Governance API

The governance API exposes enterprise RTBF operations under /api/governance. These endpoints require a governance-authorized dashboard or session bearer credential for the target organization. Ordinary production API keys are rejected.

Export User

POST /api/governance/export-user

curl -X POST "${REFLEXIO_URL:-https://www.reflexio.ai}/api/governance/export-user" \
  -H "Authorization: Bearer $REFLEXIO_GOVERNANCE_BEARER" \
  -H "Content-Type: application/json" \
  --data @- <<'JSON'
{
  "user_id": "alice",
  "request_id": "support-ticket-123"
}
JSON

Returns the user's export bundle and minimized subject_ref. Durable audit rows store minimized references and counts, not raw bearer tokens.

Erase User

POST /api/governance/erase-user

curl -X POST "${REFLEXIO_URL:-https://www.reflexio.ai}/api/governance/erase-user" \
  -H "Authorization: Bearer $REFLEXIO_GOVERNANCE_BEARER" \
  -H "Content-Type: application/json" \
  --data @- <<'JSON'
{
  "user_id": "alice",
  "request_id": "support-ticket-123"
}
JSON

Repeating the same user_id and request_id returns the same purge operation identity. A completed response is returned only after the subject write barrier, deletes, final empty check, and ERASE ok audit write succeed.

Aggregated agent playbooks are treated as org-owned artifacts. User erasure removes user-owned data and source-window links to erased user playbooks, but does not automatically hide, rebuild, or delete agent playbooks.

Erasure also deletes, in every project, the pending tool calls (Agent Builder questions and their answers) raised by the user's extraction runs. These are org-scoped, so another user's run may have been waiting on one; that run is finalized without the answer, or keeps waiting on its own remaining questions, instead of failing.

Purge Operation Status

GET /api/governance/purge-operations/{purge_id}

curl -X GET "${REFLEXIO_URL:-https://www.reflexio.ai}/api/governance/purge-operations/purge_abc" \
  -H "Authorization: Bearer $REFLEXIO_GOVERNANCE_BEARER"

Returns minimized purge state only:

{
  "purge_id": "purge_abc",
  "subject_ref": "subref_v1_abc",
  "request_ref": "reqref_v1_abc",
  "status": "complete",
  "error_code": null,
  "error_detail": null,
  "created_at": 1710000000,
  "updated_at": 1710000005,
  "completed_at": 1710000005
}

This phase does not expose audit-event listing.

Data-source erasure controls

The portal reuses the same governance authorization and erasure service through:

• POST /api/projects/{project_id}/data-sources/streams/{stream_id}/purge-preview
• POST /api/projects/{project_id}/data-sources/streams/{stream_id}/purge-user

Both require an admin session, the governance entitlement, a matching X-Reflexio-Project header, and JSON { "user_id": "…", "request_id": "…" }. Preview returns estimated counts and a human-readable scope; it does not erase anything. The confirm route returns the existing UserEraseResult and preserves its idempotent request behavior. It does not grant erasure permission to an ordinary source-management session.

erasure_scope_cleanup reports source staging/sample cleanup. Unresolved records in the selected project are conservatively removed because their ownership cannot be ruled out; other projects' unresolved records are unaffected. Minimal source suppression prevents later mapping edits or reconnects from restoring erased data.