Your data

This page covers the data Hexel Studio keeps about you as a person, and about an organization as a whole.

• Your account belongs to you. Only you can read, change, export or delete it through the API.
• An organization belongs to its members. Who can export, delete or restore it depends on their permissions.

The examples use $ACCESS_TOKEN, an access token for your account. See Authenticate to the API.

Your account

Get your account

curl https://api.hexelstudio.com/v1/users/me \
  -H "Authorization: Bearer $ACCESS_TOKEN"

The response is your user record. An abridged example:

{
  "id": "<user-id>",
  "email": "[email protected]",
  "display_name": "Ada Lovelace",
  "first_name": "Ada",
  "last_name": "Lovelace",
  "locale": "en-GB",
  "timezone": "Europe/London",
  "status": "ACTIVE",
  "is_email_verified": true,
  "created_at": "2026-09-01T12:00:00Z",
  "updated_at": "2026-10-20T09:30:00Z"
}

Fields without a value are left out. id is your user ID; other endpoints on this page take it as {user_id}. GET /v1/users/{user_id} returns the same record, and answers 403 for any user ID other than your own.

Update your profile

curl -X PATCH https://api.hexelstudio.com/v1/users/$USER_ID \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"display_name": "Ada L.", "timezone": "Europe/Paris"}'

const res = await fetch(
  `https://api.hexelstudio.com/v1/users/${process.env.USER_ID}`,
  {
    method: "PATCH",
    headers: {
      Authorization: `Bearer ${process.env.ACCESS_TOKEN}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({ display_name: "Ada L.", timezone: "Europe/Paris" }),
  },
);

import os
import requests

res = requests.patch(
    f"https://api.hexelstudio.com/v1/users/{os.environ['USER_ID']}",
    headers={"Authorization": f"Bearer {os.environ['ACCESS_TOKEN']}"},
    json={"display_name": "Ada L.", "timezone": "Europe/Paris"},
)

You can change these fields: display_name, name, first_name, last_name, profile_image_url, avatar_url, phone_number, locale and timezone. Other fields, such as email and status, are ignored. A request with none of the allowed fields fails.

The response is:

{ "message": "user updated" }

Export your data

curl https://api.hexelstudio.com/v1/users/$USER_ID/export \
  -H "Authorization: Bearer $ACCESS_TOKEN"

{ "message": "data export sent to your registered email" }

Hexel Studio emails a ZIP file to your account's email address. It holds your profile and the other records kept with your account, such as your linked sign-in methods, as JSON files. The API response does not contain the data itself.

In the console, use Settings → Export Data.

Delete your account

Request deletion:

curl -X POST https://api.hexelstudio.com/v1/users/$USER_ID/deletion-request \
  -H "Authorization: Bearer $ACCESS_TOKEN"

{ "message": "deletion requested", "grace_period_days": 30 }

The request starts a 30-day grace period. Your account record shows when you asked (deletion_requested_at) and the date deletion is scheduled for (deletion_scheduled_for). Your account keeps working during the grace period.

You can't request deletion while you're the only owner of an organization, because the organization would be left without one. The request fails with 409:

{
  "error": "sole_owner",
  "message": "You are the only owner of these organizations. Transfer ownership or delete them before deleting your account.",
  "organization_ids": ["org_..."]
}

Transfer ownership of each listed organization, or delete it, then request deletion again.

To change your mind, cancel before the scheduled date:

curl -X DELETE https://api.hexelstudio.com/v1/users/$USER_ID/deletion-request \
  -H "Authorization: Bearer $ACCESS_TOKEN"

{ "message": "deletion cancelled" }

When the grace period ends, Hexel Studio erases the account. This runs every hour, so it can happen up to an hour after the scheduled date. Hexel Studio:

• Removes you from every organization and revokes pending invitations sent to your email address.
• Removes you from every group in your organizations, including the groups behind member roles, so you lose the access they gave.
• Erases your Hexel account sign-in: your password, passkeys and linked social sign-ins.
• Replaces your email address and removes your name, phone number, profile image and saved preferences.
• Deletes the service users you created and revokes their API keys.
• Stops issuing access tokens to the account.

If you became the only owner of an organization during the grace period, erasure waits until you transfer ownership or the organization is deleted.

In the console, use Settings → Delete Account.

Your organization

Export an organization

Any caller with org:org:read in the organization can export it. Every member role has this permission by default.

curl https://api.hexelstudio.com/v1/organizations/$ORG_ID/export \
  -H "Authorization: Bearer $ACCESS_TOKEN"

The response holds the organization and its members:

{
  "organization": {
    "id": "<org-id>",
    "account_id": "<account-id>",
    "name": "Acme",
    "tier": "PAY_AS_YOU_GO",
    "support_tier": "STANDARD",
    "created_by_user_id": "<user-id>",
    "is_active": true,
    "created_at": "2026-09-01T12:00:00Z",
    "updated_at": "2026-10-20T09:30:00Z"
  },
  "members": [
    {
      "id": "<member-id>",
      "organization_id": "<org-id>",
      "user_id": "<user-id>",
      "role": "org_owner",
      "status": "ACTIVE",
      "joined_at": "2026-09-01T12:00:00Z",
      "created_at": "2026-09-01T12:00:00Z",
      "updated_at": "2026-09-01T12:00:00Z"
    }
  ]
}

Delete an organization

Deleting needs org:org:delete, which only the owner role has by default. The token must be for the organization you delete.

First call without confirmation to see what will be deleted:

curl -X DELETE https://api.hexelstudio.com/v1/organizations/$ORG_ID \
  -H "Authorization: Bearer $ACCESS_TOKEN"

{
  "message": "Confirmation required to delete organization",
  "warning": "This action will permanently delete the organization and all related data",
  "preview": {
    "organization": "Acme",
    "workspaces": 2,
    "members": 4
  },
  "confirm_url": "/organizations/<org-id>?confirm=true"
}

Nothing is deleted yet. Repeat the request with ?confirm=true to delete:

curl -X DELETE "https://api.hexelstudio.com/v1/organizations/$ORG_ID?confirm=true" \
  -H "Authorization: Bearer $ACCESS_TOKEN"

The response is 204 No Content. From then on:

• Nobody can get or refresh an access token for the organization, members and service users alike: its API keys and OAuth clients stop working within a minute. Access tokens already issued stay valid until they expire. See Tokens.
• The organization can be restored for 30 days.
• After 30 days, Hexel Studio permanently deletes the organization with its members, invitations, settings, workspaces and environments, and its access data: policies, groups, roles, service users with their API keys and OAuth clients, and audit history. This runs once a day, so it can happen up to a day later.

Restore an organization

curl -X POST https://api.hexelstudio.com/v1/organizations/$ORG_ID/restore \
  -H "Authorization: Bearer $ACCESS_TOKEN"

The response is the restored organization. Restoring needs org:org:delete and an access token for the organization. Because no new tokens are issued for a deleted organization, you can restore it yourself only with an access token you got before you deleted it. After that token expires, contact Hexel Studio support within the 30 days.