delete_account
Permanently delete this account. TERMINAL, not reversible. Admin scope (WP-LIFE). Pass confirm="delete" (guards accidents). Revokes ALL keys and deletes live profile facts/consent, hooks, webhooks, deliveries, jobs and idempotency; KEEPS bounded profile retraction markers, the immutable financial ledger, and de-associated outcome rows. Export FIRST with export_usage: ledger, every hook/immutable instance/outcome/profile, plus every retained job, commission and request tag in one call. Paged: get_usage/list_hooks/list_outcomes/list_jobs. Backup aging: GET /v1/legal. Errors: unauthorized, forbidden, invalid_request, rate_limited.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| api_key | No | API key for this call. Omit to fall back to the Authorization: Bearer / X-API-Key request header (streamable-HTTP only), then the VHGENGINE_API_KEY env var (the stdio default). No key resolvable -> unauthorized. | |
| confirm | Yes | Must be exactly the string "delete". A guard: any other value (or omitting it) fails argument validation before anything is touched, so an accidental invocation cannot destroy the account. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| note | No | Human-readable summary of what was and was not removed. | |
| deleted | No | true once the account is tombstoned. Every key now 401s. | |
| retained | No | {financial_events, anonymized_outcomes, creator_profile_retractions}: the ledger, de-associated outcome rows, and bounded profile exclusion markers survive. The outcome field keeps its legacy name; submitted content can remain. |