Close the signed-in person's own account, for good: confirm must say delete my account

POST /api/auth/me/close

People are never deleted — every fact keeps naming them by usr_ id — so closing deactivates their membership in every organization (an auth.member-deactivated on each organization's trail), ends every session, removes every way in (the password, social accounts, passkeys) and erases their name and email. 400 AccountClosureUnconfirmed when confirm says anything else; 409 AccountClosureBlocked while they are the last active owner with a verified email of any organization, naming each — elect another owner there first; 403 AccountClosureRefused for a platform admin impersonating them. Appends auth.account-closed. Idempotent by state: closing ends the session that asked, so a retry is refused 401 and appends nothing.

Access

Requires a signed-in session: The signed-in person's own account, read from their BetterAuth session; no path names anyone else

How scopes come from roles: Scopes and roles. Getting a token: Authentication and app tokens.

Retries

Idempotent by state: closing ends the session that asked, so a retry is refused 401 and appends nothing.

Why every write carries a key: Idempotency and retries.

Facts appended

auth.member-deactivated
auth.account-closed

What a fact is: Facts and the journal.

AI agent tool

No agent tool. Closing an account is final and is the person's own decision, typed by them on their account page in the app; an agent never closes the account of the person it acts for.

Connecting an agent: AI agents.

Example

curl

curl -X POST 'https://auth.getmanifold.io/api/auth/me/close' \
  -H "Authorization: Bearer $MANIFOLD_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{
  "confirm": "delete my account"
}'

JavaScript (fetch)

const response = await fetch("https://auth.getmanifold.io/api/auth/me/close", {
  method: "POST",
  headers: { Authorization: `Bearer ${process.env.MANIFOLD_TOKEN}`, "Content-Type": "application/json" },
  body: JSON.stringify({
    "confirm": "delete my account"
  }),
});
if (!response.ok) throw new Error(`${response.status}: ${await response.text()}`);
const answer = await response.json();

Request body · application/json

{
  "confirm": "delete my account"
}

Response · 200 · application/json

{
  "userId": "usr_01a15709-7582-7646-b491-261a138f0650",
  "closedAt": "2026-10-30T02:15:00.000Z",
  "organizations": [
    "org_01a156d2-8680-7738-ab2e-ff985e454887"
  ],
  "signInMethodsRemoved": 2
}

The panel writes this call in other languages. It does not send it: Manifold's APIs do not take calls from a web page on another site, so run the call from your own code or terminal. The whole API as OpenAPI: auth-service.openapi.json. Base URL https://auth.getmanifold.io.

Errors

Every refusal is a status and a JSON body whose _tag names it. A refused call changes nothing.

`400`

Refusal	What it means	What to do
`AccountClosureUnconfirmed` reason	`confirm` says anything else.	Fix the request. Sending it again unchanged gets the same answer.

`401`

Refusal	What it means	What to do
`Unauthorized` reason	The token is missing, expired or not one Manifold issued.	Get a fresh token and send the call again.
`TokenAlreadyUsed` tokenId	A single-use app token was already spent.	Mint a new token for this call.

`402`

Refusal	What it means	What to do
`SubscriptionRequired` status	The organization's subscription has lapsed, so writes are refused.	An owner settles billing. Reads still work meanwhile.

`403`

Refusal	What it means	What to do
`AccountClosureRefused` reason	The request was refused. `reason` says why.	The caller may not do this. Use a token whose roles allow it.
`TenantRequired` userId	The token names no organization.	Choose the organization, then get a new token.
`ScopeRequired` required	The token's roles do not grant the scope this call needs.	Ask an owner or admin for a role that grants it.

`409`

Refusal	What it means	What to do
`AccountClosureBlocked` reason, organizations	They are the last active owner with a verified email of any organization, naming each — elect another owner there first.	Nothing changed. Read the record, then decide.
`MirroredFromSource` source	This area is fed by your source system until the organization goes live.	Make the change in the source system, or go live first.

`503`

Refusal	What it means	What to do
`RequestLogUnavailable` tokenId, reason	The service could not record the request, so it did nothing.	Send the same request again shortly.

How refusals work everywhere: Errors.