Permanently delete an account
const url = 'https://api.tovarifinancial.com/accounts/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/permanent';const options = {method: 'DELETE', headers: {Authorization: 'Bearer <token>'}};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request DELETE \ --url https://api.tovarifinancial.com/accounts/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/permanent \ --header 'Authorization: Bearer <token>'Hard-deletes the account with its transactions, bills and import history (KAN-3400) — distinct from DELETE /accounts/{id}, which only closes it. Open and closed accounts alike. Only a household admin may: anyone else is refused first, before the account is locked or read, with 403 ACCOUNT_DELETE_NOT_ELIGIBLE and details.reason admin_only (KAN-3437). Otherwise refused with 409 ACCOUNT_DELETE_NOT_ELIGIBLE and details.reason one of linked_to_bank (any bank link, current or past), has_cross_account_transfer (a transfer leg in another account), or scheduled_transfer_target (an active bill on another account transfers into this one), in that precedence. A missing or other-org account is 404 NOT_FOUND with details.reason not_found. Nothing is deleted and no idempotency record is kept on a refusal; a same-key replay returns the stored 200. removed counts the live transactions and all bills deleted.
Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Path Parameters
Section titled “Path Parameters”Account id
Header Parameters
Section titled “Header Parameters”Optional idempotency key for safe write retries. Every operation that declares this header reads it. Three cases, told apart per operation: (1) where the operation also documents a 409 whose codes include IDEMPOTENCY_CONFLICT, replaying this key with a different payload returns 409 IDEMPOTENCY_CONFLICT and replaying it with the same payload returns the original response; (2) where it documents no 409, a replay is reconciled optimistically against a unique key column and answers the original 200; (3) where it documents a 409 whose codes do NOT include IDEMPOTENCY_CONFLICT, a conflict on this key is impossible — a replay answers a 200, and that 409 is a resource-state conflict described by the operation’s own 409 schema.
Responses
Section titled “Responses”Permanently deleted
object
object
object
Example
{ "data": { "deleted": true, "permanent": true }}Validation failed — see errorCode / fieldErrors
object
Machine-readable error code (AUTH_ERROR_CODES).
Optional field-level validation errors, keyed by field name.
object
Example
{ "errorCode": "INVALID_EMAIL_FORMAT"}Missing, invalid, or expired bearer token
object
Machine-readable error code (AUTH_ERROR_CODES).
Optional field-level validation errors, keyed by field name.
object
Example
{ "errorCode": "INVALID_EMAIL_FORMAT"}Authenticated, but the tenant gate refuses the request until the caller resolves a precondition. errorCode is one of EMAIL_NOT_VERIFIED, POLICY_ACCEPTANCE_REQUIRED, or SUBSCRIPTION_REQUIRED, evaluated in exactly that order (contract term CCR-1: email verification first, then policy acceptance, then subscription — so a subscriber who has merely not re-accepted the current policies always sees POLICY_ACCEPTANCE_REQUIRED). A POLICY_ACCEPTANCE_REQUIRED body additionally carries details.outstanding (the policy versions still to accept) and details.firstAcceptance. The SUBSCRIPTION_REQUIRED arm is INERT unless the server-side BILLING_ENABLED flag is exactly the string true; while it is off, only the first two codes are reachable. Not retryable as sent — resolve the named condition, then resend. This operation can ALSO answer 403 with errorCode ACCOUNT_DELETE_NOT_ELIGIBLE and details.reason admin_only, a refusal by the caller’s HOUSEHOLD ROLE rather than by the tenant gate: only a household admin may permanently delete an account (KAN-3437). Anyone else is refused before the account is locked or read, so the answer is the same whether or not the account exists. Nothing is written and no idempotency record is kept. It is not cleared by resolving anything on the account — it needs an admin — and the account can still be closed with DELETE /accounts/{id}. It is INDEPENDENT of BILLING_ENABLED. The errorCode enum on this operation’s response schema is the complete, machine-readable list.
object
Which condition refused the request. The first three are the tenant gate, evaluated in that order (CCR-1), and SUBSCRIPTION_REQUIRED is unreachable while BILLING_ENABLED is not exactly true. ACCOUNT_DELETE_NOT_ELIGIBLE here always carries details.reason admin_only: the caller is not a household admin.
object
Active policy versions the user has not yet accepted.
object
True when the user has accepted no policy before — the client renders the new-signup screen rather than the re-acceptance one.
object
Example
{ "errorCode": "EMAIL_NOT_VERIFIED", "details": { "reason": "admin_only" }}No such account in the caller org (missing, already deleted, or another org’s — indistinguishable). Nothing was written.
object
object
Example
{ "errorCode": "NOT_FOUND", "details": { "reason": "not_found" }}ACCOUNT_DELETE_NOT_ELIGIBLE (the account can only be closed; see details.reason), or IDEMPOTENCY_CONFLICT (the key was replayed with a different request). Nothing was written.
object
object
Example
{ "errorCode": "IDEMPOTENCY_CONFLICT", "details": { "reason": "linked_to_bank" }}Internal error (no internal detail leaked)
object
Machine-readable error code (AUTH_ERROR_CODES).
Optional field-level validation errors, keyed by field name.
object
Example
{ "errorCode": "INVALID_EMAIL_FORMAT"}Service temporarily unavailable — errorCode is SERVICE_UNAVAILABLE. A TRANSIENT, RETRYABLE condition rather than a defect in the request: a query that exceeded its time budget, a lost or refused database connection, a saturated connection pool, or an outage at an upstream provider the request depends on (the authentication provider, or the bank data provider on a bank-connection operation). The identical request may succeed on retry — back off briefly and, on a write, resend the same X-Idempotency-Key where the operation accepts one.
object
Machine-readable error code (AUTH_ERROR_CODES).
Optional field-level validation errors, keyed by field name.
object
Example
{ "errorCode": "INVALID_EMAIL_FORMAT"}