curl --request DELETE \
--url 'https://api.noresponse.org/v1/accounts/acct_7f3a9c' \
--header "Authorization: Bearer $NORESPONSE_API_KEY"import { NoResponse } from "@noresponse/node";
const noResponse = new NoResponse({
apiKey: process.env["NORESPONSE_API_KEY"] ?? "",
});
async function run() {
const result = await noResponse.accounts.delete({
accountId: "acct_7f3a9c",
});
console.log(result);
}
run();
from noresponse import NoResponse
import os
with NoResponse(
api_key=os.getenv("NORESPONSE_API_KEY", ""),
) as no_response:
res = no_response.accounts.delete(account_id="acct_7f3a9c")
# Handle response
print(res)
package main
import(
"context"
"os"
noresponse "github.com/noresponsehq/go/v5"
"log"
)
func main() {
ctx := context.Background()
s := noresponse.New(
noresponse.WithSecurity(os.Getenv("NORESPONSE_API_KEY")),
)
res, err := s.Accounts.Delete(ctx, "acct_7f3a9c")
if err != nil {
log.Fatal(err)
}
if res != nil {
// handle response
}
}
package hello.world;
import java.lang.Exception;
import org.noresponse.NoResponse;
import org.noresponse.models.errors.AuthenticationException;
import org.noresponse.models.errors.BadRequestException;
import org.noresponse.models.errors.ConflictException;
import org.noresponse.models.errors.NotFoundException;
import org.noresponse.models.errors.PermissionDeniedException;
import org.noresponse.models.errors.RateLimitException;
import org.noresponse.models.operations.DeleteAccountResponse;
public class Application {
public static void main(String[] args) throws Exception {
NoResponse sdk = NoResponse.builder()
.apiKey(System.getenv().getOrDefault("NORESPONSE_API_KEY", ""))
.build();
DeleteAccountResponse res = sdk.accounts().delete()
.accountId("acct_7f3a9c")
.call();
if (res.accountDeletion().isPresent()) {
System.out.println(res.accountDeletion().get());
}
}
}
using NoResponse;
using NoResponse.Models.Shared;
using System;
var sdk = new NoResponseClient(apiKey: Environment.GetEnvironmentVariable("NORESPONSE_API_KEY"));
var res = await sdk.Accounts.DeleteAsync(accountId: "acct_7f3a9c");
// handle response
<?php
declare(strict_types=1);
require 'vendor/autoload.php';
use NoResponse;
$sdk = NoResponse\NoResponseClient::builder()
->setSecurity(
getenv('NORESPONSE_API_KEY') ?: ''
)
->build();
$response = $sdk->accounts->delete(
accountId: 'acct_7f3a9c'
);
if ($response->accountDeletion !== null) {
// handle response
}
require 'noresponse'
Models = ::NoResponse::Models
s = ::NoResponse::NoResponseClient.new(
api_key: ENV.fetch('NORESPONSE_API_KEY', '')
)
res = s.accounts.delete(account_id: 'acct_7f3a9c')
unless res.nil?
# handle response
end
{
"schema_version": "1",
"id": "acct_7f3a9c",
"deleted": true,
"assessments_deleted": 3,
"deleted_at": "2026-10-23T09:00:00.000Z"
}Erase an account
Erases one of your accounts in the environment of your key, for example when your user asks you to delete their data. Every assessment of the account goes, with its versions, evidence and outcomes, and an abuse outcome you reported on one of them stops counting toward other assessments. An assessment of the account that was still running is stopped.
Afterwards GET /v1/accounts/{account_id} and GET /v1/assessments/{assessment_id} of each erased assessment answer 404, and the account’s history is an empty page. The account_id can be assessed again later, as a new account.
When the call deleted at least one assessment, an account.deleted event goes to your verified webhook endpoints. Idempotent and safe to retry: a repeat, or an account with nothing to erase, answers 200 with assessments_deleted: 0 and sends no event. Requires the history scope.
curl --request DELETE \
--url 'https://api.noresponse.org/v1/accounts/acct_7f3a9c' \
--header "Authorization: Bearer $NORESPONSE_API_KEY"import { NoResponse } from "@noresponse/node";
const noResponse = new NoResponse({
apiKey: process.env["NORESPONSE_API_KEY"] ?? "",
});
async function run() {
const result = await noResponse.accounts.delete({
accountId: "acct_7f3a9c",
});
console.log(result);
}
run();
from noresponse import NoResponse
import os
with NoResponse(
api_key=os.getenv("NORESPONSE_API_KEY", ""),
) as no_response:
res = no_response.accounts.delete(account_id="acct_7f3a9c")
# Handle response
print(res)
package main
import(
"context"
"os"
noresponse "github.com/noresponsehq/go/v5"
"log"
)
func main() {
ctx := context.Background()
s := noresponse.New(
noresponse.WithSecurity(os.Getenv("NORESPONSE_API_KEY")),
)
res, err := s.Accounts.Delete(ctx, "acct_7f3a9c")
if err != nil {
log.Fatal(err)
}
if res != nil {
// handle response
}
}
package hello.world;
import java.lang.Exception;
import org.noresponse.NoResponse;
import org.noresponse.models.errors.AuthenticationException;
import org.noresponse.models.errors.BadRequestException;
import org.noresponse.models.errors.ConflictException;
import org.noresponse.models.errors.NotFoundException;
import org.noresponse.models.errors.PermissionDeniedException;
import org.noresponse.models.errors.RateLimitException;
import org.noresponse.models.operations.DeleteAccountResponse;
public class Application {
public static void main(String[] args) throws Exception {
NoResponse sdk = NoResponse.builder()
.apiKey(System.getenv().getOrDefault("NORESPONSE_API_KEY", ""))
.build();
DeleteAccountResponse res = sdk.accounts().delete()
.accountId("acct_7f3a9c")
.call();
if (res.accountDeletion().isPresent()) {
System.out.println(res.accountDeletion().get());
}
}
}
using NoResponse;
using NoResponse.Models.Shared;
using System;
var sdk = new NoResponseClient(apiKey: Environment.GetEnvironmentVariable("NORESPONSE_API_KEY"));
var res = await sdk.Accounts.DeleteAsync(accountId: "acct_7f3a9c");
// handle response
<?php
declare(strict_types=1);
require 'vendor/autoload.php';
use NoResponse;
$sdk = NoResponse\NoResponseClient::builder()
->setSecurity(
getenv('NORESPONSE_API_KEY') ?: ''
)
->build();
$response = $sdk->accounts->delete(
accountId: 'acct_7f3a9c'
);
if ($response->accountDeletion !== null) {
// handle response
}
require 'noresponse'
Models = ::NoResponse::Models
s = ::NoResponse::NoResponseClient.new(
api_key: ENV.fetch('NORESPONSE_API_KEY', '')
)
res = s.accounts.delete(account_id: 'acct_7f3a9c')
unless res.nil?
# handle response
end
{
"schema_version": "1",
"id": "acct_7f3a9c",
"deleted": true,
"assessments_deleted": 3,
"deleted_at": "2026-10-23T09:00:00.000Z"
}Authorizations
Your API key, sent as Authorization: Bearer <key>. A key is nrk_live_ or nrk_test_, a 26-character key id, _ and a 43-character secret. A key sees only its own environment's data.
Each key has one or more scopes: assess creates and reads assessments, records outcomes and reports key usage; history reads assessments, an account's current risk and an account's history, and erases an account; detailed adds the detailed view; webhooks registers, tests, rotates and deletes webhook endpoints; integrations registers and manages hosted provider integrations. A missing, unknown, revoked or expired key answers 401. A valid key without the scope an operation needs answers 403.
Path Parameters
The account_id the workspace sends with its assessments, as one path segment (percent-encode '|' and ':' if the client requires it). A value that does not match the account_id shape answers 400 invalid_request. The provider's own opaque identifier for the account being checked, scoped to the calling workspace. It must be provider-opaque and must not contain a direct identifier (email, phone, name, national id): that is a provider obligation the schema can only partly check. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id} and its /assessments. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id.
1 - 128^[A-Za-z0-9][A-Za-z0-9._:|-]{0,127}$Response
The account was erased, or held nothing to erase.
Body of the 200 answer to DELETE /v1/accounts/{account_id}: the calling workspace's account was erased in the environment of the calling key. Every assessment of the account went, with its revisions, evidence, outcomes and the identity-graph marks its outcomes set, and an assessment that was still running when the call arrived is stopped. Afterwards GET /v1/accounts/{account_id} and GET /v1/assessments/{assessment_id} of each erased assessment answer 404, and the history page is empty. The call is idempotent: a repeat, or an account with nothing to erase, answers 200 with assessments_deleted 0. The account_id can be assessed again later, as a new account.
Version of the body shape.
The account_id that was erased.
1 - 128^[A-Za-z0-9][A-Za-z0-9._:|-]{0,127}$How many assessments this call deleted. 0 when the account had none left, so a repeat answers 0.
x >= 0When the erasure took effect. An assessment of the account begun before this time is refused or stopped.