OVOK DOCS
Get startedOvokSignalsSDKsGuidesAPI referenceDeveloper resources
Sub Project

Delete a sub tenant

  • Sandbox: available
  • Staging: available
  • Production: unknown
DELETE
/v1/internal/sub-project/{subProjectId}

Deletes a child project of your current project, with the setup Ovok created for it.

Auth: bearer token of a project admin (ProjectMembership.admin). Scope: :subProjectId must be a direct child of the caller's project (from the token).

Behaviour

  • A project that still holds a Patient, Device or Location, or is the parent of another project, is refused with 409 project_not_empty. The body names the count per type in counts and the child ids in childProjectIds. Move or delete those first.
  • Otherwise the route unlinks the project from its parent, deletes its memberships, Practitioners, AccessPolicies, PlanDefinitions, ClientApplications, Organizations and tenant code in one atomic write, deletes the Project, revokes its Signals tenant and finally deletes the parent-child relationship. Audit records (Provenance, AuditEvent) are kept.
  • Users are never deleted; they may belong to other projects.
  • Retry-safe: if the Signals revoke fails, the project is already deleted and the route answers 502 signals_tenant_revoke_failed. Call it again to finish.
  • A second delete of the same project while the first runs answers 409.

Example

curl -X DELETE 'https://api.sandbox.ovok.com/v1/internal/sub-project/c3499c27-2973-0a7f-807e-fb8676a92dcb' \  -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3NjcyNjg4MDAsImV4cCI6MTc2NzI3MjQwMH0.Ql3B_ztDvctlyZ2z0vp4sl3ExXRQGkzmxdmTAqxNzZk'

Path Parameters

subProjectId*string
Length1 <= length

Response Body

The sub tenant was deleted successfully.

application/json
  1. response
success*true
Value intrue
Example Request
curl -X DELETE 'https://api.sandbox.ovok.com/v1/internal/sub-project/string'
Example Response
{  "success": true}

Delete a sub tenant DELETE

Deletes a child project of your current project, with the setup Ovok created for it. **Auth:** bearer token of a project admin (`ProjectMembership.admin`). **Scope:** `:subProjectId` must be a direct child of the caller's project (from the token). ## Behaviour - A project that still holds a `Patient`, `Device` or `Location`, or is the parent of another project, is refused with 409 `project_not_empty`. The body names the count per type in `counts` and the child ids in `childProjectIds`. Move or delete those first. - Otherwise the route unlinks the project from its parent, deletes its memberships, Practitioners, AccessPolicies, PlanDefinitions, ClientApplications, Organizations and tenant code in one atomic write, deletes the `Project`, revokes its Signals tenant and finally deletes the parent-child relationship. Audit records (`Provenance`, `AuditEvent`) are kept. - Users are never deleted; they may belong to other projects. - Retry-safe: if the Signals revoke fails, the project is already deleted and the route answers 502 `signals_tenant_revoke_failed`. Call it again to finish. - A second delete of the same project while the first runs answers 409. ## Example ```bash curl -X DELETE 'https://api.sandbox.ovok.com/v1/internal/sub-project/c3499c27-2973-0a7f-807e-fb8676a92dcb' \ -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3NjcyNjg4MDAsImV4cCI6MTc2NzI3MjQwMH0.Ql3B_ztDvctlyZ2z0vp4sl3ExXRQGkzmxdmTAqxNzZk' ```

Start practitioner login POST

Starts a practitioner login: checks the email and password and returns either a session code plus the list of tenants the practitioner can enter, or, when the user has MFA enrolled, a login ID for the MFA step. **Auth:** none. **Scope:** no tenant yet. A practitioner's User is server-wide; the tenant is chosen in `login/token`. ## Behaviour - This is step 1 of a PKCE login. Generate a random `codeVerifier`, send its S256 hash as `codeChallenge` here, and send the `codeVerifier` itself to `POST /auth/tenant/Practitioner/login/token`. - Response `nextStep`: - `token`: no MFA. The response carries `sessionCode` and `profiles`, one entry per Practitioner membership of the user: its `tenantCode`, `project` (`id`, `resourceType`, `name`), `profile`, `admin` (true when the user is an admin of that project), `isMainProject` and `parentProjectId`. - `mfa`: the user has MFA enrolled. Pass `loginId` and the current TOTP code to `POST /auth/tenant/Practitioner/login/mfa`, which returns the same `profiles` list. - `isMainProject` is `true` when the project has no parent project, and `null` when the hierarchy could not be read. `parentProjectId` is set only when the caller is also a member of that parent; otherwise it is `null`. - `PRACTITIONER_LOGIN_ENABLED` is not checked here; it is checked in `login/token` against the chosen tenant. - A wrong email, an unknown account, an account without a password and a wrong password all give the same 401 `Invalid email or password.` - After 5 failed sign-ins for one email within 15 minutes, that email's sign-ins answer 429 with `Retry-After` for 15 minutes, the right password included, whether or not the email has an account. A successful sign-in resets the count. - Error responses are delayed to take at least one second. ## Example ```bash curl -X POST 'https://api.sandbox.ovok.com/auth/tenant/Practitioner/login/start' \ -H 'Content-Type: application/json' \ -d '{ "email": "max.mustermann@example.com", "password": "your-password", "codeChallenge": "<base64url S256 hash of your codeVerifier>" }' ```