facebook.com/.well-known/delete would be a better endpoint. .well-known is already standardized, facebook.com/.well-known/change-password is already implemented, and you have proof you’re dealing with the right party.