Discard draft version
Policies
Discard draft version
Hard-deletes an in-flight draft version authored by the caller. Returns 409 if the version is not a draft (submitted requires recall first); 404 if not found for the caller's tenant. PWB-039: a tenant ADMIN human session may also discard a draft it did not author when that draft is bound to an authoring capability (an agent's pre-minted shell). That discard is SOFT (status becomes discarded; the row is kept because signed capability records reference it), EXHAUSTS every capability bound to it (the carrier key is not poisoned and may receive a new capability), reopens issuance on the policy, and requires a body { "reason": string } recorded in the audit chain. An API key never takes this path. PWB-045: the same admin session may discard a key-authored draft bound to NO capability when the author key can no longer act — the key is revoked or inactive, or its capability records fail verification. Nothing is exhausted (nothing is bound), and the audit row records discard_mode=unbound_dead_author, the reason, the author key ids and the empty exhausted list. A draft whose author key is still live is refused: the author clears their own draft.
DELETE
Discard draft version
Authorizations
MeshQu API key passed as a bearer token: Authorization: Bearer mqu_…. Mint one in the console (Settings → API keys).
Tenant UUID for multi-tenant isolation. Required on all authenticated routes — validated before authentication (middleware/tenant.ts), so a missing or non-UUID header returns 400 (MISSING_TENANT_ID / INVALID_TENANT_ID) before the API key is checked.
Body
application/json
Required string length:
1 - 500Response
Default Response