Endpoint to delete an account #194

Activity

1. PGijsbers

   added

   enhancementNew feature or requestNew feature or request

   on Sep 23, 2024
2. joaquinvanschoren commented on Sep 23, 2024

   

   joaquinvanschoren

   on Sep 23, 2024

   Contributor

   More actions

   It means:

   • Removing the account from the user database and other stores (e.g. elasticsearch)
   • If the user has uploaded datasets, flow, runs, they should either be 'removed' or the uploader should be anonymized. Right now we need to ask authors what to do (luckily it has not yet come up that people also had created resources, so we could simply delete them).

   How this can be implemented in practice:

   • A first step could be that authors get the option to remove their accounts only when they have no resources. That covers most use cases. If they do have resources, they'll get an error message that they need to remove those resources first.
   • Next, we can make this an option that users can select. The default being that resources remain and the uploader becomes anonymous. If they opt for removal we can remove the resources for them.
   • According to FAIR principles, it must be possible for people to remove data, but a record (meta-data) of the dataset should remain available. This is akin to archiving. E.g. for datasets, that means that the dataset still exists in the database, but the data itself is deleted. For flows and runs it is more vague since they are all meta-data. But e.g. models attached to a run could still be removed.
   • I believe this means that we should probably update the dataset delete option to allow removing a dataset while maintaining the meta-data. At the moment, I believe that the API will only actually delete a dataset if there are no resources dependent on it.
   • We should update the terms and conditions to make this more clear I think.

   We should definitely discuss more. Maybe we should split it up into two issues, one for removing users without resources (which we can do fast), and one where we also take care of properly removing/archiving or anonymizing their resources.

   👍React with 👍1Reacted by Pieter Gijsbers
3. PGijsbers commented on Sep 23, 2024

   

   PGijsbers

   on Sep 23, 2024

   Last edited by PGijsbers

   ContributorAuthor

   More actions

   Thanks for the elaboration. The deletion of datasets themselves is interesting. On the one hand, people should be able to. On the other, entities not owned by the same users may depend on it (tasks, benchmarking suites). That goes against the promise of availability. On top of that, other users may have forked the data, rendering deletion useless to some degree. Definitely worth having a discussion about and also exploring the legal obligations.
4. Varshith-Yadav commented on Mar 2, 2026

   

   Varshith-Yadav

   on Mar 2, 2026

   More actions

   Hi @joaquinvanschoren, I'd like to work on this.

   Based on your explanation, I propose a two-phase approach:

   Phase 1: Add DELETE endpoint that only allows deletion for users with no resources. Return 409 error if they have any.

   Phase 2: Add options for resource handling - either anonymize uploader (default, FAIR-compliant) or delete if no dependencies exist.

   Should I start with Phase 1? Happy to take this on.
5. Jayant-kernel commented on Mar 7, 2026

   

   Jayant-kernel

   on Mar 7, 2026

   More actions

   Hey @PGijsbers and @joaquinvanschoren

   I'd love to take this on! Looked through the code — the endpoint is fully missing
   (no router, no DB delete function, nothing).

   • New DELETE /v1/user/{user_id} endpoint
   • Block deletion if user has resources → return 409
   • Only allow self or admin to delete
   • Tests + UserError enum

   Then
   (anonymization) can be a follow-up.
   Can I get assigned?
6. Jayant-kernel

   added a commit that references this issue on Mar 7, 2026

   feat: add DELETE /users/{user_id} endpoint (Phase 1, fixes openml#194)

   ...

   This issue will close once commit 9662c1f is merged into the 'main' branch.

   9662c1f
7. PGijsbers commented on Apr 15, 2026

   

   PGijsbers

   on Apr 15, 2026

   ContributorAuthor

   More actions

   @igennova would you like to pick this up? In particular, support for deleting users without assets ("phase 1" from above).

   Add DELETE endpoint that only allows deletion for users with no resources. Return 409 error if they have any.

   Users should only be able to delete their own account. Admins can delete any account (that does not have resources).

   👍React with 👍1Reacted by Lucky negi
8. igennova commented on Apr 15, 2026

   

   igennova

   on Apr 15, 2026

   Contributor

   More actions

   @igennova would you like to pick this up? In particular, support for deleting users without assets ("phase 1" from above).

   Add DELETE endpoint that only allows deletion for users with no resources. Return 409 error if they have any.

   Users should only be able to delete their own account. Admins can delete any account (that does not have resources).

   @PGijsbers Sure, I’ll work on this and open a PR soon. Thanks!
9. PGijsbers

   assigned

   igennova

   on Apr 16, 2026
10. PGijsbers

    closed this as completedin #317on May 13, 2026
11. PGijsbers

    added a commit that references this issue on May 13, 2026

    Add DELETE /users/{id} with no-resources rule (#317)

    ...

    This issue will close once commit 24dedf9 is merged into the 'main' branch.

    24dedf9
12. PGijsbers commented on May 13, 2026

    

    PGijsbers

    on May 13, 2026

    ContributorAuthor

    More actions

    Only users which do not have resources were addressed with #317.
    I will re-open this issue to indicate the feature is not complete.
13. PGijsbers

    reopened this on May 13, 2026
14. PGijsbers

    added

    behaviorDiscussion about behavior of the server (e.g., to propose a change)Discussion about behavior of the server (e.g., to propose a change)

    on May 13, 2026