Delete user

Overview

Soft-delete a user (and their person), anonymises the email, revokes any live tokens (SOC 2 CC6.2) and removes the user's email reports. You cannot delete your own account and the target must belong to the caller's company. Audited via USER_DELETED.

Prerequisites

• A bearer token in the Authorization header.

Base URL

Endpoint

DELETE /api/v1/users/delete

Authentication

• Requires a bearer token in the Authorization: Bearer <bearer-token> header.

• Authenticated company-admin — collection bearer token.

• Gate: the target's company_id must equal the caller's, and the target ≠ self. Otherwise it returns 403 Permission denied.

Rate limit

• No rate limit.

Request body

(DELETE request carries a JSON body.)

{
  "user": 12
}

How it works

• Synchronous (DB transaction). 200 on success.
• 403 on company mismatch or self-delete (Permission denied.).
• 500 on delete failure (rolled back).

Response

200 OK · 200

{
  "data": {
    "status": "success",
    "response": "User has been deleted successfully."
  }
}

403 Permission denied · 403

{
  "message": "Forbidden",
  "status": "error",
  "errors": "Permission denied."
}

Errors

Example request

curl --request DELETE \
  --url "https://production-api.shoutaboutus.com/api/v1/users/delete" \
  --header 'Authorization: Bearer <bearer-token>' \
  --header 'Accept: application/json' \
  --header 'Content-Type: application/json' \
  --data '{"user": 12}'