governance
Tenant export, deletion, legal-hold visibility, audit, and feedback.
| Method | Path | Operation ID |
|---|---|---|
| POST | /v1/feedback |
submitFeedback |
| GET | /v1/governance/audit |
queryGovernanceAudit |
| GET | /v1/governance/deletions |
listGovernanceDeletions |
| POST | /v1/governance/deletions |
createGovernanceDeletion |
| GET | /v1/governance/deletions/{deletion_id} |
getGovernanceDeletion |
| GET | /v1/governance/exports |
listGovernanceExports |
| POST | /v1/governance/exports |
createGovernanceExport |
| GET | /v1/governance/exports/{export_id} |
getGovernanceExport |
| GET | /v1/governance/legal-holds |
listGovernanceLegalHolds |
POST /v1/feedback
Section titled “POST /v1/feedback”Operation ID: submitFeedback
Submit feedback with authorized typed resource references.
Authentication: Authorization: Bearer <API key or console session> (Authentication).
Request body
Section titled “Request body”application/json: FeedbackBody (required)
| Field | Type | Required | Description |
|---|---|---|---|
category |
string or null | no | |
contact_consented |
boolean | no | Default false. |
contexts |
array of FeedbackContextBody | no | Default []. |
message |
string | yes | Max length 4000. |
Responses
Section titled “Responses”| Status | Description | Body |
|---|---|---|
| 201 | Successful Response | application/json FeedbackResponse |
| 401 | The bearer credential is missing, malformed, expired, revoked, or otherwise invalid. Clerk sessions and scoped API keys fail identically and the body never reveals which credential was presented or whether it exists. | application/json HttpErrorResponse |
| 403 | The provider deleted this identity, or the account is deactivated. A valid session cannot authorize a tombstoned identity back into use; an API key must also grant the scope required by the operation, and an operation is not classified by the route/scope policy and is denied by default. An API key restricted to client networks is refused from any other network with the API_KEY_IP_NOT_ALLOWED envelope. |
application/json HttpErrorResponse or GovernanceErrorResponse or ErrorResponse |
| 404 | Not Found | application/json GovernanceErrorResponse |
| 409 | Just-in-time provisioning conflicted: the verified email belongs to another provisioned account. | application/json HttpErrorResponse or GovernanceErrorResponse |
| 422 | A verified email is unavailable for account provisioning. | application/json HttpErrorResponse or GovernanceErrorResponse |
| 429 | The API key’s own request rate limit was exceeded (API_KEY_RATE_LIMITED). Only keys configured with a rate limit can receive this. Retryable after Retry-After seconds; the refused request consumed no capacity. |
application/json ErrorResponse |
| 503 | Credential verification is unavailable: Clerk session verification is not configured, no API-key pepper is enrolled, or bounded API-key verification is temporarily overloaded. Retryable. | application/json HttpErrorResponse or GovernanceErrorResponse |
201 response fields
Section titled “201 response fields”| Field | Type | Required | Description |
|---|---|---|---|
feedback_id |
string | yes |
GET /v1/governance/audit
Section titled “GET /v1/governance/audit”Operation ID: queryGovernanceAudit
Query the tenant-scoped immutable audit projection.
Authentication: Authorization: Bearer <API key or console session> (Authentication).
Parameters
Section titled “Parameters”| Name | In | Type | Required | Description |
|---|---|---|---|---|
actor_id |
query | string or null | no | |
resource_type |
query | string or null | no | |
resource_id |
query | string or null | no | |
action |
query | string or null | no | |
request_id |
query | string or null | no | |
occurred_from |
query | string or null | no | |
occurred_to |
query | string or null | no | |
limit |
query | integer | no | Minimum 1. Maximum 500. Default 100. |
Responses
Section titled “Responses”| Status | Description | Body |
|---|---|---|
| 200 | Successful Response | application/json array of AuditEventResponse |
| 401 | The bearer credential is missing, malformed, expired, revoked, or otherwise invalid. Clerk sessions and scoped API keys fail identically and the body never reveals which credential was presented or whether it exists. | application/json HttpErrorResponse |
| 403 | The provider deleted this identity, or the account is deactivated. A valid session cannot authorize a tombstoned identity back into use; an API key must also grant the scope required by the operation, and an operation is not classified by the route/scope policy and is denied by default. An API key restricted to client networks is refused from any other network with the API_KEY_IP_NOT_ALLOWED envelope. |
application/json HttpErrorResponse or GovernanceErrorResponse or ErrorResponse |
| 404 | Not Found | application/json GovernanceErrorResponse |
| 409 | Just-in-time provisioning conflicted: the verified email belongs to another provisioned account. | application/json HttpErrorResponse or GovernanceErrorResponse |
| 422 | A verified email is unavailable for account provisioning. | application/json HttpErrorResponse or GovernanceErrorResponse |
| 429 | The API key’s own request rate limit was exceeded (API_KEY_RATE_LIMITED). Only keys configured with a rate limit can receive this. Retryable after Retry-After seconds; the refused request consumed no capacity. |
application/json ErrorResponse |
| 503 | Credential verification is unavailable: Clerk session verification is not configured, no API-key pepper is enrolled, or bounded API-key verification is temporarily overloaded. Retryable. | application/json HttpErrorResponse or GovernanceErrorResponse |
GET /v1/governance/deletions
Section titled “GET /v1/governance/deletions”Operation ID: listGovernanceDeletions
List a stable tenant-owned page of governance deletion requests.
Authentication: Authorization: Bearer <API key or console session> (Authentication).
Parameters
Section titled “Parameters”| Name | In | Type | Required | Description |
|---|---|---|---|---|
status |
query | enum or null | no | |
cursor |
query | string or null | no | |
limit |
query | integer | no | Minimum 1. Maximum 100. Default 50. |
Responses
Section titled “Responses”| Status | Description | Body |
|---|---|---|
| 200 | Successful Response | application/json DeletionPageResponse |
| 401 | The bearer credential is missing, malformed, expired, revoked, or otherwise invalid. Clerk sessions and scoped API keys fail identically and the body never reveals which credential was presented or whether it exists. | application/json HttpErrorResponse |
| 403 | The provider deleted this identity, or the account is deactivated. A valid session cannot authorize a tombstoned identity back into use; an API key must also grant the scope required by the operation, and an operation is not classified by the route/scope policy and is denied by default. An API key restricted to client networks is refused from any other network with the API_KEY_IP_NOT_ALLOWED envelope. |
application/json HttpErrorResponse or GovernanceErrorResponse or ErrorResponse |
| 404 | Not Found | application/json GovernanceErrorResponse |
| 409 | Just-in-time provisioning conflicted: the verified email belongs to another provisioned account. | application/json HttpErrorResponse or GovernanceErrorResponse |
| 422 | A verified email is unavailable for account provisioning. | application/json HttpErrorResponse or GovernanceErrorResponse |
| 429 | The API key’s own request rate limit was exceeded (API_KEY_RATE_LIMITED). Only keys configured with a rate limit can receive this. Retryable after Retry-After seconds; the refused request consumed no capacity. |
application/json ErrorResponse |
| 503 | Credential verification is unavailable: Clerk session verification is not configured, no API-key pepper is enrolled, or bounded API-key verification is temporarily overloaded. Retryable. | application/json HttpErrorResponse or GovernanceErrorResponse |
200 response fields
Section titled “200 response fields”| Field | Type | Required | Description |
|---|---|---|---|
items |
array of DeletionResponse | yes | |
next_cursor |
string or null | yes |
POST /v1/governance/deletions
Section titled “POST /v1/governance/deletions”Operation ID: createGovernanceDeletion
Request account- or asset-scoped governance deletion.
Authentication: Authorization: Bearer <API key or console session> (Authentication).
Parameters
Section titled “Parameters”| Name | In | Type | Required | Description |
|---|---|---|---|---|
Idempotency-Key |
header | string | yes | Pattern: ^[!-~]+$. Max length 200. |
Request body
Section titled “Request body”application/json: DeletionRequestBody (required)
| Field | Type | Required | Description |
|---|---|---|---|
asset_id |
string or null | no | |
creator_id |
string or null | no | |
scope |
enum | yes | One of: asset, user_data, creator_identity. |
Responses
Section titled “Responses”| Status | Description | Body |
|---|---|---|
| 202 | Successful Response | application/json DeletionResponse |
| 401 | The bearer credential is missing, malformed, expired, revoked, or otherwise invalid. Clerk sessions and scoped API keys fail identically and the body never reveals which credential was presented or whether it exists. | application/json HttpErrorResponse |
| 403 | The provider deleted this identity, or the account is deactivated. A valid session cannot authorize a tombstoned identity back into use; an API key must also grant the scope required by the operation, and an operation is not classified by the route/scope policy and is denied by default. An API key restricted to client networks is refused from any other network with the API_KEY_IP_NOT_ALLOWED envelope. |
application/json HttpErrorResponse or GovernanceErrorResponse or ErrorResponse |
| 404 | Not Found | application/json GovernanceErrorResponse |
| 409 | Just-in-time provisioning conflicted: the verified email belongs to another provisioned account. | application/json HttpErrorResponse or GovernanceErrorResponse |
| 422 | A verified email is unavailable for account provisioning. | application/json HttpErrorResponse or GovernanceErrorResponse |
| 429 | The API key’s own request rate limit was exceeded (API_KEY_RATE_LIMITED). Only keys configured with a rate limit can receive this. Retryable after Retry-After seconds; the refused request consumed no capacity. |
application/json ErrorResponse |
| 503 | Credential verification is unavailable: Clerk session verification is not configured, no API-key pepper is enrolled, or bounded API-key verification is temporarily overloaded. Retryable. | application/json HttpErrorResponse or GovernanceErrorResponse |
202 response fields
Section titled “202 response fields”| Field | Type | Required | Description |
|---|---|---|---|
asset_id |
string or null | no | |
completed_at |
string or null | no | |
created_at |
string or null | no | |
deletion_request_id |
string | yes | |
scope |
string or null | no | |
status |
string or null | no |
GET /v1/governance/deletions/{deletion_id}
Section titled “GET /v1/governance/deletions/{deletion_id}”Operation ID: getGovernanceDeletion
Read one tenant-owned deletion workflow.
Authentication: Authorization: Bearer <API key or console session> (Authentication).
Parameters
Section titled “Parameters”| Name | In | Type | Required | Description |
|---|---|---|---|---|
deletion_id |
path | string | yes | Pattern: ^del_[a-z2-7]{16}$. |
Responses
Section titled “Responses”| Status | Description | Body |
|---|---|---|
| 200 | Successful Response | application/json DeletionResponse |
| 401 | The bearer credential is missing, malformed, expired, revoked, or otherwise invalid. Clerk sessions and scoped API keys fail identically and the body never reveals which credential was presented or whether it exists. | application/json HttpErrorResponse |
| 403 | The provider deleted this identity, or the account is deactivated. A valid session cannot authorize a tombstoned identity back into use; an API key must also grant the scope required by the operation, and an operation is not classified by the route/scope policy and is denied by default. An API key restricted to client networks is refused from any other network with the API_KEY_IP_NOT_ALLOWED envelope. |
application/json HttpErrorResponse or GovernanceErrorResponse or ErrorResponse |
| 404 | Not Found | application/json GovernanceErrorResponse |
| 409 | Just-in-time provisioning conflicted: the verified email belongs to another provisioned account. | application/json HttpErrorResponse or GovernanceErrorResponse |
| 422 | A verified email is unavailable for account provisioning. | application/json HttpErrorResponse or GovernanceErrorResponse |
| 429 | The API key’s own request rate limit was exceeded (API_KEY_RATE_LIMITED). Only keys configured with a rate limit can receive this. Retryable after Retry-After seconds; the refused request consumed no capacity. |
application/json ErrorResponse |
| 503 | Credential verification is unavailable: Clerk session verification is not configured, no API-key pepper is enrolled, or bounded API-key verification is temporarily overloaded. Retryable. | application/json HttpErrorResponse or GovernanceErrorResponse |
200 response fields
Section titled “200 response fields”| Field | Type | Required | Description |
|---|---|---|---|
asset_id |
string or null | no | |
completed_at |
string or null | no | |
created_at |
string or null | no | |
deletion_request_id |
string | yes | |
scope |
string or null | no | |
status |
string or null | no |
GET /v1/governance/exports
Section titled “GET /v1/governance/exports”Operation ID: listGovernanceExports
List a stable tenant-owned page of account export metadata.
Authentication: Authorization: Bearer <API key or console session> (Authentication).
Parameters
Section titled “Parameters”| Name | In | Type | Required | Description |
|---|---|---|---|---|
status |
query | enum or null | no | |
cursor |
query | string or null | no | |
limit |
query | integer | no | Minimum 1. Maximum 100. Default 50. |
Responses
Section titled “Responses”| Status | Description | Body |
|---|---|---|
| 200 | Successful Response | application/json ExportPageResponse |
| 401 | The bearer credential is missing, malformed, expired, revoked, or otherwise invalid. Clerk sessions and scoped API keys fail identically and the body never reveals which credential was presented or whether it exists. | application/json HttpErrorResponse |
| 403 | The provider deleted this identity, or the account is deactivated. A valid session cannot authorize a tombstoned identity back into use; an API key must also grant the scope required by the operation, and an operation is not classified by the route/scope policy and is denied by default. An API key restricted to client networks is refused from any other network with the API_KEY_IP_NOT_ALLOWED envelope. |
application/json HttpErrorResponse or GovernanceErrorResponse or ErrorResponse |
| 404 | Not Found | application/json GovernanceErrorResponse |
| 409 | Just-in-time provisioning conflicted: the verified email belongs to another provisioned account. | application/json HttpErrorResponse or GovernanceErrorResponse |
| 422 | A verified email is unavailable for account provisioning. | application/json HttpErrorResponse or GovernanceErrorResponse |
| 429 | The API key’s own request rate limit was exceeded (API_KEY_RATE_LIMITED). Only keys configured with a rate limit can receive this. Retryable after Retry-After seconds; the refused request consumed no capacity. |
application/json ErrorResponse |
| 503 | Credential verification is unavailable: Clerk session verification is not configured, no API-key pepper is enrolled, or bounded API-key verification is temporarily overloaded. Retryable. | application/json HttpErrorResponse or GovernanceErrorResponse |
200 response fields
Section titled “200 response fields”| Field | Type | Required | Description |
|---|---|---|---|
items |
array of ExportMetadataResponse | yes | |
next_cursor |
string or null | yes |
POST /v1/governance/exports
Section titled “POST /v1/governance/exports”Operation ID: createGovernanceExport
Seal an exact-version snapshot for tenant account export.
Authentication: Authorization: Bearer <API key or console session> (Authentication).
Parameters
Section titled “Parameters”| Name | In | Type | Required | Description |
|---|---|---|---|---|
Idempotency-Key |
header | string | yes | Pattern: ^[!-~]+$. Max length 200. |
Responses
Section titled “Responses”| Status | Description | Body |
|---|---|---|
| 202 | Successful Response | application/json ExportResponse |
| 401 | The bearer credential is missing, malformed, expired, revoked, or otherwise invalid. Clerk sessions and scoped API keys fail identically and the body never reveals which credential was presented or whether it exists. | application/json HttpErrorResponse |
| 403 | The provider deleted this identity, or the account is deactivated. A valid session cannot authorize a tombstoned identity back into use; an API key must also grant the scope required by the operation, and an operation is not classified by the route/scope policy and is denied by default. An API key restricted to client networks is refused from any other network with the API_KEY_IP_NOT_ALLOWED envelope. |
application/json HttpErrorResponse or GovernanceErrorResponse or ErrorResponse |
| 404 | Not Found | application/json GovernanceErrorResponse |
| 409 | Just-in-time provisioning conflicted: the verified email belongs to another provisioned account. | application/json HttpErrorResponse or GovernanceErrorResponse |
| 422 | A verified email is unavailable for account provisioning. | application/json HttpErrorResponse or GovernanceErrorResponse |
| 429 | The API key’s own request rate limit was exceeded (API_KEY_RATE_LIMITED). Only keys configured with a rate limit can receive this. Retryable after Retry-After seconds; the refused request consumed no capacity. |
application/json ErrorResponse |
| 503 | Credential verification is unavailable: Clerk session verification is not configured, no API-key pepper is enrolled, or bounded API-key verification is temporarily overloaded. Retryable. | application/json HttpErrorResponse or GovernanceErrorResponse |
202 response fields
Section titled “202 response fields”| Field | Type | Required | Description |
|---|---|---|---|
expires_at |
string | yes | |
export_id |
string | yes | |
filters |
object or null | no | |
item_count |
integer | yes | |
items |
array of ExportItemResponse | no | Default []. |
kind |
string | yes | |
manifest |
object or null | no | |
manifest_sha256 |
string or null | yes | |
status |
string | yes | |
total_bytes |
integer | yes |
GET /v1/governance/exports/{export_id}
Section titled “GET /v1/governance/exports/{export_id}”Operation ID: getGovernanceExport
Deliver integrity-checked exact-version export capabilities.
Authentication: Authorization: Bearer <API key or console session> (Authentication).
Parameters
Section titled “Parameters”| Name | In | Type | Required | Description |
|---|---|---|---|---|
export_id |
path | string | yes | Pattern: ^exp_[a-z2-7]{16}$. |
Responses
Section titled “Responses”| Status | Description | Body |
|---|---|---|
| 200 | Successful Response | application/json ExportResponse |
| 401 | The bearer credential is missing, malformed, expired, revoked, or otherwise invalid. Clerk sessions and scoped API keys fail identically and the body never reveals which credential was presented or whether it exists. | application/json HttpErrorResponse |
| 403 | The provider deleted this identity, or the account is deactivated. A valid session cannot authorize a tombstoned identity back into use; an API key must also grant the scope required by the operation, and an operation is not classified by the route/scope policy and is denied by default. An API key restricted to client networks is refused from any other network with the API_KEY_IP_NOT_ALLOWED envelope. |
application/json HttpErrorResponse or GovernanceErrorResponse or ErrorResponse |
| 404 | Not Found | application/json GovernanceErrorResponse |
| 409 | Just-in-time provisioning conflicted: the verified email belongs to another provisioned account. | application/json HttpErrorResponse or GovernanceErrorResponse |
| 422 | A verified email is unavailable for account provisioning. | application/json HttpErrorResponse or GovernanceErrorResponse |
| 429 | The API key’s own request rate limit was exceeded (API_KEY_RATE_LIMITED). Only keys configured with a rate limit can receive this. Retryable after Retry-After seconds; the refused request consumed no capacity. |
application/json ErrorResponse |
| 503 | Credential verification is unavailable: Clerk session verification is not configured, no API-key pepper is enrolled, or bounded API-key verification is temporarily overloaded. Retryable. | application/json HttpErrorResponse or GovernanceErrorResponse |
200 response fields
Section titled “200 response fields”| Field | Type | Required | Description |
|---|---|---|---|
expires_at |
string | yes | |
export_id |
string | yes | |
filters |
object or null | no | |
item_count |
integer | yes | |
items |
array of ExportItemResponse | no | Default []. |
kind |
string | yes | |
manifest |
object or null | no | |
manifest_sha256 |
string or null | yes | |
status |
string | yes | |
total_bytes |
integer | yes |
GET /v1/governance/legal-holds
Section titled “GET /v1/governance/legal-holds”Operation ID: listGovernanceLegalHolds
List tenant-visible active and released legal holds.
Authentication: Authorization: Bearer <API key or console session> (Authentication).
Responses
Section titled “Responses”| Status | Description | Body |
|---|---|---|
| 200 | Successful Response | application/json array of LegalHoldResponse |
| 401 | The bearer credential is missing, malformed, expired, revoked, or otherwise invalid. Clerk sessions and scoped API keys fail identically and the body never reveals which credential was presented or whether it exists. | application/json HttpErrorResponse |
| 403 | The provider deleted this identity, or the account is deactivated. A valid session cannot authorize a tombstoned identity back into use; an API key must also grant the scope required by the operation, and an operation is not classified by the route/scope policy and is denied by default. An API key restricted to client networks is refused from any other network with the API_KEY_IP_NOT_ALLOWED envelope. |
application/json HttpErrorResponse or GovernanceErrorResponse or ErrorResponse |
| 404 | Not Found | application/json GovernanceErrorResponse |
| 409 | Just-in-time provisioning conflicted: the verified email belongs to another provisioned account. | application/json HttpErrorResponse or GovernanceErrorResponse |
| 422 | A verified email is unavailable for account provisioning. | application/json HttpErrorResponse or GovernanceErrorResponse |
| 429 | The API key’s own request rate limit was exceeded (API_KEY_RATE_LIMITED). Only keys configured with a rate limit can receive this. Retryable after Retry-After seconds; the refused request consumed no capacity. |
application/json ErrorResponse |
| 503 | Credential verification is unavailable: Clerk session verification is not configured, no API-key pepper is enrolled, or bounded API-key verification is temporarily overloaded. Retryable. | application/json HttpErrorResponse or GovernanceErrorResponse |