---
title: Schedule account deletion
sidebar_label: Schedule account deletion
sidebar_position: 9
description: Schedule the deletion of the signed-in user's own account with DELETE /auth/delete, and how signing in again cancels it.
---

# Schedule account deletion

| Method | Path |
| --- | --- |
| `DELETE` | `/auth/delete` |

[Authentication](/authentication) · [Account routes](/authentication#account-routes) · [Email templates](/email-templates)

Schedules the deletion of the caller's own account. The account is not deleted right away. It stays until the scheduled date, and signing in again before then cancels the deletion.

:::note
This is an account-level route. It has no `/auth/tenant/` variant. Use the access token that a [tenant sign-in](/authentication) returns.
:::

**Auth:** Bearer token of the user who deletes their own account, a patient or a practitioner.
**Scope:** The caller's own User, in the project of the token.

## Request

### Body

Both fields are optional. Send `{}` to accept the defaults.

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `days` | `integer` | No | Days from now until the account is due. From `0` to `90`. Default `30`. |
| `wipe` | `boolean` | No | Whether the user's medical data should be deleted too. Default `false`. It is recorded on the request, but it does not change what is deleted yet. |

## Behaviour

- Ovok signs the user out of all sessions, including the one you call with, and then records the deletion date on the User. Calling the route again resets the date.
- The account is removed by a daily clean-up once its date has passed. The clean-up deletes the project membership, the profile (Patient or Practitioner) and the User.
- `days` set to `0` makes the account due immediately. It is still removed by the next daily clean-up, not during the request.
- The clean-up does not delete medical data yet, so `wipe` has no effect on what is deleted.
- A successful sign-in through the tenant `login/token` routes, for [patients](/authentication/patient-login#step-3-exchange-the-session-code-for-tokens) or [practitioners](/authentication/practitioner-login#step-3-choose-a-tenant-and-get-tokens), removes the scheduled deletion.
- Ovok sends a confirmation email: `PATIENT_ACCOUNT_DELETION` for a patient and `ACCOUNT_DELETION` otherwise. It goes out only when the template is [mapped](/email-templates/map-templates). A failed email does not fail the request.
- The response holds `scheduled`, the due date, and the updated User without its password hash.

## Example

```bash
curl -X DELETE 'https://api.sandbox.ovok.com/auth/delete' \
  -H "Authorization: Bearer ${OVOK_TOKEN}" \
  -H 'Content-Type: application/json' \
  -d '{
    "days": 30,
    "wipe": false
  }'
```

## Successful response

`200` — The deletion is scheduled. The user is trimmed here.

```json
{
  "scheduled": "2026-11-08T09:15:00.000Z",
  "user": {
    "resourceType": "User",
    "id": "9a4e6c10-3b7d-4f28-8c15-2d0e7b9a6f43",
    "meta": { "lastUpdated": "2026-10-09T09:15:00.000Z" },
    "firstName": "Alex",
    "lastName": "Example",
    "email": "alex@example.com"
  }
}
```

| Field | Type | Description |
| --- | --- | --- |
| `scheduled` | `string` | When the account is due for deletion. ISO 8601. |
| `user` | `object` | The updated User, without its password hash. |
| `user.resourceType` | `"User"` | Always `User`. |
| `user.id` | `string (uuid)` | User id. |
| `user.meta.lastUpdated` | `string` | When the User was last changed. ISO 8601. |
| `user.firstName` | `string` | First name. |
| `user.lastName` | `string` | Last name. |
| `user.email` | `string` | Sign-in email address. |
| `user.identifier` | `object[]` | Identifiers on the User, including the markers that record the scheduled deletion. Use `scheduled` instead of reading them. |

Other fields of the User can be present.

## Errors

| Status | Meaning |
| --- | --- |
| `400` | The session has no user, project or email address to act on. |
| `401` | The bearer token is missing, invalid, expired or revoked. |
| `422` | `days` is not an integer from `0` to `90`, or `wipe` is not a boolean. |
| `429` | Too many requests. |