Governance API

Authentication & Scope

User RTBF Operations

Deployment owners must configure REFLEXIO_GOVERNANCE_REF_SECRET for platform and self-host deployments. Unmanaged OSS local/no-auth mode retains its existing fallback; operational ENVIRONMENT labels do not change persisted governance identity. The retired REFLEXIO_ENV selector is ignored only when blank or set to its former development default. Custom values require explicitly adopting the deployment-mode policy and removing the old name while preserving the existing secret. Do not choose a new secret as part of this setting cleanup: changing a secret requires a separate migration of persisted HMAC references and erasure barriers. Enterprise startup uses the same policy as runtime operations. Only an absent/blank mode or explicit local selects the OSS local policy; unknown nonblank modes stop with adoption guidance. Correcting a mode must preserve the existing key and erasure-barrier identity.

Export User

POST /api/governance/export-user

curl -X POST "${REFLEXIO_URL:-https://www.reflexio.ai}/api/governance/export-user" \
  -H "Authorization: Bearer $REFLEXIO_GOVERNANCE_BEARER" \
  -H "Content-Type: application/json" \
  --data @- <<'JSON'
{
  "user_id": "alice",
  "request_id": "support-ticket-123"
}
JSON

Returns the user's export bundle and minimized subject_ref. Durable audit rows store minimized references and counts, not raw bearer tokens.

Erase User

POST /api/governance/erase-user

curl -X POST "${REFLEXIO_URL:-https://www.reflexio.ai}/api/governance/erase-user" \
  -H "Authorization: Bearer $REFLEXIO_GOVERNANCE_BEARER" \
  -H "Content-Type: application/json" \
  --data @- <<'JSON'
{
  "user_id": "alice",
  "request_id": "support-ticket-123"
}
JSON

Repeating the same user_id and request_id returns the same purge operation identity. A completed response is returned only after the subject write barrier, deletes, final empty check, and ERASE ok audit write succeed.

Aggregated agent playbooks are treated as org-owned artifacts. User erasure removes user-owned data and source-window links to erased user playbooks, but does not automatically hide, rebuild, or delete agent playbooks.

Erasure also deletes, in every project, the pending tool calls (Agent Builder questions and their answers) raised by the user's extraction runs. These are org-scoped, so another user's run may have been waiting on one; that run is finalized without the answer, or keeps waiting on its own remaining questions, instead of failing.

Purge Operation Status

GET /api/governance/purge-operations/{purge_id}

curl -X GET "${REFLEXIO_URL:-https://www.reflexio.ai}/api/governance/purge-operations/purge_abc" \
  -H "Authorization: Bearer $REFLEXIO_GOVERNANCE_BEARER"

Returns minimized purge state only:

{
  "purge_id": "purge_abc",
  "subject_ref": "subref_v1_abc",
  "request_ref": "reqref_v1_abc",
  "status": "complete",
  "error_code": null,
  "error_detail": null,
  "created_at": 1710000000,
  "updated_at": 1710000005,
  "completed_at": 1710000005
}

This phase does not expose audit-event listing.

Data-source erasure controls

The portal reuses the same governance authorization and erasure service through:

• POST /api/projects/{project_id}/data-sources/streams/{stream_id}/purge-preview
• POST /api/projects/{project_id}/data-sources/streams/{stream_id}/purge-user

Both require an admin session, the governance entitlement, a matching X-Reflexio-Project header, and JSON { "user_id": "…", "request_id": "…" }. Preview returns estimated counts and a human-readable scope; it does not erase anything. The confirm route returns the existing UserEraseResult and preserves its idempotent request behavior. It does not grant erasure permission to an ordinary source-management session.

erasure_scope_cleanup reports source staging/sample cleanup. Unresolved records in the selected project are conservatively removed because their ownership cannot be ruled out; other projects' unresolved records are unaffected. Minimal source suppression prevents later mapping edits or reconnects from restoring erased data.

Explore Related Guides