Delete all of the visitor's own conversations
Permanently delete every conversation belonging to the calling visitor, with their transcripts. Intended for a widget’s “clear my history” control and for host-site privacy-erasure hooks. Pass targetId to delete only the conversations a target-scoped UI actually listed; OMITTING it deliberately means every conversation in the authorized visitor scope, across all targets. Every response carries X-History-Identity-Status (not_provided | admitted | ignored) reporting what the server did with a supplied X-Identity-Proof, so a widget can tell a verified action from a browser-scoped one. It is exposed via CORS; it grants no authority.
Headers
The browser’s anonymous visitor secret (cvt_…) returned by /client/init. It is what scopes the request to one visitor’s own conversations, so a request without it is refused. Sent as a header so it never lands in access logs or Referer.
Optional fresh hosted end-user identity proof. When admitted and already bound to the presented visitor, expands the request from this exact browser to sibling visitors for the same verified person. Without it, even a previously bound visitor remains exact-browser scoped.
Query parameters
Client session id from /client/init.
Deprecated alias of targetId. Sending both with different values is rejected 400; sending both with the same value is accepted.
Response
Deleted. deleted counts the rows removed and is 0 when the visitor had no history in scope.
Number of conversations deleted. The delete-all route returns 0 when the visitor has no history, rather than an error.