The descriptions of the operations and fields are the contract’s own, in English.
/memory/v1/journalRead the deletion journal head
- Credential
- API key
- Permission
memory.read
Reads the current head of the deletion journal for the owner. An uninitiated journal returns its explicit genesis (sequence 0, the genesis digest).
curl "https://console.eu.ccsio.ai/memory/v1/journal?tenant=<tenant>&project=<project>&journal_id=<journal_id>" \
-H "Authorization: Bearer $CCSIO_API_KEY"Parameters
| Name | In | Description |
|---|---|---|
X-Request-IDoptional | header | string Optional request ULID. A valid ULID (upper or lowercase) is honored; when the header is absent or invalid, the runtime mints the id. The response X-Request-ID header carries the canonical uppercase form. |
tenantrequired | query | string The tenant (c6 identifier). |
projectrequired | query | string The project id (c6 identifier). |
journal_idrequired | query | string The journal id (c6 identifier). |
Responses
- 200
The journal head.
Schema
MemoryHeadResponseheadobjectrequiredA {journalId, sequence, chainDigest} position in the deletion chain. Sequence zero is the explicit genesis, never an absent digest.
journal_idstringrequiredpattern ^[a-z][a-z0-9._-]{0,127}$
sequenceintegerrequiredat least 0
chain_digeststringrequiredpattern ^sha256:[0-9a-f]{64}$
- 400
Client refusal unrelated to authentication, including malformed input, a denied or failed request.
- 401
The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:
Read more
Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled
- 402
The organization has to pay first: its standing is payment_required.
Read more
The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required
- 403
The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.
Read more
Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)
- 405
The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.
- 500
Platform failure, rendered without internal cause details.
/memory/v1/journal/pageRead a deletion journal page
- Credential
- API key
- Permission
memory.read
Reads a contiguous page of journal entries after the given sequence, at most limit (1..256). The page anchors at the owner's own predecessor at sequence = after (genesis when after = 0) and validates the span as contiguous from that anchor.
Read more
The 200 is reachable: a real, API-generated journal chain (for example the owner-scoped entry a successful erase appends) renders 200 with a non-empty page, and the empty page at genesis renders 200 with null Entries. A chain that fails digest verification — a corrupted or forged row — renders 400 journal-invalid, the invalid-journal closure (fail-closed); a foreign owner or a missing checkpoint renders the owner's own empty genesis page without disclosure.
curl "https://console.eu.ccsio.ai/memory/v1/journal/page?tenant=<tenant>&project=<project>&journal_id=<journal_id>&after=<after>&limit=<limit>" \
-H "Authorization: Bearer $CCSIO_API_KEY"Parameters
| Name | In | Description |
|---|---|---|
X-Request-IDoptional | header | string Optional request ULID. A valid ULID (upper or lowercase) is honored; when the header is absent or invalid, the runtime mints the id. The response X-Request-ID header carries the canonical uppercase form. |
tenantrequired | query | string The tenant (c6 identifier). |
projectrequired | query | string The project id (c6 identifier). |
journal_idrequired | query | string The journal id (c6 identifier). |
afterrequired | query | integer The sequence cursor to read after (non-negative integer). |
limitrequired | query | integer The page size (1..256). |
Responses
- 200
The journal page.
Schema
MemoryPageResponsejournalobjectrequiredOne page of the deletion journal: the owner, the journal id, the prior head the page continues from, the current head the page reaches, and the contiguous entries between them. PascalCase (untagged domain.Journal).
OwnerobjectrequiredThe erasure owner: exactly {tenantId, projectId}. PascalCase — the untagged domain.ErasureOwner renders as {Tenant, Project}.
Tenantstringrequiredpattern ^[a-z][a-z0-9._-]{0,127}$
Projectstringrequiredpattern ^[a-z][a-z0-9._-]{0,127}$
JournalIDstringrequiredpattern ^[a-z][a-z0-9._-]{0,127}$
FromobjectrequiredA {JournalID, Sequence, ChainDigest} position in the deletion chain as the untagged domain.JournalHead renders on the wire (the erase's journal_head and the page's From/Head). Sequence zero is the explicit genesis.
JournalIDstringrequiredpattern ^[a-z][a-z0-9._-]{0,127}$
Sequenceintegerrequiredat least 0
ChainDigeststringrequiredpattern ^sha256:[0-9a-f]{64}$
HeadobjectrequiredA {JournalID, Sequence, ChainDigest} position in the deletion chain as the untagged domain.JournalHead renders on the wire (the erase's journal_head and the page's From/Head). Sequence zero is the explicit genesis.
JournalIDstringrequiredpattern ^[a-z][a-z0-9._-]{0,127}$
Sequenceintegerrequiredat least 0
ChainDigeststringrequiredpattern ^sha256:[0-9a-f]{64}$
Entriesarray of MemoryJournalEntry or nullrequiredSequenceintegerrequiredat least 1
DispatchMemoryErasureDispatchrequiredThe context-erasure-dispatch/v1 command as rendered on the wire (the page's journal entries). operationId embeds the preimage digest and tombstone_digest is its sha256 — the integrity pin that keeps a dispatch unforgeable. PascalCase (untagged domain.ErasureDispatch).
PreviousDigeststringrequiredpattern ^sha256:[0-9a-f]{64}$
ChainDigeststringrequiredpattern ^sha256:[0-9a-f]{64}$
- 400
Client refusal unrelated to authentication, including malformed input, a denied or failed request.
- 401
The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:
Read more
Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled
- 402
The organization has to pay first: its standing is payment_required.
Read more
The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required
- 403
The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.
Read more
Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)
- 405
The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.
- 500
Platform failure, rendered without internal cause details.
Generated from the platform contracts at commit 5f833620.