> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dbhost.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Deleted databases

> List, download, and recover an operation-bound deleted database.

Deleted-database lifecycle endpoints require a full-account API key and the
enabled recovery feature.

## List recently deleted databases

`GET /api/v1/databases/deleted`

Returns unpurged tombstones owned by the API-key owner. Each item includes
`deletedAt`, `purgeAfter`, `recoveryStatus` and metadata for the exact verified
deletion backup:

```json theme={null}
{
  "data": [
    {
      "id": "550e8400-e29b-41d4-a716-446655440000",
      "name": "my-app",
      "displayName": "My Application",
      "deletedAt": "2026-07-27T09:00:00.000Z",
      "purgeAfter": "2026-08-03T09:00:00.000Z",
      "recoveryStatus": "recoverable",
      "deletionBackup": {
        "fileName": "20260727_090000_000000.sql.gz",
        "format": "sql.gz",
        "sizeBytes": 4194304,
        "checksumSha256": "<sha256>",
        "verifiedAt": "2026-07-27T09:01:00.000Z",
        "downloadUrl": "/api/v1/databases/550e8400-e29b-41d4-a716-446655440000/deletion-backup"
      }
    }
  ]
}
```

`recoveryStatus` is `recoverable`, `unavailable`, or `expired`. An incomplete
backup or access-snapshot binding is reported as unavailable rather than being
offered for recovery. `deletionBackup.downloadUrl` is `null` after
`purgeAfter`, even while metadata remains visible during a short purge retry.

## Download the deletion backup

`GET /api/v1/databases/{id}/deletion-backup`

Returns the exact operation-bound deletion artifact as a download or short-lived
redirect. The caller cannot select a filename. The route returns `404
DELETION_BACKUP_NOT_AVAILABLE` after expiry, purge, ownership mismatch or any
database, operation, backup, verification or retention-binding mismatch.

## Recover the database

`POST /api/v1/databases/{id}/recover`

Returns `202 Accepted` with an operation. Recovery requires available plan
quota and restores the isolated PostgreSQL generation, active team memberships,
the IP allowlist and still-existing selected-database API-key bindings. Missing
users or keys are skipped and reported in the completed operation. Pending
invitations are not restored.

After `purgeAfter`, download and recovery are disabled. Permanent deletion can
be briefly delayed by a safe retry, but the database and deletion backup are
removed together before the tombstone disappears from this list.