POST
/
api
/
v1
/
auth
/
reactivate
Reactivate a pending-deletion account
curl --request POST \
  --url https://api.example.com/api/v1/auth/reactivate
import requests

url = "https://api.example.com/api/v1/auth/reactivate"

response = requests.post(url)

print(response.text)
const options = {method: 'POST'};

fetch('https://api.example.com/api/v1/auth/reactivate', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));
<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.example.com/api/v1/auth/reactivate",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}
package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/api/v1/auth/reactivate"

	req, _ := http.NewRequest("POST", url, nil)

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}
HttpResponse<String> response = Unirest.post("https://api.example.com/api/v1/auth/reactivate")
  .asString();
require 'uri'
require 'net/http'

url = URI("https://api.example.com/api/v1/auth/reactivate")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)

response = http.request(request)
puts response.read_body

​
Overview

When a user calls DELETE /me their account is soft-deleted: it becomes invisible to login and matching immediately, and a background worker permanently erases it 30 days later. During that 30-day grace window the deletion is reversible. POST /auth/reactivate is the only way to reverse it. It takes the same email + password as login; on success it clears the pending deletion and returns a fresh session — an identical body to POST /auth/login. The caller lands fully authenticated.
A successful login does NOT reactivate. While an account is pending deletion, POST /auth/login returns 403 ACCOUNT_PENDING_DELETION (with meta.deletionScheduledAt) instead of a session. This is deliberate: a user who merely wants to check their status never un-deletes by accident. Reactivation is always an explicit, separate action.

​
Authentication

None required — like login, this endpoint takes credentials in the body.

​
Path parameters

None.

​
Query parameters

None.

​
Request body

FieldTypeRequiredAllowed valuesExample
emailstringyesRFC 5322 valid, lowercased server-side, 5..254 charsalice@example.com
passwordstringyes1..200 charscorrect horse battery staple

​
Example payload

{
  "email": "alice@example.com",
  "password": "correct horse battery staple"
}

​
Response — 200 OK

Identical shape to POST /auth/login: accessToken, refreshToken, and a lightweight user summary. The account’s deletedAt / deletedReason are cleared, so subsequent logins succeed normally.

​
Example response

{
  "accessToken": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "refreshToken": "v8q3xZ0p6rW7sT4uV1nB2cX9yY8mK5jL6hG7fD3eA0c",
  "user": {
    "id": "6a22f1897f96f4bd18ab7168",
    "email": "alice@example.com",
    "firstName": "Alice",
    "lastName": "Andersson",
    "avatarUrl": null,
    "onboardingStep": "complete",
    "tenancyStatus": "approved",
    "subscriptionStatus": "active"
  }
}

​
Error responses

StatusCodeMeaning
400VALIDATION_FAILEDEmail is malformed or password is missing.
401UNAUTHENTICATEDWrong credentials, no soft-deleted account for that email, or the 30-day grace window has already elapsed (nothing left to reactivate). All of these collapse to the same generic error — the endpoint is enumeration-safe and never reveals which case applied.
429RATE_LIMITEDToo many attempts from this IP. Respect Retry-After.
Once the grace window elapses, the erasure worker tombstones the row (PII nulled, child data hard-deleted). After that point reactivation is impossible and returns 401 — there is no longer an account to restore.

​
Example error — 401

{
  "type": "https://api.swappr.co.uk/errors/unauthenticated",
  "title": "Authentication required",
  "status": 401,
  "code": "UNAUTHENTICATED",
  "detail": "Invalid email or password",
  "instance": "/api/v1/auth/reactivate",
  "requestId": "01HZQ7K3M4N5P6Q7R8S9T0V1W2"
}

​
Side effects

  • Clears deletedAt + deletedReason on the user document.
  • Issues a new session (creates a refresh_tokens row keyed by a new ULID session id).
  • Writes a user.reactivated audit row (actorType: USER).

​
Typical client flow

  1. User logs in during the grace window → 403 ACCOUNT_PENDING_DELETION with meta.deletionScheduledAt.
  2. Client shows a reactivation screen (“Your account is scheduled for deletion on {date}”).
  3. User taps Reactivate → client calls POST /auth/reactivate with the same credentials → 200 + fresh session → user is back in.

​
See also

​
curl

curl -X POST https://api.swappr.co.uk/api/v1/auth/reactivate \
  -H "Content-Type: application/json" \
  -d '{
    "email": "alice@example.com",
    "password": "correct horse battery staple"
  }'