Privacy - Crewship

Agents may extract “peer cards” — per-user notes about the people they collaborate with. These endpoints give every authenticated user GDPR control over the cards stored about themselves: list what’s held, purge it, and manage opt-out consent. Every endpoint acts on the caller’s own data only — the user ID is read from the auth context, never a path parameter. They require authentication and workspace context. Cross-user GDPR actions (admin acting on another user) go through a separate admin surface. Opt-out is a hard stop: setting opted_out=true triggers an immediate purge of every existing card about the user across every agent in the current workspace, and of their operator model — it does not wait for the next routine sweep. The operator model is a separate surface with its own endpoints below: one short profile per (user, workspace) holding the role, ownership and standing constraints that person has stated. It records only what they said, never what the system inferred. The endpoints let a person read it and drop a single wrong entry without turning the whole feature off.

List My Peer Cards

GET /api/v1/users/me/peer-cards?workspace_id={workspaceId}

Lists every peer card mentioning the requesting user across every agent in the current workspace, including content (the user has a right to see what was stored). Each read is itself audited. Auth: Any authenticated user (own data only) Response: 200 OK

{
  "user_id": "user_123",
  "peers": [
    {
      "id": "pc_abc",
      "agent_id": "agent_xyz",
      "agent_slug": "ada",
      "user_slug": "pavel",
      "bytes": 412,
      "created_at": "2026-05-26T14:22:10Z",
      "updated_at": "2026-05-26T14:22:10Z",
      "content": "# Pavel\n..."
    }
  ]
}

Peer Card Fields

Field	Type	Description
`id`	string	Peer card ID
`agent_id`	string	Agent that authored the card
`agent_slug`	string	Agent slug
`user_slug`	string	The card’s user slug
`bytes`	integer	Card size in bytes
`created_at`	string	ISO 8601 timestamp
`updated_at`	string	ISO 8601 timestamp
`content`	string?	Card markdown; omitted when no storage path is configured

Status	Condition
`401`	Not authenticated
`400`	Missing workspace context

Purge My Peer Cards

DELETE /api/v1/users/me/peer-cards?workspace_id={workspaceId}

Deletes every card about the requesting user across every agent in the workspace (disk + index + per-card audit). Does not touch consent — a user can delete current cards without opting out of future extraction. Auth: Any authenticated user (own data only) Response: 200 OK

{ "user_id": "user_123", "purged": 3 }

Field	Type	Description
`user_id`	string	The requesting user
`purged`	integer	Number of cards deleted

GET /api/v1/users/me/peer-consent?workspace_id={workspaceId}

Returns the user’s opt-out state for the current workspace. Auth: Any authenticated user (own data only) Response: 200 OK

{
  "user_id": "user_123",
  "workspace_id": "ws_123",
  "opted_out": false,
  "opted_out_at": ""
}

Field	Type	Description
`user_id`	string	The requesting user
`workspace_id`	string	Current workspace
`opted_out`	boolean	Whether the user has opted out of peer-card extraction
`opted_out_at`	string	ISO 8601 timestamp of opt-out; empty when not opted out

PUT /api/v1/users/me/peer-consent?workspace_id={workspaceId}
Content-Type: application/json

Flips the opt-out state. Setting opted_out=true triggers an immediate purge of all existing peer cards about the user in this workspace, alongside the consent change and an audit row. Auth: Any authenticated user (own data only) Request Body:

Field	Type	Required	Description
`opted_out`	boolean	Yes	`true` to opt out (and purge); `false` to opt back in

{ "opted_out": true }

Response: 200 OK

{
  "user_id": "user_123",
  "workspace_id": "ws_123",
  "opted_out": true,
  "purged": 3,
  "purged_models": 1
}

purged reflects the number of peer cards removed by the opt-out and purged_models the operator model (0 or 1). Both are 0 when opting back in.

Status	Condition
`400`	Invalid JSON or missing workspace context
`401`	Not authenticated

Get My Operator Model

GET /api/v1/users/me/user-model?workspace_id={workspaceId}

Returns the operator model stored about the requesting user in this workspace: the raw file plus each - key: value bullet split into a field, and for each field where it came from. A read is recorded in the peer-card audit log with action='read'. Auth: Any authenticated user (own data only) Response: 200 OK

{
  "user_id": "user_123",
  "workspace_id": "ws_123",
  "exists": true,
  "user_slug": "9f2c1a4e7b3d0518",
  "bytes": 118,
  "created_at": "2026-08-01T05:00:00.000Z",
  "updated_at": "2026-08-02T05:00:00.000Z",
  "content": "- role: runs the platform team\n- timezone: UTC+1\n- language: Czech",
  "facts": [
    {
      "key": "role",
      "value": "runs the platform team",
      "provenance": {
        "quote": "I run the platform team here",
        "message_id": "msg_1757912400123_9f2c1a4e7b3d0518",
        "source_type": "stated",
        "at": "2026-08-02T05:00:00.000Z"
      }
    },
    {
      "key": "timezone",
      "value": "UTC+1",
      "provenance": {
        "quote": "I'm on UTC+1",
        "message_id": "msg_1757912455771_0a1b2c3d4e5f6071",
        "source_type": "stated",
        "at": "2026-08-02T05:00:00.000Z"
      }
    },
    { "key": "language", "value": "Czech" }
  ]
}

exists: false with an empty facts array means nothing has been recorded about this person in this workspace yet. content and facts are omitted when the server has no memory storage path configured. provenance is where the fact came from: quote is the verbatim span of the person’s own words the extraction verified it against, message_id the id of the message it was found in, source_type the origin the extraction profile admitted (stated under every shipped profile), and at when it was recorded (ISO 8601, UTC, milliseconds). Provenance is stored beside the model file, never inside it, and every sync appends: a field changed or restated in a later message gets a new row and the response shows the newest (the same sentence re-found by the next day’s sweep is not recorded twice). A fact recorded before provenance was kept has no provenance key at all — never null, never an empty object.

Status	Condition
`400`	Missing workspace context
`401`	Not authenticated

Forget One Field

DELETE /api/v1/users/me/user-model/facts/{key}?workspace_id={workspaceId}

Removes a single field from the operator model and leaves the rest standing — the answer to “an agent recorded something wrong about me” that does not cost the person everything it recorded correctly. {key} is a field name from the facts array above; matching is case-insensitive. The field’s provenance rows go with it — every one, not only the newest. Removing the last remaining field removes the model entirely (an empty model is not a model), which the response reports as exists: false. Auth: Any authenticated user (own data only) Response: 200 OK

{
  "user_id": "user_123",
  "forgot": "timezone",
  "exists": true,
  "remaining": [
    { "key": "role", "value": "runs the platform team" }
  ]
}

Status	Condition
`400`	Missing field key or workspace context
`401`	Not authenticated
`404`	No operator model, or no field by that name — a miss is never reported as a success
`503`	The server has no memory storage path configured

Purge My Operator Model

DELETE /api/v1/users/me/user-model?workspace_id={workspaceId}

Forgets the whole operator model and every provenance row behind it. Does not opt the caller out: new facts may be recorded again from things they state later. Use PUT /users/me/peer-consent with opted_out: true to stop recording altogether — that purges the model and its provenance too. Auth: Any authenticated user (own data only) Response: 200 OK

{ "user_id": "user_123", "purged": 1 }

Status	Condition
`400`	Missing workspace context
`401`	Not authenticated

​List My Peer Cards

​Peer Card Fields

​Purge My Peer Cards

​Get Peer Consent

​Set Peer Consent

​Get My Operator Model

​Forget One Field

​Purge My Operator Model