Delete all of the visitor's own conversations

Permanently delete every conversation belonging to the calling visitor, with their transcripts. Intended for a widget's "clear my history" control and for host-site privacy-erasure hooks. Pass `targetId` to delete only the conversations a target-scoped UI actually listed; OMITTING it deliberately means every conversation in the authorized visitor scope, across all targets. Every response carries `X-History-Identity-Status` (`not_provided` | `admitted` | `ignored`) reporting what the server did with a supplied `X-Identity-Proof`, so a widget can tell a verified action from a browser-scoped one. It is exposed via CORS; it grants no authority.

Headers

x-visitor-tokenstringRequired

The browser’s anonymous visitor secret (cvt_…) returned by /client/init. It is what scopes the request to one visitor’s own conversations, so a request without it is refused. Sent as a header so it never lands in access logs or Referer.

x-identity-proofstringOptional1-8192 characters

Optional fresh hosted end-user identity proof. When admitted and already bound to the presented visitor, expands the request from this exact browser to sibling visitors for the same verified person. Without it, even a previously bound visitor remains exact-browser scoped.

Query parameters

sessionIdstringRequired

Client session id from /client/init.

targetIdstringOptional
Only delete conversations for this flow or agent id, matching the list route's filter. Omit to delete the visitor's entire authorized history. A widget showing one target's history should always send this, so "clear my history" cannot remove conversations the visitor was never shown.
flowIdstringOptional

Deprecated alias of targetId. Sending both with different values is rejected 400; sending both with the same value is accepted.

Response

Deleted. deleted counts the rows removed and is 0 when the visitor had no history in scope.

deleteddouble

Number of conversations deleted. The delete-all route returns 0 when the visitor has no history, rather than an error.

Errors

400
Bad Request Error
401
Unauthorized Error
403
Forbidden Error
429
Too Many Requests Error
500
Internal Server Error
503
Service Unavailable Error