Schedule the signed-in person's account for deletion
It is deleted 30 days later. Their sessions end at once, and each app they had signed in to that registered a `backchannel_logout_uri` gets a logout token; they can't sign in meanwhile. Someone who owns a Synq org hands it over or deletes it first. Needs `me:write`. Recorded as `user.deletion_scheduled`.
/v1/deletionIt is deleted 30 days later. Their sessions end at once, and each app they had signed in to that registered a backchannel_logout_uri gets a logout token; they can't sign in meanwhile. Someone who owns a Synq org hands it over or deletes it first. Needs me:write. Recorded as user.deletion_scheduled.
Authorization
bearer An access token from this issuer for its account API (resource=<issuer>/me).
In: header
Response Body
application/json
application/problem+json
application/problem+json
application/problem+json
application/problem+json
curl -X POST "https://example.com/v1/deletion"{ "sub": "string", "email": "string", "email_verified": true, "username": "string", "name": "string", "given_name": "string", "family_name": "string", "picture": "string", "locale": "string", "deletion_scheduled_for": "2019-08-24T14:15:22Z", "created_at": "2019-08-24T14:15:22Z"}Cancel a scheduled deletion DELETE
Needs `me:write`. Recorded as `user.deletion_cancelled`.
Remove a way to sign in DELETE
A wallet, the email address (with its password) or an account at a provider stops signing the person in. Their last way to sign in can't be removed (`last_sign_in_method`): an email address counts only with its password, or where people can sign in with an emailed code. Removing their primary wallet makes their most recently used other wallet primary. Removing the email address leaves it their contact address, no longer verified. Sessions it signed in keep going: end them with `DELETE /v1/sessions/{session}`. Passkeys are removed at `/v1/passkeys`. Needs `me:write`, from a sign-in in the last 5 minutes whose time Synq proved (send the person to sign in with `max_age=300`; a provider that can't show when they signed in, such as Discord, never counts), else 403 `fresh_sign_in_required`. Send `max_age` only when you need a fresh sign-in: it asks someone signed in that way to sign in again. Recorded as `user.identity_unlinked`.