Get a document purge proof | API reference

Description

Returns the retained signed proof that a document was purged, so a device can verify the deletion before removing its local copy. Only callers who were authorized through the purge-time container path are served it; a 202 asks the client to retry the identical request after policy history is prepared.

Authentication

Requires a signed-in session: the client sends its session token as a bearer token in the Authorization header.

Parameters

Name	In	Type	Details
`documentId`	path	string	required
`documentCheckpointManifestHash`	query	string	optional 1 to 6,500 characters

Responses

200 OK

application/jsonDocumentPurgeProofResponse

The signed proof that a document was purged, with the manifests and policy history a client needs to verify it.

9 fields

authorizingContainerPathlist of AccessManifestBundleWireResponserequired
- at least 1 item
Container path that authorized the purge.
documentContainerManifestHistorylist of AccessManifestBundleWireResponserequired
documentIdstringrequired
- not empty
documentManifestAccessManifestBundleWireResponserequired
The document's last link-set manifest.
documentManifestContainerPathslist of list of AccessManifestBundleWireResponserequired
documentManifestPredecessorslist of AccessManifestBundleWireResponserequired
Earlier link-set manifests of the document.
purgeEventAccessEventBundleWireResponserequired
The signed document.purge event.
purgedAtstringrequired
- not empty
policyEvidenceProjectionPolicyEvidenceResponserequired

Other fields are allowed.

202 The attempted operation rolled back. Retry the identical request to continue verification preparation.

application/jsonPrincipalHistoryPreparationResponse

A 202: the operation rolled back while the server prepares principal history. Retry the identical request.

3 fields

codestringrequired
- always principal_history_preparation_pending
committedbooleanrequired
- always false
progressTokenstringrequired
- exactly 64 characters
- lowercase hexadecimal
Changes when preparation advances; clients stop after three identical tokens in a row.

Other responses

Status	Meaning	Body
400	Bad Request	`application/json`ErrorResponse
401	Unauthorized	`application/json`SessionFailureResponse
402	Payment Required	`application/json`PaymentRequiredErrorResponse
403	Forbidden	`application/json`ErrorResponse
404	Not Found	`application/json`DocumentMutationFailureResponse
409	Conflict	`application/json`DocumentMutationFailureResponse
500	Internal Server Error	`application/json`ErrorResponse
503	Service Unavailable	`application/json`PrincipalHistoryPreparationFailureResponse

Additional rules

The server also enforces these rules, which the schema above cannot express.

A 503 with code principal_history_preparation_unavailable requires committed:false; other 503 responses do not guarantee rollback.