--- title: Your data description: View and update your account, export your data, delete your account, and export, delete or restore an organization. url: https://hexelstudio.com/docs/identity/your-data --- This page covers the data Hexel Studio keeps about you as a person, and about an organization as a whole. - Your **account** belongs to you. Only you can read, change, export or delete it through the API. - An **organization** belongs to its members. Who can export, delete or restore it depends on their permissions. The examples use `$ACCESS_TOKEN`, an access token for your account. See [Authenticate to the API](https://hexelstudio.com/docs/identity/authenticate). ## Your account ### Get your account ```bash curl https://api.hexelstudio.com/v1/users/me \ -H "Authorization: Bearer $ACCESS_TOKEN" ``` The response is your user record. An abridged example: ```json { "id": "", "email": "you@example.com", "display_name": "Ada Lovelace", "first_name": "Ada", "last_name": "Lovelace", "locale": "en-GB", "timezone": "Europe/London", "status": "ACTIVE", "is_email_verified": true, "created_at": "2026-09-01T12:00:00Z", "updated_at": "2026-10-20T09:30:00Z" } ``` Fields without a value are left out. `id` is your user ID; other endpoints on this page take it as `{user_id}`. `GET /v1/users/{user_id}` returns the same record, and answers `403` for any user ID other than your own. ### Update your profile ```bash curl curl -X PATCH https://api.hexelstudio.com/v1/users/$USER_ID \ -H "Authorization: Bearer $ACCESS_TOKEN" \ -H "Content-Type: application/json" \ -d '{"display_name": "Ada L.", "timezone": "Europe/Paris"}' ``` ```typescript TypeScript const res = await fetch( `https://api.hexelstudio.com/v1/users/${process.env.USER_ID}`, { method: "PATCH", headers: { Authorization: `Bearer ${process.env.ACCESS_TOKEN}`, "Content-Type": "application/json", }, body: JSON.stringify({ display_name: "Ada L.", timezone: "Europe/Paris" }), }, ); ``` ```python Python import os import requests res = requests.patch( f"https://api.hexelstudio.com/v1/users/{os.environ['USER_ID']}", headers={"Authorization": f"Bearer {os.environ['ACCESS_TOKEN']}"}, json={"display_name": "Ada L.", "timezone": "Europe/Paris"}, ) ``` You can change these fields: `display_name`, `name`, `first_name`, `last_name`, `profile_image_url`, `avatar_url`, `phone_number`, `locale` and `timezone`. Other fields, such as `email` and `status`, are ignored. A request with none of the allowed fields fails. The response is: ```json { "message": "user updated" } ``` ### Export your data ```bash curl https://api.hexelstudio.com/v1/users/$USER_ID/export \ -H "Authorization: Bearer $ACCESS_TOKEN" ``` ```json { "message": "data export sent to your registered email" } ``` Hexel Studio emails a ZIP file to your account's email address. It holds your profile and the other records kept with your account, such as your linked sign-in methods, as JSON files. The API response does not contain the data itself. In the console, use **Settings** → **Export Data**. ### Delete your account Request deletion: ```bash curl -X POST https://api.hexelstudio.com/v1/users/$USER_ID/deletion-request \ -H "Authorization: Bearer $ACCESS_TOKEN" ``` ```json { "message": "deletion requested", "grace_period_days": 30 } ``` The request starts a 30-day grace period. Your account record shows when you asked (`deletion_requested_at`) and the date deletion is scheduled for (`deletion_scheduled_for`). Your account keeps working during the grace period. You can't request deletion while you're the only owner of an organization, because the organization would be left without one. The request fails with `409`: ```json { "error": "sole_owner", "message": "You are the only owner of these organizations. Transfer ownership or delete them before deleting your account.", "organization_ids": ["org_..."] } ``` [Transfer ownership](https://hexelstudio.com/docs/identity/members#transfer-ownership) of each listed organization, or delete it, then request deletion again. To change your mind, cancel before the scheduled date: ```bash curl -X DELETE https://api.hexelstudio.com/v1/users/$USER_ID/deletion-request \ -H "Authorization: Bearer $ACCESS_TOKEN" ``` ```json { "message": "deletion cancelled" } ``` When the grace period ends, Hexel Studio erases the account. This runs every hour, so it can happen up to an hour after the scheduled date. Hexel Studio: - Removes you from every organization and revokes pending invitations sent to your email address. - Removes you from every group in your organizations, including the groups behind member roles, so you lose the access they gave. - Erases your Hexel account sign-in: your password, passkeys and linked social sign-ins. - Replaces your email address and removes your name, phone number, profile image and saved preferences. - Deletes the service users you created and revokes their API keys. - Stops issuing access tokens to the account. If you became the only owner of an organization during the grace period, erasure waits until you transfer ownership or the organization is deleted. Service users you created are deleted with your account, in every organization. If scripts or servers depend on them, ask an organization admin to create replacements owned by someone else before the scheduled date. In the console, use **Settings** → **Delete Account**. ## Your organization ### Export an organization Any caller with `org:org:read` in the organization can export it. Every member role has this permission by default. ```bash curl https://api.hexelstudio.com/v1/organizations/$ORG_ID/export \ -H "Authorization: Bearer $ACCESS_TOKEN" ``` The response holds the organization and its members: ```json { "organization": { "id": "", "account_id": "", "name": "Acme", "tier": "PAY_AS_YOU_GO", "support_tier": "STANDARD", "created_by_user_id": "", "is_active": true, "created_at": "2026-09-01T12:00:00Z", "updated_at": "2026-10-20T09:30:00Z" }, "members": [ { "id": "", "organization_id": "", "user_id": "", "role": "org_owner", "status": "ACTIVE", "joined_at": "2026-09-01T12:00:00Z", "created_at": "2026-09-01T12:00:00Z", "updated_at": "2026-09-01T12:00:00Z" } ] } ``` ### Delete an organization Deleting needs `org:org:delete`, which only the owner role has by default. The token must be for the organization you delete. First call without confirmation to see what will be deleted: ```bash curl -X DELETE https://api.hexelstudio.com/v1/organizations/$ORG_ID \ -H "Authorization: Bearer $ACCESS_TOKEN" ``` ```json { "message": "Confirmation required to delete organization", "warning": "This action will permanently delete the organization and all related data", "preview": { "organization": "Acme", "workspaces": 2, "members": 4 }, "confirm_url": "/organizations/?confirm=true" } ``` Nothing is deleted yet. Repeat the request with `?confirm=true` to delete: ```bash curl -X DELETE "https://api.hexelstudio.com/v1/organizations/$ORG_ID?confirm=true" \ -H "Authorization: Bearer $ACCESS_TOKEN" ``` The response is `204 No Content`. From then on: - Nobody can get or refresh an access token for the organization, members and service users alike: its API keys and OAuth clients stop working within a minute. Access tokens already issued stay valid until they expire. See [Tokens](https://hexelstudio.com/docs/identity/tokens). - The organization can be restored for 30 days. - After 30 days, Hexel Studio permanently deletes the organization with its members, invitations, settings, workspaces and environments, and its access data: policies, groups, roles, service users with their API keys and OAuth clients, and audit history. This runs once a day, so it can happen up to a day later. ### Restore an organization ```bash curl -X POST https://api.hexelstudio.com/v1/organizations/$ORG_ID/restore \ -H "Authorization: Bearer $ACCESS_TOKEN" ``` The response is the restored organization. Restoring needs `org:org:delete` and an access token for the organization. Because no new tokens are issued for a deleted organization, you can restore it yourself only with an access token you got before you deleted it. After that token expires, contact Hexel Studio support within the 30 days.