Export organization identity data

Outcome

Export the portable Auth-owned organization, membership, access, preference, session, and audit record set.

Full examples below were captured from isolated actual Auth handlers and repository SQL with disclosed simulations.

Before you start

• Verify the intended credential identity and pinned context; discover the exact organization id and published target authority. Display labels and synthetic fixture ids do not authorize a live call.

• Review the private destination for sensitive identity, access, contact, device/session and audit data before requesting a real export.

Discover the authorized organization

topolo whoami --json
topolo context ls --json
topolo actions get app_topolo_auth.organizations.export --detail --json
topolo actions get app_topolo_auth.organizations.list --detail --json

Organization directory discovery itself requires platform authority. An ordinary manager must use the organization already resolved from its credential context; directory refusal does not justify switching context.

Input fields

Response fields

A success contains success=true, message, data and an ISO timestamp. Refusals contain success=false and error instead. Directory/detail responses use camelCase projections; export preserves selected raw snake_case fields and JSON text.

Export requires verified platform authority or an owner, super_admin or admin role bound to that exact organization in the verified token. Ordinary membership is refused with HTTP 401 AUTH_ERROR; do not treat denied export authority as proof of credential expiry.

schemaVersion=1 and exportedAt identify the portable Auth-owned projection. organization is a raw snake_case row with settings still JSON text. users includes selected member fields and can include deleted accounts. Other named collections preserve their selected database fields; JSON-valued columns may remain text.

This is sensitive identity, membership, contact, permission, device/session and audit data. Selected password, key, client and token secrets are excluded, but arbitrary audit detail text is not guaranteed scrubbed. Store the export only in the intended authorized destination; never paste a real export into public documentation.

The export reads multiple collections in parallel across their Auth database bindings. It is not a point-in-time transaction, a complete application-content backup, an import/restore operation or proof of multi-D1 consistency. Empty collection arrays mean no matching rows in that observed query, not an unsupported feature.

A missing organization returns HTTP 404. The export lookup includes a stored soft-deleted row when the caller is authorized; unlike organizations.get, it has no includeDeleted input. No state changes and no rollback apply.

Worked examples

Every identifier, address and stored record below is synthetic. Resolve live identifiers and runtime authority before validating and planning the unchanged read. The CLI/MCP connection supplies its own credential; fixture token scenarios are not input fields. Empty fixture collections do not prove production feature coverage or provider parity.

Organization owner exports the portable Auth-owned record sets

Input · payload.json:

{
  "orgId": "org_read_fixture"
}

CLI:

topolo actions validate app_topolo_auth.organizations.export --data @payload.json --json
topolo actions plan app_topolo_auth.organizations.export --data @payload.json --json
topolo actions call app_topolo_auth.organizations.export --data @payload.json --detail --json

MCP read after topolo_validate_action and topolo_plan_action on the same input:

{
  "tool": "topolo_read_action",
  "arguments": {
    "actionId": "app_topolo_auth.organizations.export",
    "input": {
      "orgId": "org_read_fixture"
    }
  }
}

Captured local handler response · HTTP 200:

{
  "success": true,
  "message": "Organization export created",
  "data": {
    "schemaVersion": 1,
    "exportedAt": "2026-10-03T00:00:00.000Z",
    "organization": {
      "id": "org_read_fixture",
      "name": "org_read_fixture",
      "slug": "org_read_fixture",
      "logo_url": null,
      "domain": null,
      "settings": "{\"theme\":\"fixture\"}",
      "plan_type": "basic",
      "status": "active",
      "created_at": 1,
      "updated_at": 1
    },
    "users": [
      {
        "id": "usr_agent",
        "email": "usr_agent@example.test",
        "name": null,
        "avatar_url": null,
        "phone": null,
        "email_verified": 0,
        "status": "active",
        "metadata": "{\"topoloPrincipal\":{\"type\":\"agent_employee\"}}",
        "created_at": 1,
        "updated_at": null,
        "last_login": null,
        "last_password_change": null,
        "role": "member"
      },
      {
        "id": "usr_deleted",
        "email": "usr_deleted@example.test",
        "name": null,
        "avatar_url": null,
        "phone": null,
        "email_verified": 0,
        "status": "deleted",
        "metadata": "{}",
        "created_at": 1,
        "updated_at": null,
        "last_login": null,
        "last_password_change": null,
        "role": "member"
      },
      {
        "id": "usr_guest",
        "email": "usr_guest@example.test",
        "name": null,
        "avatar_url": null,
        "phone": null,
        "email_verified": 0,
        "status": "active",
        "metadata": "{}",
        "created_at": 1,
        "updated_at": null,
        "last_login": null,
        "last_password_change": null,
        "role": "guest"
      },
      {
        "id": "usr_local",
        "email": "usr_local@example.test",
        "name": null,
        "avatar_url": null,
        "phone": null,
        "email_verified": 0,
        "status": "active",
        "metadata": "{\"topoloPrincipal\":{\"type\":\"service_local\"}}",
        "created_at": 1,
        "updated_at": null,
        "last_login": null,
        "last_password_change": null,
        "role": "admin"
      },
      {
        "id": "usr_owner",
        "email": "usr_owner@example.test",
        "name": null,
        "avatar_url": null,
        "phone": null,
        "email_verified": 0,
        "status": "active",
        "metadata": "{}",
        "created_at": 1,
        "updated_at": null,
        "last_login": null,
        "last_password_change": null,
        "role": "owner"
      }
    ],
    "memberships": [
      {
        "id": "membership_usr_owner",
        "user_id": "usr_owner",
        "organization_id": "org_read_fixture",
        "role": "owner",
        "permissions": "[]",
        "joined_at": 1,
        "status": "active"
      },
      {
        "id": "membership_usr_guest",
        "user_id": "usr_guest",
        "organization_id": "org_read_fixture",
        "role": "guest",
        "permissions": "[]",
        "joined_at": 1,
        "status": "active"
      },
      {
        "id": "membership_usr_local",
        "user_id": "usr_local",
        "organization_id": "org_read_fixture",
        "role": "admin",
        "permissions": "[]",
        "joined_at": 1,
        "status": "active"
      },
      {
        "id": "membership_usr_agent",
        "user_id": "usr_agent",
        "organization_id": "org_read_fixture",
        "role": "member",
        "permissions": "[]",
        "joined_at": 1,
        "status": "active"
      },
      {
        "id": "membership_usr_deleted",
        "user_id": "usr_deleted",
        "organization_id": "org_read_fixture",
        "role": "member",
        "permissions": "[]",
        "joined_at": 1,
        "status": "active"
      }
    ],
    "services": [],
    "invitations": [],
    "emailAddresses": [],
    "apiKeys": [],
    "principals": [],
    "resourceGrants": [],
    "workspaces": [],
    "workspaceOwnerships": [],
    "roles": [],
    "roleBundles": [],
    "rolePermissions": [],
    "userRoles": [],
    "permissionOverrides": [],
    "seats": [],
    "oauthClients": [],
    "onboarding": [],
    "tours": [],
    "notificationPreferences": [],
    "notificationPolicies": [],
    "notificationRules": [],
    "sessions": [],
    "auditLogs": []
  },
  "timestamp": "2026-10-03T00:00:00.000Z"
}

Verify the result

• Match data.organization.id to the authorized input, schemaVersion to 1 and all named collection arrays; preserve the export in its intended private destination. Do not infer restore capability or application-content coverage.

Errors and recovery

Export refuses a missing organization

Input:

{
  "orgId": "org_missing"
}

Captured local refusal · HTTP 404:

{
  "success": false,
  "error": {
    "message": "Organization not found",
    "code": "NOT_FOUND",
    "details": null,
    "timestamp": "2026-10-03T00:00:00.000Z"
  }
}

Missing credential is refused

Input:

{
  "orgId": "org_read_fixture"
}

Captured local refusal · HTTP 401:

{
  "success": false,
  "error": {
    "message": "Access token required",
    "code": "AUTH_ERROR",
    "details": null,
    "timestamp": "2026-10-03T00:00:00.000Z"
  }
}

Ordinary membership cannot export the organization

Input:

{
  "orgId": "org_read_fixture"
}

Captured local refusal · HTTP 401:

{
  "success": false,
  "error": {
    "message": "You cannot export this organization",
    "code": "AUTH_ERROR",
    "details": null,
    "timestamp": "2026-10-03T00:00:00.000Z"
  }
}

Published recovery guidance

• AUTH_ERROR (HTTP 401): Verify the same pinned credential and exact refusal. For directory/detail/export this code also reports denied authority; do not change context or assume expiry.

• NOT_FOUND (HTTP 404): Rediscover the exact organization under the same authorized context. For detail, respect the platform-only deleted inclusion rule.

• SERVER_ERROR (HTTP 500): Preserve sanitized request/status evidence for an authorized Auth maintainer. These reads do not write; after the underlying store/parser issue is resolved, review a fresh read of the same target.

Recovery boundary

This read has no rollback. Keep the same discovered organization and credential context; respect authority refusal and preserve sanitized evidence for store failures. Re-read only after the underlying issue is resolved.

Discovery and evidence

Actual isolated organization handlers and repository SQL; no live identity, membership, billing or export was changed.

Real: Organization read/billing/privacy handlers; Organization directory/service and seat summary SQL; Portable export field selection and database routing; Canonical migration-created tables and SQLite engine; Response serialization and permission helpers. Simulated: Verified token identities and hydrated membership lookup; Empty application icon catalog; Clock, synthetic records and deliberate malformed settings; All split bindings co-located in isolated SQLite; no multi-D1 provider parity. No live organization, identity, membership, export, billing or seat changed.