> ## Documentation Index > Fetch the complete documentation index at: https://docs.noresponse.org/llms.txt > Use this file to discover all available pages before exploring further. # Erase an account > Erases one of your accounts in the environment of your key, for example when your user asks you to delete their data. Every assessment of the account goes, with its versions, evidence and outcomes, and an abuse outcome you reported on one of them stops counting toward other assessments. An assessment of the account that was still running is stopped. Afterwards `GET /v1/accounts/{account_id}` and `GET /v1/assessments/{assessment_id}` of each erased assessment answer 404, and the account's history is an empty page. The `account_id` can be assessed again later, as a new account. When the call deleted at least one assessment, an `account.deleted` event goes to your verified webhook endpoints. Idempotent and safe to retry: a repeat, or an account with nothing to erase, answers 200 with `assessments_deleted: 0` and sends no event. Requires the `history` scope. ## OpenAPI ````yaml /openapi.json delete /v1/accounts/{account_id} openapi: 3.1.0 info: title: NoResponse API version: '1' description: >- The NoResponse API assesses a signup, login or purchase and answers with the account's one current risk: a 0 to 100 score, a decision for the flow (`allow`, `step_up`, `review` or `block`), the reasons behind it and the decision for each flow. The assessment's own facts, such as its status, confidence and incomplete sources, sit under `detail`. Authenticate every request with your API key as `Authorization: Bearer nrk_...`. Call the API only from your backend. Guides, SDKs and webhook verification are at [docs.noresponse.org](https://docs.noresponse.org/). Every error is an RFC 9457 problem document; see [Errors](https://docs.noresponse.org/reference/errors). servers: - url: https://api.noresponse.org description: Production security: - tenantBearer: [] tags: - name: assess x-displayName: Assessments x-group: Assessments description: Create, read and list assessments, and report outcomes. - name: accounts x-displayName: Accounts x-group: Accounts description: >- Each of your accounts holds one current risk, and its assessments are its history. - name: usage x-displayName: Key usage x-group: Key usage description: >- Report usage of the API keys your signup gate issued, so a shared or stolen key raises its account's risk. - name: keys x-displayName: API keys x-group: API keys description: Rotate your own API key. - name: integrations x-displayName: Integrations x-group: Integrations description: >- Hosted endpoints that answer your WorkOS or Auth0 sign-up and sign-in hooks. - name: webhooks x-displayName: Webhooks x-group: Webhooks description: Your webhook endpoints, and the signed events NoResponse sends to them. paths: /v1/accounts/{account_id}: delete: tags: - accounts summary: Erase an account description: >- Erases one of your accounts in the environment of your key, for example when your user asks you to delete their data. Every assessment of the account goes, with its versions, evidence and outcomes, and an abuse outcome you reported on one of them stops counting toward other assessments. An assessment of the account that was still running is stopped. Afterwards `GET /v1/accounts/{account_id}` and `GET /v1/assessments/{assessment_id}` of each erased assessment answer 404, and the account's history is an empty page. The `account_id` can be assessed again later, as a new account. When the call deleted at least one assessment, an `account.deleted` event goes to your verified webhook endpoints. Idempotent and safe to retry: a repeat, or an account with nothing to erase, answers 200 with `assessments_deleted: 0` and sends no event. Requires the `history` scope. operationId: deleteAccount parameters: - $ref: '#/components/parameters/AccountId' responses: '200': $ref: '#/components/responses/AccountDeleted' '400': $ref: '#/components/responses/InvalidAccountRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/WorkspaceForbidden' '429': $ref: '#/components/responses/RateLimited' '503': $ref: '#/components/responses/ServiceUnavailable' security: - tenantBearer: [] x-codeSamples: - lang: curl label: cURL source: | curl --request DELETE \ --url 'https://api.noresponse.org/v1/accounts/acct_7f3a9c' \ --header "Authorization: Bearer $NORESPONSE_API_KEY" - lang: typescript label: TypeScript source: | import { NoResponse } from "@noresponse/node"; const noResponse = new NoResponse({ apiKey: process.env["NORESPONSE_API_KEY"] ?? "", }); async function run() { const result = await noResponse.accounts.delete({ accountId: "acct_7f3a9c", }); console.log(result); } run(); - lang: python label: Python source: | from noresponse import NoResponse import os with NoResponse( api_key=os.getenv("NORESPONSE_API_KEY", ""), ) as no_response: res = no_response.accounts.delete(account_id="acct_7f3a9c") # Handle response print(res) - lang: go label: Go source: "package main\n\nimport(\n\t\"context\"\n\t\"os\"\n\tnoresponse \"github.com/noresponsehq/go/v5\"\n\t\"log\"\n)\n\nfunc main() {\n ctx := context.Background()\n\n s := noresponse.New(\n noresponse.WithSecurity(os.Getenv(\"NORESPONSE_API_KEY\")),\n )\n\n res, err := s.Accounts.Delete(ctx, \"acct_7f3a9c\")\n if err != nil {\n log.Fatal(err)\n }\n if res != nil {\n // handle response\n }\n}\n" - lang: java label: Java source: | package hello.world; import java.lang.Exception; import org.noresponse.NoResponse; import org.noresponse.models.errors.AuthenticationException; import org.noresponse.models.errors.BadRequestException; import org.noresponse.models.errors.ConflictException; import org.noresponse.models.errors.NotFoundException; import org.noresponse.models.errors.PermissionDeniedException; import org.noresponse.models.errors.RateLimitException; import org.noresponse.models.operations.DeleteAccountResponse; public class Application { public static void main(String[] args) throws Exception { NoResponse sdk = NoResponse.builder() .apiKey(System.getenv().getOrDefault("NORESPONSE_API_KEY", "")) .build(); DeleteAccountResponse res = sdk.accounts().delete() .accountId("acct_7f3a9c") .call(); if (res.accountDeletion().isPresent()) { System.out.println(res.accountDeletion().get()); } } } - lang: csharp label: C# source: > using NoResponse; using NoResponse.Models.Shared; using System; var sdk = new NoResponseClient(apiKey: Environment.GetEnvironmentVariable("NORESPONSE_API_KEY")); var res = await sdk.Accounts.DeleteAsync(accountId: "acct_7f3a9c"); // handle response - lang: php label: PHP source: | setSecurity( getenv('NORESPONSE_API_KEY') ?: '' ) ->build(); $response = $sdk->accounts->delete( accountId: 'acct_7f3a9c' ); if ($response->accountDeletion !== null) { // handle response } - lang: ruby label: Ruby source: | require 'noresponse' Models = ::NoResponse::Models s = ::NoResponse::NoResponseClient.new( api_key: ENV.fetch('NORESPONSE_API_KEY', '') ) res = s.accounts.delete(account_id: 'acct_7f3a9c') unless res.nil? # handle response end components: parameters: AccountId: name: account_id in: path required: true schema: type: string minLength: 1 maxLength: 128 pattern: ^[A-Za-z0-9][A-Za-z0-9._:|-]{0,127}$ description: >- The provider's own opaque identifier for the account being checked, scoped to the calling workspace. It must be provider-opaque and must not contain a direct identifier (email, phone, name, national id): that is a provider obligation the schema can only partly check. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id} and its /assessments. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id. not: description: refused_text plus secret_encoded, for account_id. anyOf: - description: >- A line feed anywhere, refused with `not` beside every anchored pattern. pattern: \n - description: >- Exact shapes only: a complete modular-crypt password hash (bcrypt $2a$/$2b$/$2x$/$2y$ with a two-digit cost and 53 characters; $argon2i/d/id with its m, t, p parameters, salt and hash; md5-crypt $1$, sha256-crypt $5$ or sha512-crypt $6$ with a 22, 43 or 86 character hash; passlib $scrypt$ with ln, r, p, salt and hash) or a three-segment JWT whose header is base64url JSON opening with an "alg", "typ", "kid" or "cty" member (eyJhbGciOi, eyJ0eXAiOi, eyJraWQiOi or eyJjdHkiOi). A value that merely starts with '$2' or 'eyJ', such as eyJohnathan.doe.x, is not refused. Best effort, not a guarantee; see the provider obligation in the README. anyOf: - pattern: ^\$2[abxy]?\$[0-9]{2}\$[./A-Za-z0-9]{53}$ - pattern: >- ^\$argon2(?:id|i|d)\$(?:v=[0-9]{1,4}\$)?m=[0-9]{1,10},t=[0-9]{1,10},p=[0-9]{1,3}\$[A-Za-z0-9+/]{8,}\$[A-Za-z0-9+/]{16,}$ - pattern: >- ^\$[156]\$(?:rounds=[0-9]{1,9}\$)?[./A-Za-z0-9]{1,16}\$(?:[./A-Za-z0-9]{22}|[./A-Za-z0-9]{43}|[./A-Za-z0-9]{86})$ - pattern: >- ^\$scrypt\$ln=[0-9]{1,2},r=[0-9]{1,3},p=[0-9]{1,3}\$[A-Za-z0-9+/.]{8,}\$[A-Za-z0-9+/.]{16,}$ - pattern: >- ^eyJ(?:hbGciOi|0eXAiOi|raWQiOi|jdHkiOi)[A-Za-z0-9_-]*\.[A-Za-z0-9_-]{2,}\.[A-Za-z0-9_-]*$ description: >- The account_id the workspace sends with its assessments, as one path segment (percent-encode '|' and ':' if the client requires it). A value that does not match the account_id shape answers 400 invalid_request. responses: AccountDeleted: description: The account was erased, or held nothing to erase. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/json: schema: $ref: '#/components/schemas/AccountDeletion' examples: erased: value: schema_version: '1' id: acct_7f3a9c deleted: true assessments_deleted: 3 deleted_at: '2026-10-23T09:00:00.000Z' repeat: value: schema_version: '1' id: acct_7f3a9c deleted: true assessments_deleted: 0 deleted_at: '2026-10-23T09:00:05.000Z' InvalidAccountRequest: description: >- account_id does not match its shape, a query parameter is unknown, repeated or out of range, or the cursor fails its MAC, belongs to another workspace or account, or has expired. invalid_params names the offending parameters, never their values. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 400 code: enum: - invalid_request - invalid_cursor Unauthorized: description: No API key, or one that is malformed, unknown, revoked or expired. headers: Cache-Control: schema: type: string const: no-store required: true WWW-Authenticate: schema: type: string const: Bearer realm="noresponse-assessments" required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 401 code: enum: - unauthorized WorkspaceForbidden: description: >- The API key is valid but may not use this operation: it lacks the operation's scope, or its workspace is not entitled or is suspended. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 403 code: enum: - workspace_forbidden examples: missingScope: value: type: https://docs.noresponse.org/problems/workspace-forbidden title: Forbidden status: 403 detail: The API key does not carry a scope this operation accepts. code: workspace_forbidden request_id: 0123456789abcdef0123456789abcdef RateLimited: description: >- The workspace's rate or concurrency limit is exhausted. Retry-After says when to retry; the provider applies its own fallback meanwhile. headers: Cache-Control: schema: type: string const: no-store required: true Retry-After: description: >- Whole seconds to wait before polling or retrying. Required on 202, 429 and 503. schema: type: string pattern: >- ^(?:[1-9]|[1-9][0-9]|[1-9][0-9]{2}|[12][0-9]{3}|3[0-5][0-9]{2}|3600)$ description: Whole decimal seconds; wait at least this long. required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 429 code: enum: - rate_limited examples: limited: value: type: https://docs.noresponse.org/problems/rate-limited title: Rate limited status: 429 detail: >- The tenant's assessment rate is exhausted; retry after the Retry-After interval. code: rate_limited request_id: 0123456789abcdef0123456789abcdef ServiceUnavailable: description: >- The assessment could not be admitted at all (overload, shutdown or a dependency down). An assessment that was admitted answers partial or pending instead of 503. headers: Cache-Control: schema: type: string const: no-store required: true Retry-After: description: >- Whole seconds to wait before polling or retrying. Required on 202, 429 and 503. schema: type: string pattern: >- ^(?:[1-9]|[1-9][0-9]|[1-9][0-9]{2}|[12][0-9]{3}|3[0-5][0-9]{2}|3600)$ description: Whole decimal seconds; wait at least this long. required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 503 code: enum: - service_unavailable schemas: AccountDeletion: title: Account deletion description: >- Body of the 200 answer to DELETE /v1/accounts/{account_id}: the calling workspace's account was erased in the environment of the calling key. Every assessment of the account went, with its revisions, evidence, outcomes and the identity-graph marks its outcomes set, and an assessment that was still running when the call arrived is stopped. Afterwards GET /v1/accounts/{account_id} and GET /v1/assessments/{assessment_id} of each erased assessment answer 404, and the history page is empty. The call is idempotent: a repeat, or an account with nothing to erase, answers 200 with assessments_deleted 0. The account_id can be assessed again later, as a new account. type: object additionalProperties: false required: - schema_version - id - deleted - assessments_deleted - deleted_at properties: schema_version: const: '1' description: Version of the body shape. id: type: string minLength: 1 maxLength: 128 pattern: ^[A-Za-z0-9][A-Za-z0-9._:|-]{0,127}$ description: The account_id that was erased. not: description: refused_text plus secret_encoded, for account_id. anyOf: - description: >- A line feed anywhere, refused with `not` beside every anchored pattern. pattern: \n - description: >- Exact shapes only: a complete modular-crypt password hash (bcrypt $2a$/$2b$/$2x$/$2y$ with a two-digit cost and 53 characters; $argon2i/d/id with its m, t, p parameters, salt and hash; md5-crypt $1$, sha256-crypt $5$ or sha512-crypt $6$ with a 22, 43 or 86 character hash; passlib $scrypt$ with ln, r, p, salt and hash) or a three-segment JWT whose header is base64url JSON opening with an "alg", "typ", "kid" or "cty" member (eyJhbGciOi, eyJ0eXAiOi, eyJraWQiOi or eyJjdHkiOi). A value that merely starts with '$2' or 'eyJ', such as eyJohnathan.doe.x, is not refused. Best effort, not a guarantee; see the provider obligation in the README. anyOf: - pattern: ^\$2[abxy]?\$[0-9]{2}\$[./A-Za-z0-9]{53}$ - pattern: >- ^\$argon2(?:id|i|d)\$(?:v=[0-9]{1,4}\$)?m=[0-9]{1,10},t=[0-9]{1,10},p=[0-9]{1,3}\$[A-Za-z0-9+/]{8,}\$[A-Za-z0-9+/]{16,}$ - pattern: >- ^\$[156]\$(?:rounds=[0-9]{1,9}\$)?[./A-Za-z0-9]{1,16}\$(?:[./A-Za-z0-9]{22}|[./A-Za-z0-9]{43}|[./A-Za-z0-9]{86})$ - pattern: >- ^\$scrypt\$ln=[0-9]{1,2},r=[0-9]{1,3},p=[0-9]{1,3}\$[A-Za-z0-9+/.]{8,}\$[A-Za-z0-9+/.]{16,}$ - pattern: >- ^eyJ(?:hbGciOi|0eXAiOi|raWQiOi|jdHkiOi)[A-Za-z0-9_-]*\.[A-Za-z0-9_-]{2,}\.[A-Za-z0-9_-]*$ deleted: const: true assessments_deleted: type: integer minimum: 0 description: >- How many assessments this call deleted. 0 when the account had none left, so a repeat answers 0. deleted_at: type: string format: date-time description: >- When the erasure took effect. An assessment of the account begun before this time is refused or stopped. Problem: title: Problem details error description: >- RFC 9457 problem-details error body returned by every non-2xx API response, extended with a stable machine code and request id. type: object additionalProperties: false required: - type - title - status - detail - code - request_id properties: type: type: string format: uri-reference title: type: string status: type: integer minimum: 400 maximum: 599 detail: type: string instance: type: string format: uri-reference code: type: string request_id: type: string minLength: 1 invalid_params: type: array items: type: object additionalProperties: false required: - field - reason properties: field: type: string minLength: 1 reason: type: string minLength: 1 example: type: string minLength: 1 securitySchemes: tenantBearer: type: http scheme: bearer description: >- Your API key, sent as `Authorization: Bearer `. A key is `nrk_live_` or `nrk_test_`, a 26-character key id, `_` and a 43-character secret. A key sees only its own environment's data. Each key has one or more scopes: `assess` creates and reads assessments, records outcomes and reports key usage; `history` reads assessments, an account's current risk and an account's history, and erases an account; `detailed` adds the detailed view; `webhooks` registers, tests, rotates and deletes webhook endpoints; `integrations` registers and manages hosted provider integrations. A missing, unknown, revoked or expired key answers 401. A valid key without the scope an operation needs answers 403. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.