Soft-delete a user (and their person), anonymises the email, revokes any live tokens (SOC 2 CC6.2) and removes the user's email reports. You cannot delete your own account and the target must belong to the caller's company. Audited via USER_DELETED.

Auth

• Authenticated company-admin — collection bearer token. Gate: the target's company_id must equal the caller's and the target ≠ self, else 403 Permission denied.

Rate limit

• No rate limit.

Body

(DELETE request carries a JSON body.)

Behaviour

• Synchronous (DB transaction). 200 on success.
• 403 on company mismatch or self-delete (Permission denied.).
• 500 on delete failure (rolled back).

Errors: 422 on validation failure.