The requirement to delete an apprequest is a bit confusing, but yes, you have to do it yourself. (If you don’t, they automatically expire after two weeks.) I think Facebook’s reasoning is that app’s will vary in how they use apprequests, so it’s better to leave it to the app to delete it at the right time than for Facebook to make an assumption about when that should be.
Let’s say a user receives an apprequest. You can query their apprequests via a GET to “me/apprequests”. This’ll return a JSON that includes an array of all apprequests that user received, which includes a Facebook assigned id. Once you’ve done whatever it is you want to do with it, you delete it by issuing a delete to “/<id>” where <id> is the id of the apprequest.
- Andrew