curl -X POST 'https://verification.didit.me/v3/users/delete/' \
-H 'x-api-key: YOUR_API_KEY' \
-H 'Content-Type: application/json' \
-d '{"vendor_data_list": ["user-123", "user-456"]}'import requests
resp = requests.post(
'https://verification.didit.me/v3/users/delete/',
headers={'x-api-key': 'YOUR_API_KEY', 'Content-Type': 'application/json'},
json={'vendor_data_list': ['user-123', 'user-456']},
)
resp.raise_for_status()
print('deleted', resp.json()['deleted'])const resp = await fetch('https://verification.didit.me/v3/users/delete/', {
method: 'POST',
headers: { 'x-api-key': process.env.DIDIT_API_KEY, 'Content-Type': 'application/json' },
body: JSON.stringify({ vendor_data_list: ['user-123', 'user-456'] }),
});
const body = await resp.json();
console.log('deleted', body.deleted);<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://verification.didit.me/v3/users/delete/",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'vendor_data_list' => [
'user-123',
'user-456'
]
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://verification.didit.me/v3/users/delete/"
payload := strings.NewReader("{\n \"vendor_data_list\": [\n \"user-123\",\n \"user-456\"\n ]\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("x-api-key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://verification.didit.me/v3/users/delete/")
.header("x-api-key", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"vendor_data_list\": [\n \"user-123\",\n \"user-456\"\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://verification.didit.me/v3/users/delete/")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["x-api-key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"vendor_data_list\": [\n \"user-123\",\n \"user-456\"\n ]\n}"
response = http.request(request)
puts response.read_body{
"deleted": 2
}Batch Delete Users
Permanently delete users — the user records are removed permanently. For everyday blocking prefer Update User Status with BLOCKED. Unlike the businesses endpoint, this endpoint only accepts vendor_data_list or delete_all (no didit_internal_id_list).
Biometric templates: every image-free biometric template retained for these users after session deletion (see /v3/biometric-templates/) is purged before the user is deleted, so the person stops matching in duplicate detection and Face Search. If a template cannot be purged because a biometric store is unavailable, the call returns 503, no user in the request is deleted, and repeating the request finishes the job.
curl -X POST 'https://verification.didit.me/v3/users/delete/' \
-H 'x-api-key: YOUR_API_KEY' \
-H 'Content-Type: application/json' \
-d '{"vendor_data_list": ["user-123", "user-456"]}'import requests
resp = requests.post(
'https://verification.didit.me/v3/users/delete/',
headers={'x-api-key': 'YOUR_API_KEY', 'Content-Type': 'application/json'},
json={'vendor_data_list': ['user-123', 'user-456']},
)
resp.raise_for_status()
print('deleted', resp.json()['deleted'])const resp = await fetch('https://verification.didit.me/v3/users/delete/', {
method: 'POST',
headers: { 'x-api-key': process.env.DIDIT_API_KEY, 'Content-Type': 'application/json' },
body: JSON.stringify({ vendor_data_list: ['user-123', 'user-456'] }),
});
const body = await resp.json();
console.log('deleted', body.deleted);<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://verification.didit.me/v3/users/delete/",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'vendor_data_list' => [
'user-123',
'user-456'
]
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://verification.didit.me/v3/users/delete/"
payload := strings.NewReader("{\n \"vendor_data_list\": [\n \"user-123\",\n \"user-456\"\n ]\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("x-api-key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://verification.didit.me/v3/users/delete/")
.header("x-api-key", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"vendor_data_list\": [\n \"user-123\",\n \"user-456\"\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://verification.didit.me/v3/users/delete/")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["x-api-key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"vendor_data_list\": [\n \"user-123\",\n \"user-456\"\n ]\n}"
response = http.request(request)
puts response.read_body{
"deleted": 2
}Overview
Deletes one or more User entities. The user records are removed permanently. Their verification sessions are not covered by this endpoint and survive with their link to the user cleared; delete them with Delete Session or Batch Delete Sessions. Transactions are not covered either; delete those from the Console.When to use it
- Right-to-be-forgotten requests (GDPR / CCPA).
- Clean-up of test users during QA.
- Deprovisioning users removed from your own platform.
Notes
- Accepts a list of
vendor_datavalues, ordelete_all: true. Unlike the Console, it does not acceptdidit_internal_idvalues. - Idempotent — re-sending the same list returns
deleted: 0after the first run. - Returns only a count of what was deleted, not a per-item report. Values that matched nothing are skipped silently. Send a de-duplicated list if you want to compare
deletedagainst the number of identifiers you sent, since a repeated identifier is only counted once. - No webhook is emitted for a deletion. Webhooks fire on user status and data changes, not on delete — so an integration that needs a deletion signal must record it on its own side.
- Verification sessions linked to the user are NOT deleted by this endpoint. They remain, with their link to the user cleared, so their documents, faces and media are only removed once you delete the sessions themselves.
- Retained biometric templates anchored to the user ARE purged, before the user is deleted. If a template cannot be purged because a biometric store is unavailable, the call returns
503, no user in the request is deleted, and repeating the request finishes the job.
Permissions
Role must grantdelete:users. This is typically reserved for OWNER and ADMIN.
Related
Authorizations
Body
Response
Users deleted. Returns the number of users actually deleted.
Number of users deleted (excludes vendor_data values that didn't match anything).