curl

curl -X DELETE \
  https://verification.didit.me/v3/session/11111111-2222-3333-4444-555555555555/delete/ \
  -H 'x-api-key: YOUR_API_KEY'

import requests

response = requests.delete(
    "https://verification.didit.me/v3/session/11111111-2222-3333-4444-555555555555/delete/",
    headers={"x-api-key": "YOUR_API_KEY"},
)
response.raise_for_status()  # 204 on success; 404 if unknown or already deleted

const response = await fetch(
  'https://verification.didit.me/v3/session/11111111-2222-3333-4444-555555555555/delete/',
  {
    method: 'DELETE',
    headers: { 'x-api-key': 'YOUR_API_KEY' },
  },
);
if (response.status !== 204) throw new Error(`HTTP ${response.status}`);

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://verification.didit.me/v3/session/{sessionId}/delete/",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "DELETE",
  CURLOPT_HTTPHEADER => [
    "x-api-key: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://verification.didit.me/v3/session/{sessionId}/delete/"

	req, _ := http.NewRequest("DELETE", url, nil)

	req.Header.Add("x-api-key", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://verification.didit.me/v3/session/{sessionId}/delete/")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Delete.new(url)
request["x-api-key"] = '<api-key>'

response = http.request(request)
puts response.read_body

User and Business Verifications

Delete Session

Delete a single verification session — User Verification (KYC) or Business Verification (KYB) — by its session_id. The id is resolved against KYC sessions first, then KYB sessions, so both kinds are deleted through this one URL.

What happens on deletion:

The session and its verification data are deleted, and it immediately disappears from every read endpoint: GET /v3/session/{sessionId}/decision/ returns 404 and GET /v3/sessions/ stops listing it.
Everything the session produced goes with it: the decision, extracted data, and all related feature records (ID verification, face, liveness, face match, AML, registry checks, IP analysis, and so on).
All stored media owned by the session is deleted: document front/back photos (full, cropped, and privacy-blurred variants), document-capture videos, portrait crops, NFC chip portrait and signature images, face reference images, liveness videos, face-match source/target images, Proof of Address documents, and any extra uploaded files (KYC); uploaded company documents and extra files (KYB). Previously issued media URLs (https://<media-host>/...) stop resolving.

What is not affected: blocklist entries created from this session (face or document) are not removed; manage those with the blocklist endpoints. Hosted-flow share tokens already issued for the session are not revoked, and webhook deliveries already queued for it still arrive. Credits already consumed are not refunded. The parent User or Business entity is not deleted; use POST /v3/users/delete/ or POST /v3/businesses/delete/ for those.

Irreversible: deletion cannot be undone and there is no restore endpoint. Export anything you need (for example a decision PDF) before you call it.

Side effects: no webhook is emitted for deletions.

Idempotency: not idempotent at the HTTP level — the first call returns 204; repeating it returns 404 because the session no longer resolves.

Authentication: send your application’s API key in the x-api-key header; the session must belong to that application. Console user access tokens (Authorization: Bearer ...) may also call this endpoint when they carry the delete:sessions permission. Authentication and permission failures both return 403 — this API never returns 401.

Rate limit: shared write budget of 300 requests/min per API key across all POST/PATCH/DELETE endpoints; exceeding it returns 429.

To bulk-delete KYC sessions by their numeric session_number, use POST /v3/sessions/delete/ instead.

DELETE

session

{sessionId}

delete

curl

curl -X DELETE \
  https://verification.didit.me/v3/session/11111111-2222-3333-4444-555555555555/delete/ \
  -H 'x-api-key: YOUR_API_KEY'

import requests

response = requests.delete(
    "https://verification.didit.me/v3/session/11111111-2222-3333-4444-555555555555/delete/",
    headers={"x-api-key": "YOUR_API_KEY"},
)
response.raise_for_status()  # 204 on success; 404 if unknown or already deleted

const response = await fetch(
  'https://verification.didit.me/v3/session/11111111-2222-3333-4444-555555555555/delete/',
  {
    method: 'DELETE',
    headers: { 'x-api-key': 'YOUR_API_KEY' },
  },
);
if (response.status !== 204) throw new Error(`HTTP ${response.status}`);

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://verification.didit.me/v3/session/{sessionId}/delete/",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "DELETE",
  CURLOPT_HTTPHEADER => [
    "x-api-key: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://verification.didit.me/v3/session/{sessionId}/delete/"

	req, _ := http.NewRequest("DELETE", url, nil)

	req.Header.Add("x-api-key", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://verification.didit.me/v3/session/{sessionId}/delete/")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Delete.new(url)
request["x-api-key"] = '<api-key>'

response = http.request(request)
puts response.read_body

KYC and KYB support

Works for both User Verification (KYC) and Business Verification (KYB) sessions. The session_id is resolved against both session types; the same delete behavior applies to both.

Behavior

The session is deleted, together with its decision, its extracted data, its associated feature records (ID verifications, registry checks, documents, AML, IP analysis, and so on) and all of its stored media.
The session disappears from list and decision responses immediately, and media URLs issued before the call stop resolving.
Deletion is irreversible. There is no restore endpoint, so export anything you need, such as a decision PDF, before you call it.

What is not affected

Deleting a session does not clean these up for you. If you are handling a right-to-erasure request, account for them separately.

Blocklist entries created from the session (face or document) stay in place. Remove them from the blocklist.
Hosted-flow share tokens already issued for the session are not revoked.
Webhook deliveries already queued still arrive, and no webhook is emitted for the deletion itself.
Credits already consumed by the verification are not refunded.
The parent User or Business entity is not deleted. Use Delete Users or Delete Businesses for those.

Examples

Delete a User Verification (KYC) session
Delete a Business Verification (KYB) session

curl -X DELETE https://verification.didit.me/v3/session/4c5c7f3a-.../delete/ \
  -H "x-api-key: YOUR_API_KEY"

Response: 204 No Content.

curl -X DELETE https://verification.didit.me/v3/session/bs-01HJX1.../delete/ \
  -H "x-api-key: YOUR_API_KEY"

Response: 204 No Content.

Permission

Requires delete:sessions. The same permission covers both User Verification (KYC) and Business Verification (KYB) sessions.

Batch delete

For bulk operations, use POST /v3/sessions/delete/ — accepts a list of session IDs of either kind.

Authorizations

x-api-key

string

header

required

Path Parameters

sessionId

string<uuid>

required

UUID (session_id) of the User Verification (KYC) or Business Verification (KYB) session to delete, as returned when the session was created. Must be a canonical hyphenated UUID — a non-UUID value does not match the route and returns 404.

Example:

"11111111-2222-3333-4444-555555555555"

Response

Session deleted. Empty body.

⌘I

Overview

User and Business Verifications

Lists

Workflows

Questionnaires

Users

Businesses

Cases

Case Blueprints

Report Templates

Regulatory Reports

Transactions

Travel Rule

Session Operations

Customization

Webhook

Billing

Management API Overview

Auth API (Programmatic)

Identity & Documents

Database Validation

Biometrics & Face

Compliance & Risk

Email Verification

Phone Verification

Delete Session

KYC and KYB support

Behavior

What is not affected

Examples

Permission

Batch delete

Authorizations

Path Parameters

Response

​KYC and KYB support

​Behavior

​What is not affected

​Examples

​Permission

​Batch delete

​Related

Authorizations

Path Parameters

Response

KYC and KYB support

Behavior

What is not affected

Examples

Permission

Batch delete

Related