Deletes the GCS file (primary + display variant if present), cleans up any lingering upload session, and hard-deletes the upload record from the database. Returns 404 if the upload does not exist or does not belong to the authenticated user.
Clerk session JWT or Unkey API key passed as Bearer token
Workspace ID fallback. Required when authenticating with a Bearer token in environments where cookies cannot be shared (e.g. preview). Not needed for API key auth (workspace is embedded in the key metadata) or when the workspace cookie is present.
"43dc2a1c-3384-41b5-a6e9-3b2d607d0fae"
Required when authenticating with an API key. Identifies the end-user making the request. Ignored when authenticating with a Bearer token (the user ID is extracted from the token).
"user_abc123"
Optional. Email of the external user, used for audit logging. Only applicable when authenticating with an API key.
"user@example.com"
Upload ID
Upload and file deleted