User Export
GDPR Article 20 / CCPA §1798.100 — Data Subject Access Request (DSAR).
Returns a JSON dump of every row associated with the requesting user across the tables we control. Stripe data is referenced but not duplicated (Stripe is a separate controller — see Privacy §5). Server-side AI conversation history IS included as of 2026-05-11 (COUNSEL/CISO audit P0-2 fix): ai_conversation_messages was landed in v63 (NH11 multi-turn persistence) but the DSAR export
- cascade-delete were never updated, leaving stored prompts + responses orphaned in PG after account deletion (GDPR Art. 17 violation). Privacy policy §8 also updated to reflect the actual persistence state (was factually incorrect).
Squad Compliance P1: previously the only DSAR path was account deletion; users had no machine-readable export.
Request
- Base URL: https://www.oxfordledge.com (the document declares no server; this is the origin it was published from)
- URL: https://www.oxfordledge.com/api/user/export
- Auth: none declared
Response
Successful Response
Loose response_model for user-data routes (export, delete, consent, preferences). Multiple shape variants per action.
Changes
No recorded changes to this operation across all 1 revision of this API.