Permanently deletes every record in the dataset whose user_id matches — the erasure operation for GDPR Article 17 requests. Derived embeddings are removed with the records. Idempotent: repeating the call answers deleted_count: 0.

tenant_id is required: the gateway scopes erasure to one dataset. (The underlying store can erase a user across every dataset when tenant_id is omitted; that form is not reachable through this API.) Records written without a user_id cannot be reached this way — delete them individually.

Deletion is unrecoverable, so it requires an API key with manage permission on a workspace the dataset is assigned to, and the dataset must be assigned to exactly one workspace: on a shared dataset no workspace permission can say whose records these are, so API-key mutations are refused with 403.