> ## Documentation Index > Fetch the complete documentation index at: https://cadenya.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Erase a tenant > Destroys the tenant, its subjects, every objective associated with it and everything reachable from those objectives, and its widget sessions. This is the full erasure hammer, wider than `DELETE /widget_sessions`, which removes only what widget sessions created. The work runs in the background: this returns the tenant in STATE_ERASING rather than a count of what was removed, since a large tenant's history cannot be destroyed inside a request. Poll the tenant to follow it — STATE_ERASING while it runs, NotFound once it finishes. Erasure is terminal; a tenant cannot be recovered once it starts. ## OpenAPI ````yaml /api-spec.yml delete /v1/workspaces/{workspaceId}/tenants/{id} openapi: 3.1.0 info: title: Cadenya API description: API for the Cadenya Agent Runtime platform. version: '1.0' servers: - url: https://api.cadenya.com description: Production server security: - bearerAuth: [] tags: - name: AIProviderKeyService - name: APIKeyService description: |- Issue, rotate, disable, and revoke a workspace's API keys. Every key belongs to exactly one workspace; the system-managed global account key is managed via GlobalAPIKeyService instead. - name: AccountService description: >- Manage the authenticated account. Accounts are the top-level organizational unit and contain one or more workspaces. - name: AgentScheduleService description: >- Manage recurring schedules attached to agents. Schedules trigger objectives on a cadence defined by AgentScheduleSpec.Schedule. - name: AgentService description: >- Manage AI agents within a workspace. Agents define AI behavior and tool access. - name: AgentVariationService description: >- Manage variations of an agent and their tool, sub-agent, and memory layer assignments. - name: GlobalAPIKeyService description: |- Manage the account's system-provisioned global API key. The global key is the only key that spans every workspace; it is created by the system and cannot be deleted, so the surface is retrieve, rotate, and the disable/enable kill switch. - name: MemoryService description: >- Manage memory layers and their entries. Layers are named containers that can be composed into an objective's memory cascade; entries are the keyed values within a layer. System-managed layers (e.g., episodic layers created by the runtime) cannot be mutated through this API. - name: ModelService description: |- Manage LLM models available to a workspace. Models represent provider and family pairs (e.g., "anthropic/claude-sonnet-4.6"). Workspaces are seeded with the supported models and you can enable or disable each one. - name: ObjectiveEventStreamsService - name: ObjectiveService - name: ProfilesService description: |- Operations on profiles, the account-level principals (users, API keys, system) that authenticate against the API. - name: SearchService - name: TenantService description: >- Read and erase tenants and the subjects under them. Tenants and subjects are created by assertion — on objective creation or widget session mint — never directly, so this service has no create or update: it exists to enumerate what assertions have produced, and to destroy it on request. - name: ToolService description: >- Manage tool sets and the tools they contain. Tool sets group related tools, and tools define specific capabilities available to agents. When a tool set is managed, only API key actors can modify its tools; human (profile) actors cannot. - name: UploadService description: |- Issue short-lived presigned URLs for direct client-to-object-storage uploads. Created uploads can be referenced by id when creating or updating resources that accept binary content (e.g., MemoryEntry). - name: WidgetService description: |- Manage embeddable chat widgets. A widget binds an agent to a globally unique hostname with a per-widget origin allowlist; browsers reach it with session tokens minted via WidgetSessionService. - name: WidgetSessionService description: >- Mint and manage widget sessions. Session creation is server-to-server only: the customer's backend authenticates its visitor, asserts tenant/subject context, attaches any per-visitor secrets, and receives a short-lived bearer token the browser uses against the widget host. - name: WorkspaceAdminService description: >- Administer workspaces across the account: create and archive workspaces and manage their membership. These operations are account-scoped and require the admin role (a token whose profile holds the WorkOS admin role); they live under /v1/account/workspaces rather than the workspace-scoped /v1/workspaces tree so an admin can manage any workspace in the account, including ones they are not themselves a member of. - name: WorkspaceSecretService - name: WorkspaceService description: |- Manage workspaces within an account. Workspaces provide organizational grouping and isolation for resources such as agents, tools, and API keys. This is the workspace-scoped, end-user surface. Administrative operations (create / archive workspaces, manage members) live in WorkspaceAdminService under /v1/account/workspaces and require the admin role. paths: /v1/workspaces/{workspaceId}/tenants/{id}: delete: tags: - TenantService - Tenants summary: Erase a tenant description: >- Destroys the tenant, its subjects, every objective associated with it and everything reachable from those objectives, and its widget sessions. This is the full erasure hammer, wider than `DELETE /widget_sessions`, which removes only what widget sessions created. The work runs in the background: this returns the tenant in STATE_ERASING rather than a count of what was removed, since a large tenant's history cannot be destroyed inside a request. Poll the tenant to follow it — STATE_ERASING while it runs, NotFound once it finishes. Erasure is terminal; a tenant cannot be recovered once it starts. operationId: TenantService_DeleteTenant parameters: - name: workspaceId in: path description: Workspace ID. required: true schema: type: string example: workspace_01HXKD2E5NQM3T9AYWCF133E3Q - name: id in: path description: |- Tenant to destroy. Accepts the canonical `tenant_…` form or the `external_id:` form. required: true schema: type: string responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/Tenant' default: description: Default error response content: application/json: schema: $ref: '#/components/schemas/Status' x-codeSamples: - lang: typescript label: TypeScript source: |- import Cadenya from '@cadenya/cadenya'; const client = new Cadenya(); const result = await client.tenants.delete('_123'); - lang: go label: Go source: "package main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\t\"log\"\n\n\tcadenya \"go.cadenya.com/cadenya-go\"\n)\n\nfunc main() {\n\tclient, err := cadenya.NewClient()\n\tif err != nil {\n\t\tlog.Fatal(err)\n\t}\n\tctx := context.Background()\n\tparams := &cadenya.TenantDeleteParams{}\n\tresult, err := client.Tenants().Delete(ctx, \"_123\", params)\n\tif err != nil {\n\t\tlog.Fatal(err)\n\t}\n\tfmt.Printf(\"%+v\\n\", result)\n}" - lang: python label: Python source: |- from cadenya import Cadenya with Cadenya() as client: result = client.tenants.delete("_123") print(result) - lang: ruby label: Ruby source: |- require "cadenya" client = Cadenya::Client.new result = client.tenants.delete("_123") puts result.inspect - lang: shell label: CLI source: cadenya tenants delete _123 components: schemas: Tenant: required: - metadata - state type: object properties: metadata: $ref: '#/components/schemas/ResourceMetadata' info: $ref: '#/components/schemas/TenantInfo' state: readOnly: true enum: - STATE_UNSPECIFIED - STATE_ACTIVE - STATE_ERASING type: string description: The current lifecycle state of the tenant. Output only. format: enum description: >- Tenant is the customer's organization as a readable record rather than an echo. It carries no spec: a tenant is never configured, only asserted, so everything about it lives in the metadata envelope — `external_id` is the key the customer asserted it under, `name` is the most recent name they asserted, and `updated_at` is therefore when the tenant was last asserted. Status: type: object properties: code: type: integer description: >- The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code]. format: int32 message: type: string description: >- A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client. details: type: array items: $ref: '#/components/schemas/GoogleProtobufAny' description: >- A list of messages that carry the error details. There is a common set of message types for APIs to use. description: >- The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). ResourceMetadata: required: - id - accountId - workspaceId - name - profileId - createdAt - externalId - labels type: object properties: id: readOnly: true type: string description: >- Unique identifier for the resource (prefixed ULID, e.g., "agent_01HXK...") accountId: readOnly: true example: account_01HXKD2E5NQM3T9AYWCFTJHJVF type: string description: >- Account this resource belongs to for multi-tenant isolation (prefixed ULID) workspaceId: readOnly: true example: workspace_01HXKD2E5NQM3T9AYWCF133E3Q type: string description: >- Workspace this resource belongs to for organizational grouping (prefixed ULID) name: type: string description: >- Human-readable name for the resource (e.g., "Customer Support Agent", "Email Tool") Required for resources that users interact with directly externalId: type: string description: >- External ID for the resource (e.g., a workflow ID from an external system) labels: type: object additionalProperties: type: string description: |- Key-value pairs for categorization and filtering. Values are 0-63 alphanumeric characters with "-", "_", or "." allowed between; keys follow the same shape and additionally accept an optional DNS-subdomain prefix (e.g. "cadenya.com/") of at most 253 characters. Examples: {"environment": "production", "team": "platform", "version": "v2"} profileId: readOnly: true example: profile_01HXKD2E5NQM3T9AYWCFS0AP08 type: string description: ID of the actor (user or service account) that created this resource createdAt: readOnly: true type: string description: Timestamp when this resource was created format: date-time updatedAt: readOnly: true type: string description: Timestamp when this resource was last updated format: date-time description: >- Standard metadata for persistent, named resources (e.g., agents, tools, prompts) TenantInfo: required: - subjectCount - objectiveCount - widgetSessionCount type: object properties: subjectCount: readOnly: true type: integer description: Number of subjects asserted under this tenant. format: int32 objectiveCount: readOnly: true type: integer description: >- Number of objectives associated with this tenant, across every surface — widget conversations and objectives created directly against the API alike. This is the footprint a delete would destroy, which is why it is worth the count query that populating `info` costs. format: int32 widgetSessionCount: readOnly: true type: integer description: Number of widget sessions minted for this tenant that still exist. format: int32 description: TenantInfo provides read-only server-derived data about a tenant. GoogleProtobufAny: type: object properties: '@type': type: string description: The type of the serialized message. additionalProperties: true description: >- Contains an arbitrary serialized message along with a @type that describes the type of the serialized message. securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT ````