These routes take Authorization: Bearer tl_sk_…. Call them only from your backend.
| Route | Purpose |
|---|---|
POST /tokens |
mint a user token, see API: auth and tokens |
GET /users/:userId/export |
every stored record of that user, as JSON |
DELETE /users/:userId |
delete that user's data |
GET /users/:userId/export
Returns all stored data for the user in your app as one JSON document:
{ "app": "…", "user": "user-123", "exportedAt": "2026-11-07T10:00:00.000Z",
"documents": [], "aiConsent": [], "aiLog": [], "writeLog": [], "activeMonths": [] }
documents holds every stored document (layouts, theme, user screens, navigation, designs,
versions); writeLog is the audit row per write; activeMonths the months the user customised. Use it to answer a data access
or portability request (GDPR articles 15 and 20).
curl "{TWEAKLANE_URL}/users/user-123/export" -H "Authorization: Bearer tl_sk_…"
DELETE /users/:userId
Deletes the user's layouts, designs, versions, write log, AI consent and AI log rows, and usage
rows. Answers 200 {deleted: {layouts, layoutAudit, aiLog, aiConsents}} with the row counts. Use it
when a user deletes their account or asks for erasure (GDPR article 17). The audit log keeps a
sha256 of the deleted user id, not the id.
curl -X DELETE "{TWEAKLANE_URL}/users/user-123" -H "Authorization: Bearer tl_sk_…"
Anonymous users have the id anon:<installId>; URL-encode it in the path.
Next: API: errors and limits.