# Your account, by API

The account behind a key: what it is, its keys, its usage, everything held about it, and the way out.

`GET https://api.dietbloxycola.com/v1/account` (keyed, scope any key, not cached)

## The account

`GET /v1/account` answers the account the key belongs to, the key itself (id, mode, scopes) and the limits each keyed product allows the account's plan. Any live or test key of the account may read it; no scope is needed.

cURL:

```bash
curl https://api.dietbloxycola.com/v1/account \
  -H "Authorization: Bearer $DBC_API_KEY"
```
JavaScript:

```js
const res = await fetch("https://api.dietbloxycola.com/v1/account", {
  headers: {
    Authorization: `Bearer ${process.env.DBC_API_KEY}`,
  },
});
const account = await res.json();
```
Python:

```python
import requests
import os

account = requests.get("https://api.dietbloxycola.com/v1/account", headers={"Authorization": f"Bearer {os.environ['DBC_API_KEY']}"}, timeout=10).json()
```
Luau:

```lua
-- HttpService must be on in the game's settings. The key is a Creator Hub
-- secret named dbc_api_key, scoped to api.dietbloxycola.com; the script never
-- sees its text.
local HttpService = game:GetService("HttpService")

local response = HttpService:RequestAsync({
  Url = "https://api.dietbloxycola.com/v1/account",
  Method = "GET",
  Headers = {
    Authorization = HttpService:GetSecret("dbc_api_key"):AddPrefix("Bearer "),
  },
})
local account = HttpService:JSONDecode(response.Body)
```

200 OK:

```json
{
  "id": "tenant_01J9X4Q2M7V8K3B5N6P7R8S9T0",
  "display": "Diet Bloxy Cola",
  "plan": "free",
  "status": "active",
  "createdAt": "2026-09-04T12:00:00.000Z",
  "key": { "id": "key_01J9X4Q2M7V8K3B5N6P7R8S9T1", "mode": "live", "scopes": ["universes:read"] },
  "limits": {
    "proxy": { "perMinute": 60, "burst": 120, "monthly": 100000 }
  }
}
```

## The keys

`GET /v1/account/keys` lists every key the account has held, revoked ones included, with the prefix that names each in the portal. A secret is shown once, when the key is made, and never again: there is no field for it here.

200 OK:

```json
{
  "data": [
    {
      "id": "key_01J9X4Q2M7V8K3B5N6P7R8S9T1",
      "prefix": "dbc_live_ab12",
      "mode": "live",
      "scopes": ["universes:read"],
      "createdAt": "2026-09-04T12:00:00.000Z",
      "lastUsedAt": "2026-09-04T12:30:00.000Z",
      "expiresAt": null,
      "revokedAt": null
    }
  ],
  "hasMore": false
}
```

## The usage

`GET /v1/account/usage?from=YYYY-MM-DD&to=YYYY-MM-DD` answers requests and errors per product and route, by hour, with the median and the 95th percentile of latency in milliseconds. The window defaults to the last seven days and is at most 92; the hours arrive a few minutes late, since counters fold into the table on a cadence.

200 OK:

```json
{
  "from": "2026-08-28T12:00:00.000Z",
  "to": "2026-09-04T12:00:00.000Z",
  "data": [
    { "product": "proxy", "route": "GET /v1/universes/:universeId/live", "hour": "2026-09-04T11:00:00.000Z", "requests": 240, "errors": 0, "p50Ms": 25, "p95Ms": 100 }
  ],
  "hasMore": false
}
```

## Everything held

`GET /v1/account/export` answers one JSON document: the account, its keys, every usage row, the audit trail (keys made and revoked, switches flipped, a deletion asked for), and whatever each product holds for the account under `products`.

## Leaving

`DELETE /v1/account` asks for the account's deletion. Every key dies at once; the rows go after a 30-day grace, on the date the answer names as `purgeAt`, and a written confirmation follows. The retention schedule on the policies pages is the contract.

cURL:

```bash
curl https://api.dietbloxycola.com/v1/account \
  -X DELETE \
  -H "Authorization: Bearer $DBC_API_KEY"
```
JavaScript:

```js
const res = await fetch("https://api.dietbloxycola.com/v1/account", {
  method: "DELETE",
  headers: {
    Authorization: `Bearer ${process.env.DBC_API_KEY}`,
  },
});
const gone = await res.json();
```
Python:

```python
import requests
import os

gone = requests.delete("https://api.dietbloxycola.com/v1/account", headers={"Authorization": f"Bearer {os.environ['DBC_API_KEY']}"}, timeout=10).json()
```
Luau:

```lua
-- HttpService must be on in the game's settings. The key is a Creator Hub
-- secret named dbc_api_key, scoped to api.dietbloxycola.com; the script never
-- sees its text.
local HttpService = game:GetService("HttpService")

local response = HttpService:RequestAsync({
  Url = "https://api.dietbloxycola.com/v1/account",
  Method = "DELETE",
  Headers = {
    Authorization = HttpService:GetSecret("dbc_api_key"):AddPrefix("Bearer "),
  },
})
local gone = HttpService:JSONDecode(response.Body)
```

200 OK:

```json
{ "status": "deleting", "purgeAt": "2026-10-04T12:00:00.000Z", "graceDays": 30 }
```