> ## Documentation Index
> Fetch the complete documentation index at: https://spoome-docs-account-deletion.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Delete Account

> Request permanent account deletion (GDPR Art. 17).

Re-authentication is required: accounts with a password send
``password``; OAuth-only accounts confirm by typing their exact
account email as ``confirm_email``. On success the account enters a
grace period (7 days by default) and `purge_after` marks its end —
after that instant a background sweep permanently erases the account,
its links, and their analytics.

During the grace period every login is blocked with error code
``ACCOUNT_PENDING_DELETION``; ``POST /auth/restore`` cancels the
deletion and reactivates the account — with email + password, or with
the one-shot link mailed on this request (the OAuth-only path).

**Authentication**: Required (JWT only — API keys and app tokens
cannot delete the account)

**Rate Limits**: 3/hour

**Errors**: 403 when re-authentication fails (never says which field
was wrong), 409 when deletion is already pending.



## OpenAPI

````yaml /openapi-v1.json delete /api/v1/me
openapi: 3.1.0
info:
  title: spoo.me
  description: >-
    REST API for spoo.me — free and open-source URL shortening service serving
    400k+ redirects/day.


    Authenticate using either:

    - **API Key**: `Authorization: Bearer spoo_<your_key>`

    - **JWT Token**: `Authorization: Bearer <jwt>` (obtained via /auth/login)

    - **Session Cookie**: `access_token` cookie (set automatically on login)
  contact:
    name: spoo.me
    url: https://spoo.me/contact
    email: support@spoo.me
  license:
    name: AGPL-3.0
    url: https://github.com/spoo-me/spoo/blob/main/LICENSE
  version: 1.0.0
servers:
  - url: https://spoo.me
    description: Production
security:
  - ApiKeyAuth: []
  - JWTAuth: []
tags:
  - name: URL Shortening
    description: Create new shortened URLs
  - name: Link Management
    description: List, update, and delete your shortened URLs
  - name: Statistics
    description: Click analytics and data export
  - name: API Keys
    description: Create and manage API keys for programmatic access
  - name: Authentication
    description: Login, register, password management, and email verification
  - name: OAuth
    description: OAuth provider login, linking, and unlinking
  - name: System
    description: Health checks and server metrics
paths:
  /api/v1/me:
    delete:
      tags:
        - Me
      summary: Delete Account
      description: |-
        Request permanent account deletion (GDPR Art. 17).

        Re-authentication is required: accounts with a password send
        ``password``; OAuth-only accounts confirm by typing their exact
        account email as ``confirm_email``. On success the account enters a
        grace period (7 days by default) and `purge_after` marks its end —
        after that instant a background sweep permanently erases the account,
        its links, and their analytics.

        During the grace period every login is blocked with error code
        ``ACCOUNT_PENDING_DELETION``; ``POST /auth/restore`` cancels the
        deletion and reactivates the account — with email + password, or with
        the one-shot link mailed on this request (the OAuth-only path).

        **Authentication**: Required (JWT only — API keys and app tokens
        cannot delete the account)

        **Rate Limits**: 3/hour

        **Errors**: 403 when re-authentication fails (never says which field
        was wrong), 409 when deletion is already pending.
      operationId: deleteMyAccount
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DeleteAccountRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccountDeletionResponse'
        '400':
          description: Bad Request — invalid parameters
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '401':
          description: Unauthorized — missing or invalid credentials
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '403':
          description: Forbidden — insufficient permissions or scope
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '409':
          description: Conflict — resource already exists
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
        '429':
          description: Rate limit exceeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
components:
  schemas:
    DeleteAccountRequest:
      properties:
        password:
          anyOf:
            - type: string
              maxLength: 255
            - type: 'null'
          title: Password
          description: Account password — re-auth for accounts with a password set
          examples:
            - MySecurePass123!
        confirm_email:
          anyOf:
            - type: string
              maxLength: 320
            - type: 'null'
          title: Confirm Email
          description: >-
            The exact account email, typed to confirm — re-auth for OAuth-only
            accounts (no password set)
          examples:
            - user@example.com
      type: object
      title: DeleteAccountRequest
      description: |-
        Request body for DELETE /api/v1/me.

        Exactly one re-auth proof applies per account: ``password`` for
        accounts with a password set, ``confirm_email`` (the exact account
        email, typed) for OAuth-only accounts. The wrong proof — or a missing
        one — fails re-authentication; the response never says which.
    AccountDeletionResponse:
      properties:
        purge_after:
          type: string
          title: Purge After
          description: >-
            When the grace period ends and the erasure sweep may pick the
            account up. Restoring before this instant cancels the deletion.
          examples:
            - '2026-08-26T00:00:00+00:00'
      type: object
      required:
        - purge_after
      title: AccountDeletionResponse
      description: Deletion accepted — the account is now pending erasure.
    ErrorResponse:
      properties:
        error:
          type: string
          title: Error
        code:
          type: string
          title: Code
        field:
          anyOf:
            - type: string
            - type: 'null'
          title: Field
        details:
          anyOf:
            - {}
            - type: 'null'
          title: Details
      type: object
      required:
        - error
        - code
      title: ErrorResponse
      description: Standard error JSON body produced by the AppError exception handler.
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
              - type: string
              - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
        input:
          title: Input
        ctx:
          type: object
          title: Context
      type: object
      required:
        - loc
        - msg
        - type
      title: ValidationError
  securitySchemes:
    ApiKeyAuth:
      type: http
      scheme: bearer
      bearerFormat: spoo_<key>
      description: 'API key authentication. Pass your key as: `Bearer spoo_<your_key>`'
    JWTAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: 'JWT access token from /auth/login. Pass as: `Bearer <jwt_token>`'

````