Delete User Account

curl --request DELETE \
  --url https://api.example.com/api/profile/{user_id}/delete/

const options = {method: 'DELETE'};

fetch('https://api.example.com/api/profile/{user_id}/delete/', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.example.com/api/profile/{user_id}/delete/",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "DELETE",
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/api/profile/{user_id}/delete/"

	req, _ := http.NewRequest("DELETE", url, nil)

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.example.com/api/profile/{user_id}/delete/")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Delete.new(url)

response = http.request(request)
puts response.read_body

DELETE

api

profile

{user_id}

delete

Delete User Account

curl --request DELETE \
  --url https://api.example.com/api/profile/{user_id}/delete/

const options = {method: 'DELETE'};

fetch('https://api.example.com/api/profile/{user_id}/delete/', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.example.com/api/profile/{user_id}/delete/",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "DELETE",
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/api/profile/{user_id}/delete/"

	req, _ := http.NewRequest("DELETE", url, nil)

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.example.com/api/profile/{user_id}/delete/")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Delete.new(url)

response = http.request(request)
puts response.read_body

Overview

This endpoint permanently deletes a user account from the system. This action is irreversible and will cascade to delete all associated data including generated passwords linked to the user.

Authentication

This endpoint requires authentication. Include a valid JWT access token in the Authorization header:

Authorization: Bearer <access_token>

Authorization

Authentication is required but the current implementation does not explicitly verify that the authenticated user matches the user_id being deleted. This means proper authorization checks should be implemented at the application level or added to the view logic.

Request

Endpoint

DELETE /api/profile/{user_id}/delete/

Path Parameters

Parameter	Type	Description	Required
user_id	integer	The ID of the user to delete	Yes

Headers

Header	Value	Required
Authorization	Bearer	Yes

Request Body

No request body required.

Response

Success Response (204 No Content)

Returns a success message when the user is deleted:

{
  "message": "User deleted successfully"
}

Note: Despite the 204 status code suggesting no content, this endpoint returns a JSON response with a success message.

Error Responses

401 Unauthorized

Returned when the authentication token is missing or invalid:

{
  "detail": "Authentication credentials were not provided."
}

404 Not Found

Returned when the user ID doesn’t exist:

{
  "detail": "Not found."
}

500 Internal Server Error

Returned when an unexpected error occurs during deletion:

{
  "error": "Error message details"
}

Example Request

curl -X DELETE https://api.example.com/api/profile/42/delete/ \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
  -H "Content-Type: application/json"

Example Response

{
  "message": "User deleted successfully"
}

Implementation Details

This endpoint is implemented in /apps/users/views.py:123 as the delete_user function view:

Decorated with @permission_classes([IsAuthenticated]) to require authentication
Uses get_object_or_404 to retrieve the user by ID (returns 404 if not found)
Calls user.delete() which triggers Django’s cascading deletion
Returns a 204 No Content status with a success message

Cascading Deletion

When a user is deleted, Django’s ORM will automatically handle cascading deletions for related objects based on the foreign key relationships defined in the models. This typically includes:

Generated Passwords: All passwords created by the user will be deleted
User Sessions: Active authentication sessions will be invalidated
Media Files: Note that avatar images in the filesystem may need manual cleanup

Security Considerations

Authorization: The current implementation requires authentication but does not verify that the authenticated user matches the user_id being deleted. Consider adding this check:
if user != request.user and not request.user.is_staff: return Response({"error": "Not authorized"}, status=403)
Soft Delete: Consider implementing soft deletion (marking users as inactive) instead of permanent deletion to maintain data integrity and audit trails.
Confirmation: In a production environment, consider requiring additional confirmation (like password verification) before allowing account deletion.
Audit Logging: Log user deletion events for security and compliance purposes.

Best Practices

User Confirmation: Always require explicit user confirmation in the UI before calling this endpoint
Data Export: Offer users the ability to export their data before deletion
Grace Period: Consider implementing a grace period where accounts are deactivated first and permanently deleted after a waiting period
Notification: Send email notifications to users confirming the account deletion

Important Warnings

This action is permanent and irreversible. Once a user account is deleted:

All user data is permanently removed from the database
All generated passwords associated with the user are deleted
The user will need to create a new account to use the service again
Historical data cannot be recovered

The current implementation does not verify that the authenticated user matches the user being deleted. Ensure proper authorization checks are in place to prevent unauthorized account deletions.

Get Profile - Retrieve user profile information
Update Profile - Update user profile information
Sign Up - Create a new user account

⌘I

Authentication

Password Generation

Saved Passwords

User Management

Delete User Account

Overview

Authentication

Authorization

Request

Endpoint

Path Parameters

Headers

Request Body

Response

Success Response (204 No Content)

Error Responses

401 Unauthorized

404 Not Found

500 Internal Server Error

Example Request

Example Response

Implementation Details

Cascading Deletion

Security Considerations

Best Practices

Important Warnings

​Overview

​Authentication

​Authorization

​Request

​Endpoint

​Path Parameters

​Headers

​Request Body

​Response

​Success Response (204 No Content)

​Error Responses

​401 Unauthorized

​404 Not Found

​500 Internal Server Error

​Example Request

​Example Response

​Implementation Details

​Cascading Deletion

​Security Considerations

​Best Practices

​Important Warnings

​Related Endpoints

Overview

Authentication

Authorization

Request

Endpoint

Path Parameters

Headers

Request Body

Response

Success Response (204 No Content)

Error Responses

401 Unauthorized

404 Not Found

500 Internal Server Error

Example Request

Example Response

Implementation Details

Cascading Deletion

Security Considerations

Best Practices

Important Warnings

Related Endpoints