Discard draft version
Policies
Discard draft version
Discards an in-flight draft version. A human governance act: only a verified human session may call it. An API key is refused 403 HUMAN_PRINCIPAL_REQUIRED (after the policies:write scope check, which answers 403 FORBIDDEN first), including for a draft it authored. The draft's author hard-deletes it. Returns 409 if the version is not a draft (submitted requires recall first); 404 if not found for the caller's tenant; 403 FORBIDDEN_NOT_AUTHOR for any other caller outside the cases below. A tenant ADMIN human session may also discard a draft it did not author in three cases, each requiring a body { "reason": string } recorded in the audit chain (400 DISCARD_REASON_REQUIRED without one), and each SOFT (status becomes discarded; the row is kept): PWB-039, the draft is bound to an authoring capability (an agent's pre-minted shell): the row is kept because signed capability records reference it, every live capability bound to it is EXHAUSTED (the carrier key is not poisoned and may receive a new capability), and the discard reopens issuance on the policy; PWB-045, the draft is bound to no capability and its author key can no longer act (revoked or inactive, or its capability records fail verification), recorded as discard_mode=unbound_dead_author; or the draft is bound to no capability and the audit chain resolves its author to an API key, live or not, recorded as discard_mode=unbound_key_author. Neither unbound case exhausts anything. An unbound draft whose author neither of those two checks resolves to an API key is treated as human-authored: an admin may not discard it.
DELETE
Discard draft version
Authorizations
MeshQu API key passed as a bearer token: Authorization: Bearer mqu_…. Mint one in the console (Settings → API keys).
Tenant UUID for multi-tenant isolation. Required on all authenticated routes — validated before authentication (middleware/tenant.ts), so a missing or non-UUID header returns 400 (MISSING_TENANT_ID / INVALID_TENANT_ID) before the API key is checked.
Body
application/json
Required string length:
1 - 500Response
Default Response