compute

DELETE `/v1/compute/servers/{serverId}/packages/{packageId}`

Remove a website from a server.

Authentication

Send an API key as a bearer token. The key must carry the sites.delete permission; a key without it is refused with 403, not 404.

This endpoint takes no organisation id. Your key already identifies the organisation it belongs to, and the response is scoped to it.

Try it

Replace anything in angle brackets with your own values, and the key placeholder with a key from your dashboard.

curl -X DELETE https://api.zinndigital.com/v1/compute/servers/{serverId}/packages/{packageId} \
  -H "Authorization: Bearer zdk_live_…" \
  -H "Content-Type: application/json" \
  -d '{ "confirm_domain": <string> }'

Signed in? The API console in your dashboard fills in your real organisation id and your own key, and runs the request against the live API so you can see the actual response. Open this endpoint in the API console

Details

Deletes the hosting package and everything on it - files, databases, certificates and settings. **Irreversible at the provider.** Two things happen first, and both are promises to the customer rather than implementation detail. A **final backup is taken before anything is deleted**, and is kept for the retention window the site lifecycle policy states (30 days as seeded); if that backup cannot be taken, the deletion is **refused** with 422 and nothing is removed. And the **domain is left parked** - no zone is deleted, no record is removed and no name is released, so a customer moving a site between machines keeps the name pointed where it is. Resolved by organisation, server and package together, so a package id belonging to another tenant returns 404 rather than 403 - the same reason every other compute surface answers 404 for a machine that is not yours. A package this platform holds no site record for is refused: we cannot back up what we have no record of, and deleting it would break the retention promise silently. That is the state of any website created in the provider's own panel. Requires `sites.delete`. ⛔ **This operation carries a request body on `DELETE`**, the same idiom and the same reasoning as `deleteSite`: RFC 9110 permits it, and the typed confirmation must travel with the request that acts on it, because a "confirm" call followed by an unconfirmed delete is two requests and the second one is the whole vulnerability. `confirm_domain` is compared against the package's primary domain and a mismatch is `422`.

Parameters

Name	Type	Required	What it is
`serverId (path)`	`Uuid`	Yes	The server's id, as `listComputeServers` reports it. Ours (UUIDv7), minted when the order row was written — never the provider's own identifier for the machine.
`packageId (path)`	`string`	Yes	The provider's package identifier, as `listComputeServerPackages` reports it in `id` — deliberately not ours, because this addresses the thing on the machine. It is not a ca…

Request body

Name	Type	Required	What it is
`confirm_domain`	`string`	Yes	The package's primary domain, typed by the customer. Compared exactly against the domain the provider reports for the package; anything else is `422` and nothing is deleted.

Errors this endpoint can return

401 · 403 · 404 · 422 · 429 · 503

DELETE /v1/compute/servers/{serverId}/packages/{packageId}