# Delete a sub tenant

Canonical page: https://docs.ovok.com/api/sub-project/delete-a-sub-tenant-4

`DELETE /v1/internal/sub-project/{subProjectId}`

Deletes a child project of your current project, with the setup Ovok created for it.

**Auth:** bearer token of a project admin (`ProjectMembership.admin`).
**Scope:** `:subProjectId` must be a direct child of the caller's project (from the token).

## Behaviour

- A project that still holds a `Patient`, `Device` or `Location`, or is the parent of another project, is refused with 409 `project_not_empty`. The body names the count per type in `counts` and the child ids in `childProjectIds`. Move or delete those first.
- Otherwise the route unlinks the project from its parent, deletes its memberships, Practitioners, AccessPolicies, PlanDefinitions, ClientApplications, Organizations and tenant code in one atomic write, deletes the `Project`, revokes its Signals tenant and finally deletes the parent-child relationship. Audit records (`Provenance`, `AuditEvent`) are kept.
- Users are never deleted; they may belong to other projects.
- Retry-safe: if the Signals revoke fails, the project is already deleted and the route answers 502 `signals_tenant_revoke_failed`. Call it again to finish.
- A second delete of the same project while the first runs answers 409.

## Example

```bash
curl -X DELETE 'https://api.sandbox.ovok.com/v1/internal/sub-project/c3499c27-2973-0a7f-807e-fb8676a92dcb' \
  -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3NjcyNjg4MDAsImV4cCI6MTc2NzI3MjQwMH0.Ql3B_ztDvctlyZ2z0vp4sl3ExXRQGkzmxdmTAqxNzZk'
```