A server-owned conversation moves custody of the transcript to HASP. Instead of replaying the full message history on every request, you open a conversation, reference it, and HASP stores and retrieves the turns — with the transcript inside the compliance boundary and every content read recorded as a disclosure.
Requires the conversation.read / conversation.write capabilities.
Ownership is per-credential, not per-org. A conversation opened by one API key or agent credential is not readable by another, even within the same org. The capability makes the resource reachable; ownership decides which rows you can touch.
Open a conversation
Body
List conversations
Returns the caller’s own conversations, most recently updated first, cursor-paginated. Metadata only — no transcript content.
PATCH accepts the same fields as create; send only what you want to change. Raising phi_mode to allow PHI is permanent for that conversation — once a transcript may have contained PHI, it is treated as PHI-bearing for retention and disclosure purposes even if the mode is lowered again.
Read the transcript
Returns turns oldest-first, cursor-paginated. This is a content read and emits an audit event — unlike the metadata endpoints above.
Export a transcript
Returns the whole transcript in one response. Export decrypts and serialises every message at once, so it is capped; a capped response reports truncated: true alongside the real total_message_count rather than looking complete. Page through /messages when a conversation exceeds the cap.
List attachments
Metadata for the files bound to the conversation — no bytes and no transcript text, so this sits on the metadata side of the disclosure boundary and does not emit a disclosure event.
Errors
