Appearance
Delete the signed-in user's own account
DELETE
/users
Permanently deletes the current user's account and signs them out. Local-credential users must re-authenticate with current_password (OWASP ASVS 3.7.1); provider-managed and SSO-created accounts are exempt — their identity provider owns re-authentication. Blocked with 422 when the user is the only system administrator or the only admin of any project (transfer the admin role first). Repeated wrong passwords count toward account lockout and return 423 once locked.
Authorizations
cookieAuth
Type
API Key (cookie: _vulcan_session)
or
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Request Body
application/json
JSON "user": { "current_password": "MyCurrentP@ssw0rd!" }
{
}
Responses
Account deleted and session ended
application/json
JSON "toast": { "title": "Account deleted.", "message": [ "Account deleted successfully." ], "variant": "success" }
{
}