: object
      required:
        - error
        - code
      title: ErrorResponse
      description: Standard error JSON body produced by the AppError exception handler.
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
              - type: string
              - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
        input:
          title: Input
        ctx:
          type: object
          title: Context
      type: object
      required:
        - loc
        - msg
        - type
      title: ValidationError
  securitySchemes:
    ApiKeyAuth:
      type: http
      scheme: bearer
      bearerFormat: spoo_<key>
      description: 'API key authentication. Pass your key as: `Bearer spoo_<your_key>`'
    JWTAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: 'JWT access token from /auth/login. Pass as: `Bearer <jwt_token>`'

````