Delete the signed-in user's own account

DELETE

/users

Permanently deletes the current user's account and signs them out. Local-credential users must re-authenticate with current_password (OWASP ASVS 3.7.1); provider-managed and SSO-created accounts are exempt — their identity provider owns re-authentication. Blocked with 422 when the user is the only system administrator or the only admin of any project (transfer the admin role first). Repeated wrong passwords count toward account lockout and return 423 once locked.

Authorizations

tokenAuth

Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.

Type

HTTP (token)

Request Body

application/json

{

  

"user": {

  

  

"current_password": "MyCurrentP@ssw0rd!"

  

}

}

Responses

Account deleted and session ended

Content-Type

application/json

{

  

"toast": {

  

  

"title": "Account deleted.",

  

  

"message": [

  

  

  

"Account deleted successfully."

  

  

],

  

  

"variant": "success"

  

}

}

DELETE

/users

Playground

Server

Authorization

tokenAuth

Body

Samples

Powered by VitePress OpenAPI