SmartREST 2 does not provide an interface for deleting of devices.
It is intended that users (not devices) control when a device is deleted because deleting a device always and irreversibly removes the device and all its attached data. This includes all measurements, events, alarms and operations. Potentially also child devices and all their data is removed depending on chosen options. The device is also removed from the asset hierarchy which can have effects on other devices and their access for users. Altogether this is not an action that should be done implicitly by a device and requires careful consideration by users
I totally backup Philipp’s answer! The device should not delete itself. This is also an audit relevant topic.
Is DELETE permitted using REST API only?
Yes, but use it with care (see above) Cumulocity - OpenAPI
A better way would be to set a specific flag on the device informing the user that it can be deleted. This can be done be setting a fragment and/or changing the device name.