Delete every stored result in the account

POST /api/v1/results/delete_all

API key required Base https://api.emailvalidator.ai 60 requests per minute per account

Permanently erase every result in the authenticated key's account and mode — single checks and batch jobs, submitted through the API and through the dashboard alike, including results your teammates submitted. Source files, generated result files and every stored copy of the submitted addresses go with them. It is immediate and irreversible, and nothing is refunded.

The sweep is scoped to the calling key's mode. A live key erases live results and leaves sandbox results untouched; a sandbox (ev_test_) key erases sandbox results and cannot touch a single live result. This is the same test/live boundary every other endpoint applies — a key only ever sees, and now only ever deletes, its own side of the account.

Requires the delete scope, which a key holds only if it was asked for by name.

A POST action, not DELETE /api/v1/results?confirm=.... Two reasons. Our request log stores paths query-redacted, so a ?confirm= token would leave no trace of the confirmation in the audit trail of an irreversible, account-wide action — while a JSON body is captured. And being a POST it accepts an Idempotency-Key: a client that timed out and retried would otherwise sweep a second time over everything created in between, and be told a count that answers neither request.

Send {"confirm": "delete-all-results"}. Any other body — including {} — is a 400 and consumes no Idempotency-Key.

403 insufficient_permissions, not insufficient_scope. That code means the key is fine and this actor may not do this, so minting a differently scoped key cannot help. It is answered when the key's user is not the account's owner or an admin: the sweep takes teammates' results, so deleting ALL of them is not a plain member's call, even though deleting one of your OWN results only needs membership.

Results still being produced are skipped, not refused: they are simply not counted in deleted, and the call still succeeds. Each deleted result that carried a callback_url emits its own verify.deleted / batch.deleted webhook.

On this page

Parameters
Request body
Responses
Response schema
Error responses
Examples

Parameters

header · parameters

Parameter	Type	Description
Idempotency-Key	string	Client-generated key (up to 255 characters) that makes a retry safe. The request identity is the confirmation body, so two `delete_all` calls carrying the same key ARE the same request: the second replays the first one's stored count and adds `Idempotency-Replayed: true` instead of sweeping again. Records expire after 24 hours and are scoped to the account, the endpoint and the key's mode. Omit the header and every call is a fresh sweep. example: 00000000-0000-4000-8000-000000000002

Request body · application/json · required

The confirmation body of POST /api/v1/results/delete_all.

A typed phrase rather than a boolean, because the action is account-wide and irreversible: an empty {}, a stray true, or a request assembled by a client that did not know what it was about to destroy must not be enough to trigger it.

Field	Type	Description
confirm required	string	Must be exactly `delete-all-results`. Anything else — including omitting the field — is a `400` with `code: invalid_request` and `param: confirm`, and consumes no `Idempotency-Key`. `delete-all-results` example: delete-all-results

Responses

200

The sweep ran. deleted is how many results were actually removed — in-flight ones were skipped rather than counted, so it can be lower than the number listed a moment earlier, and 0 is a legitimate answer for an account with nothing deletable. · application/json

400

The confirmation phrase is missing or wrong (code: invalid_request, param: confirm). Send a body of {"confirm": "delete-all-results"} to proceed. Nothing was deleted and no Idempotency-Key was consumed. · application/json

401

Missing or invalid API key. · application/json

403

Two different refusals, distinguishable by code. insufficient_scope — the key authenticated but does not hold the delete scope; mint a key that does. insufficient_permissions — the key IS scoped for this, but this actor may not run it: the key's user is not the account's owner or an admin. A differently scoped key cannot help with the second one. A sandbox key is not refused here; it sweeps its own sandbox results. · application/json

409

A request carrying this Idempotency-Key is still in flight (code: idempotency_in_progress). Retry shortly — once the first sweep finishes, the same key replays its count. · application/json

422

This Idempotency-Key was already used for a DIFFERENT request (code: idempotency_key_reuse). Nothing was deleted. · application/json

429

Rate limit exceeded. · application/json

500

Unexpected server error. The body carries code internal_error plus a request_id to quote in a support request, and never any exception detail. · application/json

Response schema · 200 · DeletedResults

The body of a successful POST /api/v1/results/delete_all: how many results were removed.

A count and not a list of ids. You asked for those results to stop existing; echoing their ids back would write a fresh copy of that inventory into the request log for the next 7 days.

Field	Type	Description
deleted required	integer min 0	How many results were actually removed. Results still being produced are skipped rather than blocking the sweep, so this can legitimately be lower than the number you saw listed a moment earlier. example: 128

Error responses

400 401 403 409 422 429 500 · ApiProblem · object

Standard error response shape used by all error status codes.

Field	Type	Description
status required	integer	HTTP status code mirrored in the body. example: 400
code required	string	The stable, machine-readable error vocabulary. Every `ApiProblem.code` is one of these values, and this is the WHOLE vocabulary — any one operation emits only the subset its own responses describe. Branch on this and never on the `error` prose, which is human-readable and may be reworded at any time. What each code means, the status it arrives with, and whether retrying can help are documented on the Errors page — the same page every error body links to as its `doc_url`. Three of these are specific to deletion. `result_in_progress` refuses to delete a result that is still being produced. `insufficient_permissions` refuses the ACTOR rather than the key. `result_deleted` is what a charged `Idempotency-Key` answers once the result it named has been deleted. `unauthorized` `invalid_api_key` `insufficient_scope` `insufficient_permissions` `invalid_request` `invalid_email` `invalid_callback_url` `insufficient_credits` `not_found` `job_not_pending` `result_in_progress` `needs_column_selection` `too_many_rows` `unsupported_file_type` `payload_too_large` `rate_limited` `idempotency_in_progress` `idempotency_key_reuse` `idempotency_resource_gone` `result_deleted` `internal_error` example: invalid_email
error required	string	Human-readable error message. example: Invalid email format.
param	string	The request field the failure is attributable to. Omitted when the failure is not about one specific field. example: email
details	array of string · null	Optional per-field validation messages. Null when not applicable. example: ["email: required"]
doc_url	string	Link to the documentation for this error code. example: https://emailvalidator.ai/docs/get-started/errors
request_id	string	Correlation id for this request. Quote it in a support request — it is how a single call is found in the server logs. example: 0HNCV1TQ3PLRK:00000003

Example request · application/json

curl -X POST https://api.emailvalidator.ai/api/v1/results/delete_all \
  -H "X-Api-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "confirm": "delete-all-results"
}'

{
  "confirm": "delete-all-results"
}

Example response · 200

{
  "deleted": 128
}