> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Session replay: watch visitor sessions before a chat

> Play back what a visitor did on your site before or during an Orbit conversation, with capture-time privacy masking for passwords, PII, and selectors.

# Session Replay

Session replay records a visitor's web session — a DOM snapshot plus the sequence of on-page interactions — while they're on a page with the Orbit chat widget installed, and stores it against the conversation that visitor starts. When a support agent picks up that conversation later, they can play the recording back in the inbox and see exactly what the visitor saw and clicked, instead of relying on the visitor to describe it. It's the asynchronous counterpart to live [co-browse](/api-reference/cobrowse): co-browse is watching in real time, session replay is watching after the fact.

This page covers the operator side — listing, fetching, and purging recordings, and configuring what gets masked before it's ever uploaded. The widget-side capture itself is automatic once the widget is installed; there's nothing to integrate to start recording.

For the full request/response schema, see the [Session Replay API reference](/api-reference/session-replay).

## Privacy masking — configure this first

Session replay can capture anything visible in the DOM, including values a visitor types. Orbit's masking policy decides what gets redacted **in the visitor's browser, before any event is uploaded** — masked content never leaves the page in the first place. The default posture is fail-closed: every input is masked and built-in PII heuristics are on, until you explicitly relax them.

```bash theme={null}
curl -X PUT https://api.orbit.devotel.io/api/v1/session-replay/privacy \
  -H "X-API-Key: dv_live_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
    "mask_all_inputs": true,
    "mask_text_selectors": [".account-number"],
    "block_selectors": ["#payment-iframe"],
    "mask_pii_default": true
  }'
```

| Field                 | Purpose                                                                                                                                                              |
| --------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `mask_all_inputs`     | Masks every `<input>`, `<textarea>`, and `<select>` value. Keep this on unless you have a specific reason to capture form input verbatim.                            |
| `mask_text_selectors` | CSS selectors whose rendered text is replaced with asterisks — for PII shown as plain text rather than typed into a form.                                            |
| `block_selectors`     | CSS selectors whose entire subtree is never recorded — use this for payment iframes, ID-upload widgets, or anything you never want captured at all, not even masked. |
| `mask_pii_default`    | Applies the recorder's built-in heuristic masking to elements you've flagged sensitive (`.rr-mask` class or `data-rr-mask` attribute).                               |

The policy is account-wide and applies to new capture sessions from the next widget bootstrap — it doesn't retroactively change recordings you've already stored. Set `block_selectors` on your checkout or account-settings pages before you rely on session replay in production.

## Listing and playing back a recording

```bash theme={null}
curl https://api.orbit.devotel.io/api/v1/session-replay \
  -H "X-API-Key: dv_live_sk_your_key_here"
```

Lists your most recent recordings as lightweight summaries (no event payloads), newest first — this is what feeds the inbox's "Session replays" panel. To play one back, fetch it by the conversation it's attached to:

```bash theme={null}
curl https://api.orbit.devotel.io/api/v1/session-replay/conv_abc123 \
  -H "X-API-Key: dv_live_sk_your_key_here"
```

The response's `events` array is a raw [rrweb](https://github.com/rrweb-io/rrweb) event stream — feed it directly to an rrweb player to render the replay. Orbit stores and replays the payload without interpreting it.

## Deleting a recording

```bash theme={null}
curl -X DELETE https://api.orbit.devotel.io/api/v1/session-replay/conv_abc123 \
  -H "X-API-Key: dv_live_sk_your_key_here"
```

This removes the recording only — the conversation and its messages are untouched. It's idempotent, so a privacy or right-to-erasure workflow can call it safely without checking whether a recording still exists.

## Endpoints

| Method   | Path                                      | Purpose                        |
| -------- | ----------------------------------------- | ------------------------------ |
| `GET`    | `/api/v1/session-replay`                  | List recent recordings         |
| `GET`    | `/api/v1/session-replay/{conversationId}` | Fetch a recording for playback |
| `DELETE` | `/api/v1/session-replay/{conversationId}` | Purge a recording              |
| `GET`    | `/api/v1/session-replay/privacy`          | Get the masking policy         |
| `PUT`    | `/api/v1/session-replay/privacy`          | Update the masking policy      |

## See also

* [Session Replay API reference](/api-reference/session-replay) — full payload shapes and error codes
* [Co-browse](/api-reference/cobrowse) — the live, real-time counterpart to session replay
* [Inbox API](/api-reference/inbox) — where agents play recordings back