Operator - Data Controls

Overview

Data controls provide auditable workspace-level privacy operations over stored traces, eval runs, and related datasets. Exports and deletions return recorded request summaries so an operator can verify what was included or removed.

Requests are evidence

The list returns id, event_id, kind, event_type, status, metadata, occurred_at, and inserted_at. Arguments, deletion boundaries, and result counts are inside metadata; keep the ID for later review.

Retention and targeted deletion differ

A deletion request applies an explicit dataset and older_than_days boundary. The manual purge executes and writes its audit result only when auto_purge_enabled is true; otherwise it returns a skipped result without a purge audit. Neither operation is an undoable preview.

Fleet evidence windows run separately

Workspace settings include location_retention_days (90 default) and work_order_evidence_retention_days (400 default), both limited to positive whole days up to 36,500. They are not gated by auto_purge_enabled, which applies to trace/eval purge. Current robot position and geofence state, terminal work-order summary, and immutable audit history are retained separately. Processed geofence outbox rows have a fixed 14-day window; pending rows are recovered, not purged.

Marketplace evidence is held

A trace bound to a marketplace engagement is the record a dispute over that hiring is settled on. Neither a deletion request nor a retention purge removes it while the engagement is active or the marketplace reports it open or disputed. A settled hire can still be disputed and an unclassified one can still receive its outcome, so those are held for 90 days after the later of the close and the last commercial change; a refunded one is not held. The result reports how many matching traces were kept as held.traces.

How it works

1. Review history first

   Read recent request status and metadata first to avoid duplicate exports or deletions over the same range.

2. Execute through a protected client

   Use /app/workspace only to edit retention and export settings. To create an export or deletion request, or run a purge, call the matching operator route from a same-origin CSRF-aware client. Save the immediate result and verify its counts before closing the privacy request. Read-only GET requests do not need a CSRF token. A mutating operator request needs the browser session cookie and current Phoenix CSRF token supplied by the product UI or another authorized same-origin client; do not substitute bearer authentication.

Examples

These examples are illustrative. Replace the sample values with your own. Keep credentials in environment variables or a secret manager, never in client-side code.

const response = await fetch("/api/v1/operator/data_requests?limit=25", {
  credentials: "same-origin",
  headers: {"Accept": "application/json"}
});
const body = await response.json();
if (!response.ok) throw new Error(`${response.status}: ${body.detail}`);
console.log(body);

Troubleshooting

A deletion count is lower than expected

Recheck dataset eligibility and older_than_days. Audit records are governed separately and are included only where the dataset and include-audit option permit it.

Mutation returns 403

Only owners and admins may use these management paths. An archived workspace is read-only and returns the workspace_archived problem code.

Endpoint reference

Ready to integrate? Open an endpoint for its required permissions, request fields, response format, and status codes. The examples above explain the workflow; these details define each individual request.