tessera

Removes the caller's own account.

DELETE
/api/v1/account

Why the shares are the caller's decision and not an administrator's

They are the account's own uploads. An administrator removing another account does not touch its content, a separate and explicit act, but an account removing itself may say what happens to what it sent.

Errors

401 when the password is wrong, 403 when an API token was used or the caller is the last one able to administer the instance.

session
cookietessera_session<token>

Set by POST /auth/login. A browser sends it automatically; it is HttpOnly, so page scripts cannot read or set it.

application/json
  1. body

Body of DELETE /account.

current_password?|

The current password, for the same reason as above, and omitted the same way by an account without one.

Length8 <= length <= 1024
delete_shares?boolean

Whether to end everything this account uploaded.

Defaults to ending it. "Delete my account" usually means "and the things I sent"; wanting the handed-out links to keep working is the rarer case, worth one explicit false.

What "delete" means here

Every link stops working the moment this returns. The bytes go later, when the housekeeping pass reaches them, because removing hundreds of objects inside one request times out half way through with no record of where it got to. Nothing serves the content in the meantime; what arrives after the answer is the disk space.

Response Body

The account is gone

curl -X DELETE 'https://example.com/api/v1/account' \  -H 'Content-Type: application/json' \  -d '{}'
Empty