Skip to main content
API reference
DocumentationMemory · console.latam.ccsio.ai

Memory entries

Store, query and read memory entries, promote an entry, and erase it.

Documentation menu

The descriptions of the operations and fields are the contract’s own, in English.

GET/memory/v1/entries

Query visible memory facts

Credential
API key
Permission
memory.read

Lists the entries the query context sees, filtered by the optional resource and state and bounded by the limit. Visibility is the scope-lattice rule: an entry is visible iff the query is in its tenant and carries the subject identity of its scope kind.

curl
curl "https://console.latam.ccsio.ai/memory/v1/entries" \
  -H "Authorization: Bearer $CCSIO_API_KEY"

Parameters

NameInDescription
X-Request-ID
optional
headerstring

Optional request ULID. A valid ULID (upper or lowercase) is honored; when the header is absent or invalid, the runtime mints the id. The response X-Request-ID header carries the canonical uppercase form.

X-Tenant
required
headerstring

The tenancy principal (c6 identifier). Direct-seam mount: required and read from this header (absent is 400 invalid-request; a pattern miss is 400 ref-invalid). Production control-role mount: the verified principal is authoritative for tenancy and this header is not read for it (a tenant conflict is refused 403 at the authz boundary before the handler). The credential is the document's security scheme (BearerAuth or ApiKeyAuth); this header is not a credential.

X-User
optional
headerstring

The user subject the query carries at the user scope level (c6 identifier).

X-Team
optional
headerstring

The team subject the query carries at the team scope level (c6 identifier).

X-Agent
optional
headerstring

The agent subject the query carries at the agent scope level (c6 identifier).

X-Session
optional
headerstring

The session subject the query carries at the session scope level (c6 identifier).

X-Project
optional
headerstring

The project subject the query carries at the project scope level (c6 identifier).

resource_id
optional
querystring

Filter by resource id (c6 identifier).

resource_version
optional
querystring

Filter by resource version (c6 version).

state
optional
querystring

Filter by entry state. The value is a raw string, not a closed set: an unknown value matches no stored entry and returns 200 {"entries": []}, never 400.

limit
optional
queryinteger

The maximum number of entries to return. Digits only; absent or 0 is unbounded, with no upper bound.

Responses

  • 200

    The visible entries.

    Schema
    MemoryQueryResponse
    • entriesarray of MemoryEntryViewrequired
      • tenantstringrequired

        pattern ^[a-z][a-z0-9._-]{0,127}$

      • resource_refstringrequired

        The resource reference as '<id>.<version>'.

      • fact_idstringrequired

        pattern ^[a-z][a-z0-9._-]{0,127}$

      • scope_kindstringrequired

        pattern ^[a-z][a-z0-9._-]{0,127}$

      • scope_subjectstringrequired

        pattern ^[a-z][a-z0-9._-]{0,127}$

      • statestringrequired

        The stored entry state, rendered verbatim. Deliberately not contract-pinned to a closed set: the runtime renders whatever state the row carries, including a value outside {proposed, active, erased} on a corrupted row.

      • revisionintegerrequired

        at least 0

      • created_atstring (utc-second)required

        pattern ^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$

      • erased_atstring (utc-second)optional

        The erase time, present only for tombstones (erased entries) and absent otherwise. The runtime renders no null (omitempty).

        pattern ^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$

  • 400

    Client refusal unrelated to authentication, including malformed input, a denied or failed request.

  • 401

    The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

    Read more

    Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

  • 402

    The organization has to pay first: its standing is payment_required.

    Read more

    The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

  • 403

    The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

    Read more

    Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

  • 405

    The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

  • 500

    Platform failure, rendered without internal cause details.

POST/memory/v1/entries

Store one memory fact

Credential
API key
Permission
memory.manage
Request body
Body up to 1 MiB

Stores one experienced fact under a memory resource. Idempotent on (tenant, resource, fact) plus full content: a repeat returns the stored entry; the same key with different content is 400 entry-conflict. Under ZCR the store is a no-op success (persisted=false, no row, no event). An invalid fact_id renders ref-invalid (the domain wraps ErrInvalidRef). The request body is capped at 1048576 bytes; over-cap is 400 invalid-request, never 413.

curl
curl -X POST "https://console.latam.ccsio.ai/memory/v1/entries" \
  -H "Authorization: Bearer $CCSIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "tenant": "string",
  "resource_id": "string",
  "resource_version": "string",
  "fact_id": "string",
  "scope_kind": "string",
  "scope_subject": "string",
  "payload": "string",
  "created_at": "2026-10-01T00:00:00Z"
}'
Built from the schema’s required members: replace the values.

Parameters

NameInDescription
X-Request-ID
optional
headerstring

Optional request ULID. A valid ULID (upper or lowercase) is honored; when the header is absent or invalid, the runtime mints the id. The response X-Request-ID header carries the canonical uppercase form.

Request body application/json

MemoryStoreRequest
  • tenantstringrequired

    pattern ^[a-z][a-z0-9._-]{0,127}$

  • resource_idstringrequired

    pattern ^[a-z][a-z0-9._-]{0,127}$

  • resource_versionstringrequired

    pattern ^(0|[1-9][0-9]{0,5})\.(0|[1-9][0-9]{0,5})\.(0|[1-9][0-9]{0,5})$

  • fact_idstringrequired

    pattern ^[a-z][a-z0-9._-]{0,127}$

  • scope_kindstringrequired

    pattern ^[a-z][a-z0-9._-]{0,127}$

  • scope_subjectstringrequired

    pattern ^[a-z][a-z0-9._-]{0,127}$

  • contentobjectoptional

    The c6 content reference profile: the schema const, the resource it names, the revision, the readiness flag, and at most 128 chunks. No text — the experienced text is the entry payload. camelCase per contracts/c6/v1/content.schema.json.

    • schemaVersionanyoptional

      always "c6/v1"

    • resourceRefobjectrequired
      • idstringrequired

        pattern ^[a-z][a-z0-9._-]{0,127}$

      • versionstringrequired

        pattern ^(0|[1-9][0-9]{0,5})\.(0|[1-9][0-9]{0,5})\.(0|[1-9][0-9]{0,5})$

    • revisionintegerrequired

      1 to 9007199254740991

    • readybooleanrequired
    • chunksarray of MemoryChunkoptional

      at most 128 items

      • refMemoryResourceRefViewrequired
      • citationRefMemoryResourceRefViewrequired
      • sourceRefMemoryResourceRefViewrequired
      • classificationstringrequired

        Allowed values: "public""internal""restricted"

  • retentionobjectoptional

    An entry's explicit retention: a behavior, and for a ttl a deadline (strictly after creation).

    • behaviorstringrequired

      Allowed values: "retain""ttl"

    • untilstring (utc-second)optional

      pattern ^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$

  • payloadstringrequired

    The experienced text, base64-encoded (standard encoding).

  • created_atstring (date-time)required

    RFC 3339; decoded to UTC and truncated to the second.

Responses

  • 200

    The stored entry (or the ZCR no-op).

    Schema
    MemoryStoreResponse

    The store outcome: whether a row was persisted (false under ZCR), the entry view, and the outbox event id (empty when suppressed).

  • 400

    Client refusal unrelated to authentication, including malformed input, a denied or failed request.

  • 401

    The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

    Read more

    Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

  • 402

    The organization has to pay first: its standing is payment_required.

    Read more

    The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

  • 403

    The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

    Read more

    Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

  • 405

    The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

  • 500

    Platform failure, rendered without internal cause details.

GET/memory/v1/entries/{fact}

Read one memory fact

Credential
API key
Permission
memory.read

Reads one entry by its fact id and resource. An unknown entry is 404 entry-not-found.

curl
curl "https://console.latam.ccsio.ai/memory/v1/entries/{fact}?resource_id=<resource_id>&resource_version=<resource_version>" \
  -H "Authorization: Bearer $CCSIO_API_KEY"

Parameters

NameInDescription
X-Request-ID
optional
headerstring

Optional request ULID. A valid ULID (upper or lowercase) is honored; when the header is absent or invalid, the runtime mints the id. The response X-Request-ID header carries the canonical uppercase form.

fact
required
pathstring

The fact id path segment. It is free-form and not pattern-validated by the runtime: a value outside the c6 identifier pattern is looked up as-is and, if no entry matches, renders 404 entry-not-found, never 400.

X-Tenant
required
headerstring

The tenancy principal (c6 identifier). Direct-seam mount: required and read from this header (absent is 400 invalid-request; a pattern miss is 400 ref-invalid). Production control-role mount: the verified principal is authoritative for tenancy and this header is not read for it (a tenant conflict is refused 403 at the authz boundary before the handler). The credential is the document's security scheme (BearerAuth or ApiKeyAuth); this header is not a credential.

X-User
optional
headerstring

The user subject the query carries at the user scope level (c6 identifier).

X-Team
optional
headerstring

The team subject the query carries at the team scope level (c6 identifier).

X-Agent
optional
headerstring

The agent subject the query carries at the agent scope level (c6 identifier).

X-Session
optional
headerstring

The session subject the query carries at the session scope level (c6 identifier).

X-Project
optional
headerstring

The project subject the query carries at the project scope level (c6 identifier).

resource_id
required
querystring

The resource id (c6 identifier) the get and promote ops bind a specific resource by. Required here — distinct from the query-entries optional filter of the same wire name: the required flag is part of the component, so the two roles cannot share one.

resource_version
required
querystring

The resource version (c6 version) the get and promote ops bind a specific resource by. Required here — distinct from the query-entries optional filter.

Responses

  • 200

    The entry view.

    Schema
    MemoryEntryView
    • tenantstringrequired

      pattern ^[a-z][a-z0-9._-]{0,127}$

    • resource_refstringrequired

      The resource reference as '<id>.<version>'.

    • fact_idstringrequired

      pattern ^[a-z][a-z0-9._-]{0,127}$

    • scope_kindstringrequired

      pattern ^[a-z][a-z0-9._-]{0,127}$

    • scope_subjectstringrequired

      pattern ^[a-z][a-z0-9._-]{0,127}$

    • statestringrequired

      The stored entry state, rendered verbatim. Deliberately not contract-pinned to a closed set: the runtime renders whatever state the row carries, including a value outside {proposed, active, erased} on a corrupted row.

    • revisionintegerrequired

      at least 0

    • created_atstring (utc-second)required

      pattern ^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$

    • erased_atstring (utc-second)optional

      The erase time, present only for tombstones (erased entries) and absent otherwise. The runtime renders no null (omitempty).

      pattern ^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$

  • 400

    Client refusal unrelated to authentication, including malformed input, a denied or failed request.

  • 401

    The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

    Read more

    Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

  • 402

    The organization has to pay first: its standing is payment_required.

    Read more

    The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

  • 403

    The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

    Read more

    Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

  • 404

    The requested resource or path was not found.

  • 405

    The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

  • 500

    Platform failure, rendered without internal cause details.

POST/memory/v1/entries/{fact}/promote

Promote a proposed entry to active

Credential
API key
Permission
memory.manage

Moves a PROPOSED entry to ACTIVE (the consented-append / governed-update path).

Read more

Declared-vs-reachable: the 200 is reachable only as the idempotent already_active duplicate of a pre-stored ACTIVE entry (already_active=true, no event); its state-changing form is currently unreachable, and so is a genuine PROPOSED-to-ACTIVE transition — the surviving runtime defect (the pg SaveEntry reports key existence before the state save; the erase side of the same existence report is resolved), recorded for a separate follow-up change, promote-only. The reachable outcomes today are promote of an existing PROPOSED entry (400 entry-exists), of an ERASED entry (400 entry-erased), or of a corrupted-state row (400 entry-illegal-transition). An unknown entry is 404 entry-not-found.

curl
curl -X POST "https://console.latam.ccsio.ai/memory/v1/entries/{fact}/promote?resource_id=<resource_id>&resource_version=<resource_version>" \
  -H "Authorization: Bearer $CCSIO_API_KEY"

Parameters

NameInDescription
X-Request-ID
optional
headerstring

Optional request ULID. A valid ULID (upper or lowercase) is honored; when the header is absent or invalid, the runtime mints the id. The response X-Request-ID header carries the canonical uppercase form.

fact
required
pathstring

The fact id path segment. It is free-form and not pattern-validated by the runtime: a value outside the c6 identifier pattern is looked up as-is and, if no entry matches, renders 404 entry-not-found, never 400.

X-Tenant
required
headerstring

The tenancy principal (c6 identifier). Direct-seam mount: required and read from this header (absent is 400 invalid-request; a pattern miss is 400 ref-invalid). Production control-role mount: the verified principal is authoritative for tenancy and this header is not read for it (a tenant conflict is refused 403 at the authz boundary before the handler). The credential is the document's security scheme (BearerAuth or ApiKeyAuth); this header is not a credential.

X-User
optional
headerstring

The user subject the query carries at the user scope level (c6 identifier).

X-Team
optional
headerstring

The team subject the query carries at the team scope level (c6 identifier).

X-Agent
optional
headerstring

The agent subject the query carries at the agent scope level (c6 identifier).

X-Session
optional
headerstring

The session subject the query carries at the session scope level (c6 identifier).

X-Project
optional
headerstring

The project subject the query carries at the project scope level (c6 identifier).

resource_id
required
querystring

The resource id (c6 identifier) the get and promote ops bind a specific resource by. Required here — distinct from the query-entries optional filter of the same wire name: the required flag is part of the component, so the two roles cannot share one.

resource_version
required
querystring

The resource version (c6 version) the get and promote ops bind a specific resource by. Required here — distinct from the query-entries optional filter.

Responses

  • 200

    The entry after the promote.

    Schema
    MemoryPromoteResponse
    • entryobjectrequired

      The wire projection of a stored entry. resource_ref renders as '<id>.<version>'; times are UTC second precision.

      • tenantstringrequired

        pattern ^[a-z][a-z0-9._-]{0,127}$

      • resource_refstringrequired

        The resource reference as '<id>.<version>'.

      • fact_idstringrequired

        pattern ^[a-z][a-z0-9._-]{0,127}$

      • scope_kindstringrequired

        pattern ^[a-z][a-z0-9._-]{0,127}$

      • scope_subjectstringrequired

        pattern ^[a-z][a-z0-9._-]{0,127}$

      • statestringrequired

        The stored entry state, rendered verbatim. Deliberately not contract-pinned to a closed set: the runtime renders whatever state the row carries, including a value outside {proposed, active, erased} on a corrupted row.

      • revisionintegerrequired

        at least 0

      • created_atstring (utc-second)required

        pattern ^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$

      • erased_atstring (utc-second)optional

        The erase time, present only for tombstones (erased entries) and absent otherwise. The runtime renders no null (omitempty).

        pattern ^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$

    • event_idstringrequired
    • already_activebooleanrequired
  • 400

    Client refusal unrelated to authentication, including malformed input, a denied or failed request.

  • 401

    The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

    Read more

    Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

  • 402

    The organization has to pay first: its standing is payment_required.

    Read more

    The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

  • 403

    The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

    Read more

    Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

  • 404

    The requested resource or path was not found.

  • 405

    The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

  • 500

    Platform failure, rendered without internal cause details.

POST/memory/v1/entries/erase

Erase a memory fact (terminal)

Credential
API key
Permission
memory.manage
Request body
Body up to 1 MiB

Erases an entry to the terminal erased tombstone, purging the payload bytes while preserving the row's metadata and retention, and appends the validated dispatch to the deletion journal. The dispatch's operationId is the idempotency key.

Read more

The 200 is reachable: erasing an existing PROPOSED or ACTIVE entry renders 200 with state "erased", a non-empty event_id, and the owner-scoped journal_head (the dispatching owner's own head — an independent sequence space per (tenant, project) under the shared journal id); the zero-trust tenant/project checks remain authoritative — the dispatch owner must match the journal tenant and the entry's project, and a mismatch is 400 dispatch-invalid before any side effect. Erasing an ERASED entry is 400 entry-erased (the tombstone never moves again); erasing a corrupted-state row is 400 entry-illegal-transition. An unknown entry is 404 entry-not-found. A GET to this path is claimed by the {fact} wildcard and answers 400 (missing resource query parameters), never 405. The request body is capped at 1048576 bytes; over-cap is 400 invalid-request, never 413. The dispatch is a JSON string decoded as the untagged domain.ErasureDispatch, which renders PascalCase on the wire; the canonical camelCase fixture (contracts/context-erasure/v1/fixtures/memory-dispatch.json) does not conform to that spelling — posting it verbatim is rejected (400 dispatch-invalid): its camelCase fields decode case-insensitively but the owner object (tenantId/projectId) does not match the wire's PascalCase owner (Tenant/Project), so the recomputed tombstone digest fails to verify. The recorded defect is the fixture's camelCase spelling, not the wire.

curl
curl -X POST "https://console.latam.ccsio.ai/memory/v1/entries/erase" \
  -H "Authorization: Bearer $CCSIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "tenant": "string",
  "resource_id": "string",
  "resource_version": "string",
  "fact_id": "string",
  "dispatch": "string"
}'
Built from the schema’s required members: replace the values.

Parameters

NameInDescription
X-Request-ID
optional
headerstring

Optional request ULID. A valid ULID (upper or lowercase) is honored; when the header is absent or invalid, the runtime mints the id. The response X-Request-ID header carries the canonical uppercase form.

Request body application/json

MemoryEraseRequest
  • tenantstringrequired

    pattern ^[a-z][a-z0-9._-]{0,127}$

  • resource_idstringrequired

    pattern ^[a-z][a-z0-9._-]{0,127}$

  • resource_versionstringrequired

    pattern ^(0|[1-9][0-9]{0,5})\.(0|[1-9][0-9]{0,5})\.(0|[1-9][0-9]{0,5})$

  • fact_idstringrequired

    pattern ^[a-z][a-z0-9._-]{0,127}$

  • dispatchstringrequired

    The context-erasure-dispatch/v1 command, JSON-encoded as a string.

Responses

  • 200

    The erased entry and the journal head reached.

    Schema
    MemoryEraseResponse
    • entryobjectrequired

      The wire projection of a stored entry. resource_ref renders as '<id>.<version>'; times are UTC second precision.

      • tenantstringrequired

        pattern ^[a-z][a-z0-9._-]{0,127}$

      • resource_refstringrequired

        The resource reference as '<id>.<version>'.

      • fact_idstringrequired

        pattern ^[a-z][a-z0-9._-]{0,127}$

      • scope_kindstringrequired

        pattern ^[a-z][a-z0-9._-]{0,127}$

      • scope_subjectstringrequired

        pattern ^[a-z][a-z0-9._-]{0,127}$

      • statestringrequired

        The stored entry state, rendered verbatim. Deliberately not contract-pinned to a closed set: the runtime renders whatever state the row carries, including a value outside {proposed, active, erased} on a corrupted row.

      • revisionintegerrequired

        at least 0

      • created_atstring (utc-second)required

        pattern ^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$

      • erased_atstring (utc-second)optional

        The erase time, present only for tombstones (erased entries) and absent otherwise. The runtime renders no null (omitempty).

        pattern ^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$

    • journal_headobjectrequired

      A {JournalID, Sequence, ChainDigest} position in the deletion chain as the untagged domain.JournalHead renders on the wire (the erase's journal_head and the page's From/Head). Sequence zero is the explicit genesis.

      • JournalIDstringrequired

        pattern ^[a-z][a-z0-9._-]{0,127}$

      • Sequenceintegerrequired

        at least 0

      • ChainDigeststringrequired

        pattern ^sha256:[0-9a-f]{64}$

    • event_idstringrequired
  • 400

    Client refusal unrelated to authentication, including malformed input, a denied or failed request.

  • 401

    The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

    Read more

    Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

  • 402

    The organization has to pay first: its standing is payment_required.

    Read more

    The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

  • 403

    The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

    Read more

    Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

  • 404

    The requested resource or path was not found.

  • 405

    The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

  • 500

    Platform failure, rendered without internal cause details.

Generated from the platform contracts at commit 5f833620.

Explore the platform

Get your first API key

Registration is open. Four steps to your first call: create your account, create your organization, create your API key, and start using it.

  1. 01Create your account
  2. 02Create your organization
  3. 03Create your API key
  4. 04Start using it
Create accountTalk to us