> ## Documentation Index > Fetch the complete documentation index at: https://docs.get-exo.com/llms.txt > Use this file to discover all available pages before exploring further. # Wipe the sandbox partition > Erase everything the sandbox partition holds. Erase everything the sandbox partition holds. Idempotent. This is the one destructive operation in the family, and it is destructive only by construction: it binds to the reserved sandbox user, and refuses with 409 (deleting nothing) unless that user carries the sandbox provenance marker. It deletes: * every per-subject row in the organization's schema owned by the sandbox user, using exactly the same table set as per-subject erasure so the two can never diverge, and including graph edges touching sandbox nodes; * organization-shared derived rows left pointing at nodes this reset removed, reported as `orphansDeleted`; * the sandbox user's ingest jobs; * the stored files those rows referenced, uploaded imports and export documents, deleted after the database work commits so a failed reset cannot leave rows intact with the uploads already gone. These are not counted in the response. What it does not clean, stated plainly: derived structure that carries no node key, such as organization-wide domain aggregates and clustered pattern tables. Those are shared across the organization with no way to attribute a row to the sandbox, so deleting them would take a real user's cognition with them. Use `POST /v1/purge` with `scope: "org"` for a clean slate. It keeps the sandbox user and its keys, so a test key keeps working against a now-empty partition, which is the point. Re-running on an already-empty sandbox is a no-op that returns zero counts. ## Authorization This route requires the `admin` scope. A missing or invalid credential returns 401 [`authentication_error`](/errors/authentication_error). A valid credential without the scope returns 403 [`permission_denied`](/errors/permission_denied), and the problem body names the exact scope required. ## Headers These are request conventions the contract does not declare as parameters, so they do not appear in the schema tables below. | Header | Applies | What it does | | ----------------- | -------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | | `X-Exo-API-Key` | Required | Your Exo API key, `exo__`. `Authorization: Bearer exo_...` is accepted as an alternate. | | `X-Exo-Subject` | Not applicable | This route is not subject-scoped. | | `Idempotency-Key` | Honoured | Makes a retry safe. The same key with the same body replays the original response instead of acting twice. See [Idempotency](/platform/idempotency). | | `X-Request-Id` | Response | Returned on every response, including `204`s. Quote it in a support request. | ## Success responses | Status | Meaning | | ------ | ------------------- | | `200` | Successful Response | ## Errors | Status | Code | When | | ------ | ------------------------------------------------------ | -------------------------------------------------------------- | | `400` | [`invalid_request`](/errors/invalid_request) | Malformed request, for example an invalid cursor. | | `401` | [`authentication_error`](/errors/authentication_error) | Missing or invalid credentials. | | `403` | [`permission_denied`](/errors/permission_denied) | Missing scope, or an unprovisioned subject selector. | | `404` | [`not_found`](/errors/not_found) | The resource does not exist, or is not visible to this caller. | | `409` | [`conflict`](/errors/conflict) | A conflict with the current state of the resource. | | `422` | [`validation_error`](/errors/validation_error) | The request was understood but failed field validation. | | `429` | [`rate_limit_exceeded`](/errors/rate_limit_exceeded) | Rate limit exceeded. Retry after the Retry-After interval. | | `503` | [`service_degraded`](/errors/service_degraded) | A dependency is temporarily unavailable. Safe to retry. | Beyond the shared statuses, this route can answer with [`idempotency_in_flight`](/errors/idempotency_in_flight), [`idempotency_key_reuse`](/errors/idempotency_key_reuse). Every problem body names its own `code`, and the `type` URI always resolves to the matching page. Every error is an RFC 9457 `application/problem+json` body carrying a stable `code`, a `requestId`, and a `suggestedAction` where Exo has one. See [Errors](/platform/errors). ## Notes * **This is the destructive one in the family**, and it is bounded by construction: it binds to the reserved sandbox user and refuses with 409 unless that user carries the sandbox provenance marker. ## OpenAPI ````yaml openapi.json POST /v1/sandbox/reset openapi: 3.1.0 info: contact: name: Exo url: https://get-exo.com/ description: >- The Exo public developer API: ingest content, retrieve identity-conditioned context, and read the knowledge graph. Authenticate every request with an Exo API key, either as the X-Exo-API-Key header or as Authorization: Bearer exo_... . Errors follow RFC 9457 problem+json with a stable snake_case code on every body. title: Exo API version: 1.0.0 servers: - url: https://api.get-exo.com security: - ApiKeyHeader: [] - BearerAuth: [] tags: - name: retrieve x-group: Retrieval - name: search x-group: Search - name: ingest x-group: Ingestion - name: jobs x-group: Jobs - name: subjects x-group: Subjects - name: recall x-group: Recall - name: graph x-group: Graph - name: insights x-group: Contradictions and proposals - name: condition x-group: Condition - name: brain x-group: Brain - name: sessions x-group: Coding sessions - name: connectors x-group: Connectors - name: events x-group: Events and webhooks - name: meta x-group: Identity - name: keys x-group: Keys and sandbox - name: usage x-group: Usage - name: settings x-group: Settings - name: exports x-group: Exports - name: team x-group: Team - name: admin x-group: Account and purge paths: /v1/sandbox/reset: post: tags: - keys summary: Wipe the sandbox partition description: >- Erase everything the sandbox partition holds. Admin scope. Idempotent. This is the one destructive operation in the family, and it is destructive ONLY by construction: the single user id it binds comes from ``ensure_sandbox_user``, which refuses (409, nothing deleted) unless the reserved subject carries the sandbox provenance marker. It deletes: - every ``PER_USER_TENANT_TABLES`` row in the org schema owned by that user (imported from the subjects module, so the sandbox wipe and per-subject GDPR erasure can never diverge), each table in its own SAVEPOINT -- including graph edges INCIDENT to sandbox nodes, whose ``user_id`` the enrichment writers leave NULL; - org-shared derived rows (``node_domains``, ``bridge_nodes``) left pointing at nodes this reset deleted, reported as ``orphansDeleted``; - the sandbox user's ``public.ingest_jobs`` rows (control plane); - the storage objects those rows referenced (uploaded imports and export documents), deleted after the database work commits so a failed reset cannot strand a developer with rows intact and their upload gone. Not counted in the response. What it does NOT clean, honestly: derived structure with no node key -- ``domains`` rows the sandbox's content helped form, the ``seg_*`` family, ``agent_patterns``. Those are org-wide aggregates with no way to attribute a row to the sandbox, so deleting them would take a real user's cognition with them. Use ``POST /v1/purge`` (scope ``org``) for a clean slate. It KEEPS the sandbox user and its keys, so a developer's test key keeps working against a now-empty partition -- the whole point. Re-running on an already-empty sandbox is a no-op returning zero counts. Replay-safe: the response is recorded with ``idempotency.complete``, so a resubmitted ``Idempotency-Key`` returns the original counts rather than re-running the wipe. operationId: resetSandbox responses: '200': content: application/json: schema: $ref: '#/components/schemas/SandboxResetResponse' description: Successful Response '400': content: application/problem+json: schema: $ref: '#/components/schemas/Problem' description: Malformed request, for example an invalid cursor. '401': content: application/problem+json: schema: $ref: '#/components/schemas/Problem' description: Missing or invalid credentials '403': content: application/problem+json: schema: $ref: '#/components/schemas/Problem' description: Missing scope or unprovisioned subject '404': content: application/problem+json: schema: $ref: '#/components/schemas/Problem' description: The requested resource does not exist. '409': content: application/problem+json: schema: $ref: '#/components/schemas/Problem' description: The reserved sandbox subject id is taken by a regular subject '422': content: application/problem+json: schema: $ref: '#/components/schemas/Problem' description: The request was understood but failed validation; see errors[]. '429': content: application/problem+json: schema: $ref: '#/components/schemas/Problem' description: Rate limit exceeded '503': content: application/problem+json: schema: $ref: '#/components/schemas/Problem' description: A dependency is unavailable components: schemas: SandboxResetResponse: description: What POST /v1/sandbox/reset erased. Keys and the subject itself survive. properties: jobsDeleted: title: Jobsdeleted type: integer keysRetained: title: Keysretained type: integer orphansDeleted: default: 0 description: >- Rows removed from org-shared derived tables that pointed at nodes this reset deleted (see the route docstring for what a reset cannot clean). title: Orphansdeleted type: integer rowsDeleted: title: Rowsdeleted type: integer subject: title: Subject type: string tablesCleared: title: Tablescleared type: integer tablesSkipped: title: Tablesskipped type: integer required: - subject - rowsDeleted - tablesCleared - tablesSkipped - jobsDeleted - keysRetained title: SandboxResetResponse type: object Problem: description: |- RFC 9457 problem+json envelope (spec D9), documented in OpenAPI. Invariant: ``code`` equals the tail of the ``type`` URI (``https://docs.get-exo.com/errors/``). properties: code: title: Code type: string detail: title: Detail type: string documentationUrl: anyOf: - type: string - type: 'null' title: Documentationurl errors: anyOf: - items: $ref: '#/components/schemas/FieldViolation' type: array - type: 'null' title: Errors requestId: default: '' title: Requestid type: string status: title: Status type: integer suggestedAction: anyOf: - type: string - type: 'null' title: Suggestedaction title: title: Title type: string type: title: Type type: string required: - type - title - status - detail - code title: Problem type: object FieldViolation: description: A single field-level violation inside a Problem ``errors[]`` list. properties: code: title: Code type: string field: title: Field type: string message: title: Message type: string pointer: title: Pointer type: string required: - pointer - field - code - message title: FieldViolation type: object securitySchemes: ApiKeyHeader: description: An Exo API key (exo_...) sent as the X-Exo-API-Key header. in: header name: X-Exo-API-Key type: apiKey BearerAuth: description: The same Exo API key (exo_...) sent as an Authorization bearer token. scheme: bearer type: http ````