Skip to main content

deletedRecords

Retrieves the identifiers of records that have been deleted since the supplied cursor, so a downstream cache can evict them. Answers "which ids of these types went away", not "what did they contain" — the records themselves are gone.

Entity types the caller does not have permission to read are dropped from the request rather than rejected, so a partially-permitted caller still gets the types it can see.

deletedRecords(
  entityTypes: [DeletedRecordType!]!
  eventIds: [ID!]! = 
  limit: PaginationLimit! = 1000
  sinceCursor: String
): DeletedRecordResult!

Arguments​

deletedRecords.entityTypes ● [DeletedRecordType!]! non-null enum​

deletedRecords.eventIds ● [ID!]! non-null scalar​

Restricts the scan to these events. Required for every type except EVENT, which has no parent event to scope by.

deletedRecords.limit ● PaginationLimit! non-null scalar​

Applied per entity type, so a call for N types can return up to N × limit records.

deletedRecords.sinceCursor ● String scalar​

An opaque cursor — callers must never parse or construct it, only store the currentCursor of the previous successful call and hand it back. Deliberately not named sinceTimestamp: the opacity is what lets the resolver change where deletes are read from (a soft-delete column scan today, tombstone rows later, or a split across both) with no SDL change and no coordinated consumer release.

Omitting it means the caller has no cursor, which returns fullReloadRequired: true and empty records. This fails closed on purpose: the alternative, scanning back to the retention floor, hides a 30-day read behind a null.

A returned cursor is only meaningful for a subsequent call carrying the same entityTypes and the same eventIds. It holds per-type resume state, so store one cursor per set of entity types; and its watermark attests only to the events the call that produced it was scoped to, so adding an event to that set leaves every delete for the new event from before the widening sitting behind the watermark, never to be offered. Widening eventIds therefore needs a full reload for the events added. Optional.

Type​

DeletedRecordResult object​

One cycle's worth of deletions, plus the cursor state the caller needs to run the next cycle. A transport envelope rather than a stored entity, so it carries no id and no audit fields.