purge_expired_plaintext
Bulk-purge your account's plaintext records older than a specified number of days. Preview with dryRun mode first, then get human approval and execute.
Instructions
Bulk-purge your account's plaintext records older than olderThanDays (POST /v1/tier2/plaintext/purge-expired). Consistent with the Terms of Service v2.1 "retainable up to 90 days" (automatic retention); an AI agent can finish "auto-purge plaintext older than 30 days" in one prompt. dryRun=true (the safe default to reach for) returns the count plus 5 sample call_ids; dryRun=false performs the actual UPDATE. Emit-then-UPDATE ordering plus a deterministic idempotencyId (sha1(endpoint+accountId+olderThanDays+cutoff_date)) gives webhook-retry-equivalent semantics. Pro+ plan only (Free gets 403). An actual purge (dryRun=false) requires approvalId — obtain human approval via request_approval (action: 'purge_expired_plaintext') first, because NULLing plaintext is irreversible. Only your own account is purged. Returns (dryRun=true) { dryRun: true, targetCount, cutoffTimestamp, olderThanDays, sampleTargetCallIds }; (dryRun=false) { dryRun: false, purgedCount, cutoffTimestamp, olderThanDays, purgedAt }. Audit: emits tier2.purge_expired_plaintext.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| dryRun | No | true = preview only (zero mutation); false = actual UPDATE. Default false (MCP discipline recommends passing dryRun explicitly) | |
| approvalId | No | Approval id granted via request_approval (apr_ + 32 hex; create with action 'purge_expired_plaintext'). When passed, the server verifies approved + within expiry + action match + unconsumed, and atomically consumes it on the actual purge (1 approval = 1 execution). dryRun only verifies without consuming | |
| olderThanDays | No | Age threshold in days for purging (1-365, default 30; consistent with the Terms of Service v2.1) |