Skip to main content
Cleanup disables reusable test access while preserving financial and audit history. This guide applies to enterprise integrations that created live end-user identities. Personal accounts do not expose the end-user APIs. The least cleanup is none: tests that run on a sandbox key create no sessions, balances, reservations, or end users, so the workflows below apply only to tests that exercised live credentials.

​
1. Prefer a sandbox key

A sandbox key simulates the metered HTTP contract without creating balances, checkout sessions, reservations, or end users. Use it for automated tests whenever provider content and live Stripe behavior are not under test.

​
2. Stop live activity

Before retiring a test end user:
  1. Stop issuing new calls, tokens, and top-ups for that identity.
  2. Let in-flight calls finish or fail so their reservations settle.
  3. Let any Locus-hosted Checkout complete or expire.
  4. Deallocate the remaining end-user balance to the workspace pool.
If retirement is not yet safe, the endpoint returns 409 END_USER_RETIREMENT_BLOCKED with the remaining public blockers. Resolve those conditions and retry; do not attempt to bypass the lifecycle through another endpoint.

​
3. Reset a policy without losing its journal

The caller needs tokens:manage; a dashboard caller must be a workspace owner or admin. This policy reset does not itself require step-up, but retiring the end user does. The reset refuses to run while a reservation still depends on the policy. It removes only operational policy/counter rows and appends a RESET decision. Historical decisions remain available at:
Repeating the reset returns reset: false and does not append a second event.

​
4. Retire the test end user

This is owner-only and requires fresh step-up. On success Locus:
  • revokes active end-user JWT records;
  • revokes scoped Agent Connection credentials bound to that end user;
  • cancels outstanding MCP cost approvals;
  • resets the active policy while preserving its audit events;
  • freezes the credit account; and
  • marks the identity inactive so minting a new token cannot reactivate it.
The operation is idempotent. It never deletes the credit account.

​
What remains by design

Locus retains the financial ledger and the security, credential, and policy audit history required to explain prior activity. Retiring an identity prevents future use; it is not a request to erase transaction records. Retention and deletion requests remain governed by your agreement, the Locus terms, and applicable law.