# Nodes and account deletion

Use stable node identity and permanently deactivate an account.


**Auth:** Approved own-device signed action `delete-node`.
## Request and response

Angle-bracket values describe placeholders, including nested objects and numeric types; these are wire shapes, not captured service data. Replace them before sending.

```http
POST /v1/nodes/<own-node-id>/delete HTTP/1.1
Host: trust-staging.rebellion.systems
Content-Type: application/json

{
  "action": {
    "action": "delete-node",
    "graphKeyId": "<own-device-id>",
    "graphNodeId": "<own-node-id>",
    "nonce": "<fresh-random-nonce>",
    "signedAt": "<current-ISO-timestamp>"
  },
  "signature": "<base64-action-signature>"
}
```

Response shape:

```json role="response"
{
  "deletion": {
    "graphNodeId": "<own-node-id>",
    "status": "deleted",
    "deletedAt": "<timestamp>"
  },
  "graphEpochRoot": "<graph-root>",
  "poseidonEpochRoot": "<poseidon-root>",
  "eventLogRoot": "<log-root>",
  "eventLogSize": "<nonnegative-integer>"
}
```




A node is the stable endpoint for a persona's connections. Binding returns its `graphNodeId` alongside the device's `graphKeyId`. Devices may change without moving the node's edges. Node kinds are `human` and `agent`; the kind is metadata, not independent evidence of humanhood or delegated authority.

## Delete your node

`POST /v1/nodes/:graphNodeId/delete` accepts a signed action:

```json role="request"
{
  "action": {
    "action": "delete-node",
    "graphKeyId": "own-device-id",
    "graphNodeId": "own-node-id",
    "nonce": "fresh-random-nonce",
    "signedAt": "2026-11-04T12:00:00.000Z"
  },
  "signature": "base64-action-signature"
}
```

The node ID must match both the URL and the signing device's own node. The device must be usable, graph-purpose and approved on a chained node. A quarantined key returns 403 `GRAPH_KEY_NOT_APPROVED`. Persona credentials and content-signing keys cannot authorize deletion.

Success is 200 with `deletion: {graphNodeId, status, deletedAt}` and the four epoch commitment fields. `status` is `deleted` or `already-deleted`.

## Effects

The node becomes deactivated and cannot participate in reachability. Its device keys are revoked; its own vouches and tags are removed from active use; its handle is released into the normal cooling-off period; external fingerprints are revoked and remain reserved. Recovery cannot revive the node. A later sign-up creates a fresh empty node.

Incoming declarations belong to their sources and remain for those sources to manage. They no longer contribute to paths through the deactivated node. An owner's incident edge listing can show `subjectDeactivated: true`, allowing that owner to revoke its own declaration.

The deletion appends to history. Existing event-log entries and previously signed attestations remain, and device public keys remain sufficient for certificate status to report revocation.

## Retry after a lost response

Sign a **new**, fresh `delete-node` action using a key of the deactivated node. A valid repeat returns `already-deleted` with the original deletion time. A stale request, bad signature or wrong-node target is refused. Do not infer deletion merely from an unrelated request failing.


**Never**
Deletion is irreversible. Confirm the chosen node with the user before signing the action. There is no separate AuthenSee confirmation step on this endpoint.


**Does not establish**
Deletion deactivates an account; it is not removal of all historical public evidence. Other people's signed incoming declarations, event commitments, issued attestations and already downloaded content are not recalled.