Research deletion and recovery

Owner workflow

Only a workspace owner signed in through Google can request or resume research deletion. Admin/researcher/viewer roles and all API tokens—including *—cannot do so.

1. Open a survey’s Responses page or a project page.
2. Choose Delete response data.
3. Review the affected surveys and counts.
4. Choose a reason.
5. Type DELETE RESPONSE DATA.
6. Confirm the deletion, or choose Cancel beside the final action.

Project deletion confirms the exact survey IDs shown; changes to that set require a refreshed preview.

Survey scope removes all accepted responses through the current published version, linked response projections, browsing caches and affected saved reports. Project scope applies that same boundary to every confirmed survey and also clears the captured project research brief. Forms, published question definitions, survey links, account/membership data and billing data are retained. Existing consumed completion capacity and aggregate rejection counters are retained; deleting responses does not buy additional capacity.

Collection closes as soon as the durable request is accepted. The owner must publish a new version to start collecting again. Old versions and old queued respondent submissions cannot recreate deleted research. Normal authoring roles can continue editing forms, but only the owner can restart collection after deletion. Reports based on deleted responses return 410 Gone, never silently recalculated findings.

The screen advances one bounded batch at a time. Leaving the page stops that browser's processing; the request stays durable and collection remains closed. Return and choose Resume deletion. An active export can produce a waiting state; retry after the export finishes or is cancelled. A failed batch rolls back and shows incomplete progress. Resume safely retries it. A completed request leaves a sanitized receipt with scope IDs, version cutoffs, reason and state, without answers or report titles.

Already downloaded CSV, previously delivered browser content and respondent device recovery copies cannot be remotely recalled. Local respondent recovery has its existing seven-day expiry; the server rejects the deleted version regardless. A completed request confirms deletion from active research data; it does not certify erasure of backups or copies held elsewhere.

Session API

Use /api/v1/surveys/{surveyId}/research-deletions or /api/v1/projects/{projectId}/research-deletions as the base path.

{
  "confirmation": "DELETE RESPONSE DATA",
  "reason": "owner_request",
  "surveyIds": ["UUID-FROM-PROJECT-PREVIEW"]
}

surveyIds is required for project scope. Reasons are owner_request, privacy_request, or test_cleanup; free-text reasons are deliberately excluded from the durable ledger. Browser writes require the same-origin Origin and session x-csrf-token. The key is 16–128 letters, digits, hyphens or underscores. Reuse it for the same intent; changing scope or reason returns 409. The key does not grant access.

States: pending, running, waiting, failed, completed. Phases identify reports, caches, projections, events, sessions and final verification. A failed request remains closed and resumable. Do not treat a 200 batch response as proof of completion; inspect state. The browser paces requests below the existing API rate limit. Clients should back off on waiting/429 and stop on permission loss.