Undo a whole session (a project owner, in person)

POST

/v1/audit/sessions/{hash}/restore

const url = 'https://beta-api.plune.ai/v1/audit/sessions/example/restore';
const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request POST \
  --url https://beta-api.plune.ai/v1/audit/sessions/example/restore \
  --header 'Authorization: Bearer <token>'

Only the project owner may roll a session back, and only in person: a token gets 403 person_only whoever owns it (an agent does not roll back), anyone else 403 owner_only; either refusal is an entry of the project. GET /v1/audit/sessions/{hash}/restore-preview answers first what would happen and writes nothing. The real call walks the session backwards — the changes were applied forwards, so the state before the FIRST change is what the earliest entry holds. Whatever the preview names as changed by people or not possible is LEFT AS IT IS and named in skipped; nothing somebody else saved is overwritten. A record that keeps being saved by others through all three attempts of the write is skipped too. Each restore writes its own entry with meta.restoredFrom naming the entry it undid, and the rollback itself leaves one event entry on the project. Idempotent: an entry a former run put back is counted in alreadyReverted and not touched again, so calling it again after a failure finishes the rest. Always 200 with a report, never a stop at the first refusal. A create is undone by deleting the record — to the bin, reversibly (D21), so a case with results goes too and keeps them. A node that still holds something stays, because the ordinary delete cascades and an undo must not take another actor’s work along. That is what takes a filed case’s derived folders and suite with it (B-7) — and leaves a suite someone has filled since, named in the report.

Authorizations

bearerAuth
cookieAuth

Parameters

Path Parameters

hash

required

string

Responses

200

How many were put back, and what was not

application/json

object

restored

required

integer

skipped

required

Entries left as they are, each with the reason; a change made by somebody else after the session has code: changed_since.

Array<object>

object

entryId

required

string

reason

required

string

code

required

string

Allowed values: not_found not_restorable entity_gone changed_since unsupported_entity

alreadyReverted

required

Entries an earlier run of this rollback already put back; not done twice.

integer

Example

{
  "skipped": [
    {
      "code": "not_found"
    }
  ]
}

401

No / invalid token or session

403

A token (code: person_only) or not the project owner (code: owner_only)

429

Rate limited