> ## Documentation Index > Fetch the complete documentation index at: https://apidocs.scripe.io/llms.txt > Use this file to discover all available pages before exploring further. # Delete a source (two-phase) > **Permanently** delete a source: the row, its full transcript (paragraphs and sentences), its topics and their hooks, its knowledge-base copy (document, chunks, and embeddings — knowledge search stops returning the content immediately), and the stored audio/video/file object. The storage quota those bytes held is released. This cannot be undone. It is deliberately **not total erasure**, and the proposal and result both say so: posts generated from the source are the user's content and are **kept** (their link to the source simply goes stale), and the internal usage-accounting ledger survives — deleting it would rewrite historical cost reporting. **Two-phase.** A `DELETE` without `confirmationToken` deletes nothing: it returns a proposal describing exactly what will be removed and what survives, plus a `confirmationToken` (expires ~5 minutes). Show the proposal to the user; after they explicitly confirm, repeat the same request with `?confirmationToken=` to execute. A token is bound to this source and this principal — a mismatched or expired token fails `400 invalid_request` with `details.reason: confirmation_invalid` / `confirmation_expired` and deletes nothing. Emits `source.deleted` on execution (identity only, never the transcript). Requires the `sources:destroy` scope, which `sources:write` and the `write` alias never imply — request it explicitly at consent. **Workspace-shared knowledge.** If any knowledge-base document written from this transcript was shared with the whole company, the delete additionally requires an admin — acting through an OAuth grant — **of the workspace that document is shared with**, which is not always the caller's own. That is the same rule `delete_knowledge_doc` applies to those rows, enforced in both phases. Without it the call fails `403 admin_required` and nothing is deleted. The proposal names the count in `data.toDelete.workspaceSharedKnowledgeDocuments`. ## OpenAPI ````yaml /openapi/v1.yaml delete /sources/{sourceId} openapi: 3.1.0 info: title: Scripe Public API version: '2026-08-10' summary: >- Read and write Scripe workspace data — posts, notes, ideas, sources, knowledge, media, analytics, usage, async jobs, and webhooks. description: | The Scripe public API gives integrators stable, versioned access to a workspace's content surface: reads across every resource, synchronous writes (notes, posts, ideas, text sources, media assets), async jobs (post generation, file/URL/YouTube ingest, image and carousel generation), usage meters, and outbound webhooks. All endpoints (except `/v1/health`) require a Bearer token — either a workspace API key (`scripe_sk_*`) or an OAuth 2.1 access token (`scripe_oat_*`). Pin the API version with the `Scripe-Api-Version` request header to opt out of breaking changes. contact: name: Scripe Support url: https://scripe.io/support email: support@scripe.io license: name: Proprietary servers: - url: https://api.scripe.io/v1 description: Production security: - BearerApiKey: [] tags: - name: Health description: Liveness and authenticated key smoke tests. - name: Workspace description: The workspace + principal resolved from your API key. - name: Projects description: Personal-brand, company-page, and amplifier projects. - name: Notes description: Project notes with paired calendar slot. - name: Posts description: Drafts, scheduled, and published LinkedIn posts. - name: Analytics description: Your own LinkedIn analytics and viral-post inspiration search. - name: Sources description: Transcriptions (audio/video sources) with truncated body. - name: Uploads description: >- Pre-signed S3 PUT URLs the customer uploads bytes to before referencing via Sources or Knowledge. - name: Knowledge description: >- Knowledge-base documents indexed for RAG. Async ingest via text, file, URL, or YouTube. - name: Jobs description: >- Async-job lifecycle — submitted via post-generation, knowledge ingest, file source. - name: Calendar description: >- The content calendar — scheduled/planned posts, note slots, idea placements, and the posting-time template. - name: Ideas description: >- The idea board — creative briefs with derived workflow statuses and date-level calendar placement. - name: Media description: >- Media-library search, own-image imports, AI image generation, and full-state media writes onto posts. - name: Settings description: >- Curated project settings, engagement policy, and company pages (read-only over REST). - name: Webhooks description: | Outbound HTTP callbacks. Subscribe an endpoint to one or more event names; we POST a signed JSON payload every time a matching event fires in the workspace. The signing secret is shown once on create and once on rotate — verify the `Webhook-Signature: t=,v1=` header on every delivery. paths: /sources/{sourceId}: delete: tags: - Sources summary: Delete a source (two-phase) description: | **Permanently** delete a source: the row, its full transcript (paragraphs and sentences), its topics and their hooks, its knowledge-base copy (document, chunks, and embeddings — knowledge search stops returning the content immediately), and the stored audio/video/file object. The storage quota those bytes held is released. This cannot be undone. It is deliberately **not total erasure**, and the proposal and result both say so: posts generated from the source are the user's content and are **kept** (their link to the source simply goes stale), and the internal usage-accounting ledger survives — deleting it would rewrite historical cost reporting. **Two-phase.** A `DELETE` without `confirmationToken` deletes nothing: it returns a proposal describing exactly what will be removed and what survives, plus a `confirmationToken` (expires ~5 minutes). Show the proposal to the user; after they explicitly confirm, repeat the same request with `?confirmationToken=` to execute. A token is bound to this source and this principal — a mismatched or expired token fails `400 invalid_request` with `details.reason: confirmation_invalid` / `confirmation_expired` and deletes nothing. Emits `source.deleted` on execution (identity only, never the transcript). Requires the `sources:destroy` scope, which `sources:write` and the `write` alias never imply — request it explicitly at consent. **Workspace-shared knowledge.** If any knowledge-base document written from this transcript was shared with the whole company, the delete additionally requires an admin — acting through an OAuth grant — **of the workspace that document is shared with**, which is not always the caller's own. That is the same rule `delete_knowledge_doc` applies to those rows, enforced in both phases. Without it the call fails `403 admin_required` and nothing is deleted. The proposal names the count in `data.toDelete.workspaceSharedKnowledgeDocuments`. operationId: deleteSource parameters: - $ref: '#/components/parameters/ScripeApiVersion' - name: sourceId in: path required: true schema: type: string example: src_a1b2c3d4e5f6g7h8 - name: confirmationToken in: query required: false schema: type: string description: | Omit on the first call to receive the proposal. Repeat the call with the returned token to execute the delete. responses: '200': description: | Without `confirmationToken`: the proposal (`data.phase: "proposal"`) — nothing was deleted. With a valid token: the deletion result (`data.deleted: true`). content: application/json: schema: oneOf: - $ref: '#/components/schemas/SourceDeleteProposal' - $ref: '#/components/schemas/SourceDeleteResult' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '429': $ref: '#/components/responses/RateLimited' components: parameters: ScripeApiVersion: name: Scripe-Api-Version in: header required: false description: | Pin the API version. Format `YYYY-MM-DD`. Omit to receive the currently rolling default. Unknown versions return `400 version_unsupported`. schema: type: string example: '2026-08-10' schemas: SourceDeleteProposal: type: object description: | Phase one of the two-phase delete — nothing has been deleted. Names the blast radius AND what deliberately survives, so a caller expecting total erasure learns otherwise before confirming. required: - data properties: data: type: object required: - phase - sourceId - projectId - toDelete - kept - warnings - note - confirmationToken - tokenExpiresAt properties: phase: type: string enum: - proposal sourceId: type: string example: src_a1b2c3d4e5f6g7h8 projectId: type: string example: proj_a1b2c3d4e5f6g7h8 name: type: - string - 'null' status: type: string durationSeconds: type: number createdAt: type: string format: date-time toDelete: type: object required: - topics - knowledgeDocuments - storedFile properties: topics: type: integer hooksOfThoseTopics: type: boolean transcriptParagraphsAndSentences: type: boolean knowledgeDocuments: type: integer workspaceSharedKnowledgeDocuments: type: integer description: | How many of `knowledgeDocuments` are shared with the whole workspace (share-with-company). Deleting the source removes them for every project, so a delete with a non-zero value here requires an admin of each such document's own workspace, acting through an OAuth grant — the same rule `delete_knowledge_doc` applies to those rows. knowledgeEmbeddings: type: boolean storedFile: type: boolean kept: type: object description: What deliberately survives the delete. required: - derivedPosts - usageLedger properties: derivedPosts: type: integer description: | Posts generated from this source. They are the user's content and are never deleted with it. usageLedger: type: boolean const: true warnings: type: array items: type: string note: type: string confirmationToken: type: string description: | Repeat the DELETE with `?confirmationToken=` to execute. Bound to this source + principal. tokenExpiresAt: type: integer description: Epoch milliseconds. SourceDeleteResult: type: object description: | Phase two — the source is gone. `removed` reports the actual per-table row counts the cascade deleted; `kept` restates what survives (derived posts, the usage-accounting ledger). required: - data properties: data: type: object required: - id - deleted - projectId - status - removed - kept - note properties: id: type: string example: src_a1b2c3d4e5f6g7h8 deleted: type: boolean const: true projectId: type: string name: type: - string - 'null' status: type: string removed: type: object required: - topics - hooks - paragraphs - sentences - knowledgeDocuments - knowledgeChunks - knowledgeAssignments - storedFileRemoved properties: topics: type: integer hooks: type: integer paragraphs: type: integer sentences: type: integer knowledgeDocuments: type: integer knowledgeChunks: type: integer knowledgeAssignments: type: integer storedFileRemoved: type: boolean kept: type: object required: - derivedPosts - usageLedger properties: derivedPosts: type: integer usageLedger: type: boolean const: true note: type: string Error: type: object required: - error properties: error: type: object required: - code - message - request_id - docs_url properties: code: type: string description: Stable, machine-readable error identifier. example: not_found message: type: string request_id: type: string example: req_a1b2c3d4e5f6 docs_url: type: string format: uri details: description: Optional structured payload — shape varies per code. responses: BadRequest: description: Malformed request (bad cursor, bad limit, etc.). content: application/json: schema: $ref: '#/components/schemas/Error' Unauthorized: description: Missing, malformed, expired, or revoked API key. content: application/json: schema: $ref: '#/components/schemas/Error' Forbidden: description: Plan not eligible, scope missing, or workspace mismatch. content: application/json: schema: $ref: '#/components/schemas/Error' NotFound: description: Resource not found in this workspace. content: application/json: schema: $ref: '#/components/schemas/Error' RateLimited: description: Sliding-window rate limit exceeded. headers: Retry-After: schema: type: integer X-RateLimit-Limit: schema: type: integer X-RateLimit-Remaining: schema: type: integer X-RateLimit-Reset: schema: type: integer content: application/json: schema: $ref: '#/components/schemas/Error' securitySchemes: BearerApiKey: type: http scheme: bearer bearerFormat: scripe_sk_live_* description: | Pass `Authorization: Bearer scripe_sk_live_<...>` (or `scripe_sk_test_<...>` for test keys) on every request. Keys are scoped to a single workspace and can be revoked from the Scripe dashboard. The same header also accepts an OAuth 2.1 access token (`scripe_oat_*`); both credentials share one scope vocabulary and every operation below documents the scope it requires. An API key can hold every scope named on this surface except `webhooks:manage`, which is grantable to OAuth tokens only today — the webhook-endpoint operations answer `403 scope_missing` to every API key. Operations that name no scope accept any valid token of the workspace. ````