Users & agents

Erase a user

Permanently erase every memory and fact scoped to one end user in a single call. This is the GDPR Article 17 endpoint, and it leaves an audit row as proof.

DELETE /v1/users/{end_user}/memories

SDK: korely.delete_all(user_id=end_user). Use it when one of your customers asks you to erase their data.

This is a physical delete. The rows are removed from the database, and the content cannot be read back by any parameter, include_invalidated included. It is unrecoverable by design, because that is what erasure means.

One audit row survives, carrying the counts and your own end_user_id but none of the erased content, so you can evidence the erasure to your own regulator (Article 5(2) accountability).

Looking for a reversible drop-from-reads on a single item instead? Use DELETE /v1/memories/{memory_id}, which soft-forgets one memory and says so.

Authentication

HTTP header, required: Authorization: Bearer kor_live_.... The key must carry the memories:write scope.

Path parameter

Parameter	Type	Description
`end_user`	string	The end-user namespace to erase. Every memory and fact scoped to this value is deleted. An unknown or empty `end_user` is not an error, it returns `200` with zero counts.

This endpoint takes no query parameters and no request body.

Example request

curl -X DELETE https://api.korely.ai/v1/users/customer-giulia-4812/memories \
  -H "Authorization: Bearer kor_live_..."

from korely_memory import Korely

korely = Korely(api_key="kor_live_...", region="eu")

result = korely.delete_all(user_id="customer-giulia-4812")

print(result.memories_forgotten)  # 14
print(result.facts_invalidated)   # 31
print(result.audit_id)            # "aud_7b1c20"

import { Korely } from "korely-memory";

const korely = new Korely({ apiKey: "kor_live_..." });

const result = await korely.deleteAll({ user_id: "customer-giulia-4812" });

console.log(result.memories_forgotten); // 14
console.log(result.facts_invalidated);  // 31
console.log(result.audit_id);           // "aud_7b1c20"

Response

200 OK. The end-user namespace that was forgotten, the counts of what was invalidated, and the id of the audit row.

{
  "user_id": "customer-giulia-4812",
  "memories_forgotten": 14,
  "facts_invalidated": 31,
  "audit_id": "aud_7b1c20"
}

Field	Type	Description
`user_id`	string	The end-user namespace that was forgotten (echoes the path param).
`memories_forgotten`	integer	Count of memories soft-deleted (`deleted_at` set).
`facts_invalidated`	integer	Count of active facts invalidated (`invalid_at` set).
`audit_id`	string	Public id of the audit row, with `scope='user'`.

Errors

Status	Code	Cause
`401`	`invalid_key`	Missing or invalid `kor_live_` key, `Invalid or missing API key`.
`403`	`forbidden`	The key lacks the `memories:write` scope, `API key missing required scope(s): memories:write`.
`429`	`rate_limit_exceeded`	Rate limit exceeded. The response carries a `Retry-After` header.

Notes

Write scope required. The key must carry memories:write.
Soft delete, audited. Rows are kept but invalidated and soft-deleted, so they drop out of default reads. This is distinct from DELETE /v1/agents/{id}, which hard-purges an agent.
No 404. Forgetting an unknown or empty end_user returns 200 with zero counts, and still writes an audit row.
One audit row. Each call writes exactly one audit row with scope='user'.

Forget a user, guide, the narrative walkthrough with context.
List users, see which end users have memories.
Add a memory, the write path that creates them.