Restore a soft-deleted asset

POST

/admin/assets/{id}/restore

• Local development behind nginx (port 8088 by default)

Clears deleted_at + deleted_reason on the asset row and fires an admin.asset.restored audit event carrying the prior reason + how long the asset had been soft-deleted.

AUTHORISATION turns on WHO DELETED IT, not on the caller’s standing authority (#931): you may undo your own delete, and system.admin may undo any. Nothing else. That keeps restore authority matched to delete authority — whoever passed the delete gate can reverse themselves — while an administrator’s removal is not silently undone by the owner the moment it lands; the owner asks for restoration instead.

A row whose deleted_by_user_ref is NULL — deleted before this was recorded, or removed by a system-scheduled retention action — is restorable by system.admin only.

Returns 404 if the asset is already live (or doesn’t exist). Returns 401 for anonymous callers; 403 when the caller did not delete it.

Authorizations

• cookieAuth
• bearerAuth

Parameters

Path Parameters

id

required

string format: uuid

Responses

204

Restored

401

Authentication required, missing, or invalid

object

error

required

Human-readable error summary

string

Example

the request could not be completed

Example

{
  "error": "authentication required: sign in and retry with a valid session or API token"
}

403

Authenticated but missing required capabilities

object

error

required

Human-readable error summary

string

Example

the request could not be completed

404

Resource not found

object

error

required

Human-readable error summary

string

Example

the request could not be completed