Outcome
List the owner, explicit members, and bounded same-organization assignment candidates for one workspace.
These examples prove local handler behavior with real isolated SQL and explicitly simulated identity/permission dependencies.
Before you start
-
Verify identity and the current credential-scoped action contract before preparing input. Workspace-access operations require a consistent active organization context and target workspace authority; metadata discovery does not prove execution permission.
-
Discover the existing canonical workspace in the exact application/organization and intended recipient. These actions do not provision identities, organization memberships, application seats or entitlement.
Discover the target
topolo whoami --json
topolo apps --json
topolo actions get app_topolo_auth.workspace_access.members.list --detail --json
Read app_topolo_auth.workspace_access.list_mine for this organization/app; copy data.resources[].id. For management read workspace_access.members.list. Recipient candidates require current active membership and app access.
Input fields
| Field | Required | Meaning |
|---|---|---|
resourceId | Yes | Canonical workspace id copied from workspace_access.list_mine data.resources[].id, not a resourceId property. Use a current active workspace in the exact organization/application. |
org_id | Yes | Exact organization for this read. The authenticated organization context must agree, unless valid platform authority is present; explicit Personal or conflicting aliases are always refused. |
app_id | Yes | Canonical application identifier from authorized discovery. Workspace identity and grants are isolated by application. |
Effects
- Reads current ownership, explicit member grants and a bounded candidate directory for a workspace the caller can manage.
Interpret the response
Raw target responses use success/message/data/timestamp. Grant returns HTTP 201; the other successes return 200. CLI/MCP envelopes may wrap or project the target response. Epoch-number record times differ from the ISO envelope timestamp.
list_mine data.resources contains canonical workspace records whose identifier is id. accessMode all and canManageAll true require organization owner/super_admin or valid platform authority; ordinary organization admin remains restricted. Owner and explicit unexpired invited_member grants drive the restricted projection.
members.list returns one owner, explicit member grants and at most 500 directory candidates. This directory has no continuation and is not guaranteed exhaustive. A candidate may still fail active membership/app assignment validation. No returned user data should be exported beyond the authorized workflow.
Member data.id is the grant id after profile and grant objects are combined; data.userId is the recipient identity id. Owner data.id is its user id. Owner profile can contain only id/name/accessRole when it is absent from the directory, and member profile fields can be absent. Profile activeContext/orgId describe that user context and do not replace the workspace organization boundary.
Grant is a natural-key upsert. Repetition changes scope, clears old revocation, resets expiry/metadata through creation defaults and preserves its id/createdAt. It does not create organization membership, application assignment, a seat or ownership. Audit persistence is nonfatal; successful grant/revoke/transfer does not prove an audit entry.
Member revoke returns userId/resourceId and removes explicit access only. Repetition returns NOT_FOUND. Owner removal returns CONFLICT. Organization-wide authority and independent application permissions still require separate verification.
The workspace owner and ownership projection update in one atomic access-database batch. Removing the new owner redundant grant and retaining/removing the previous owner grants occur afterward in separate writes; the full transfer is not atomic. A 500 can leave a new owner and a redundant member grant while previous-owner retention is unfinished.
A blind retry after partial transfer is unsafe: the former owner may be denied and a transfer to the now-current owner returns CONFLICT. Read members/current ownership first. The public revoke action refuses the current owner even if a redundant owner grant remains; this family has no customer cleanup operation for that partial state. Preserve evidence and seek authorized operator repair rather than inventing an endpoint or bypassing ownership.
Worked examples
These are complete raw target-handler responses, not CLI/gateway envelopes or live authorization proof. Replace synthetic identifiers using authorized discovery. Save only the reviewed input as payload.json; inspect validation and plan before executing. --confirm assumes the intended operation is approved. Metadata read-back requires separate recipient-principal and owning-application access tests.
Owner sees directory candidates and no explicit members
Input · payload.json:
{
"org_id": "org_example",
"app_id": "app_topolo_campaigns",
"resourceId": "ws_fixture_one"
}
CLI:
topolo actions validate app_topolo_auth.workspace_access.members.list --data @payload.json --json
topolo actions plan app_topolo_auth.workspace_access.members.list --data @payload.json --json
topolo actions call app_topolo_auth.workspace_access.members.list --data @payload.json --json
MCP call after validation and plan review:
{
"tool": "topolo_read_action",
"arguments": {
"actionId": "app_topolo_auth.workspace_access.members.list",
"input": {
"org_id": "org_example",
"app_id": "app_topolo_campaigns",
"resourceId": "ws_fixture_one"
}
}
}
Captured local handler response · HTTP 200:
{
"success": true,
"message": "Workspace members fetched",
"data": {
"resourceId": "ws_fixture_one",
"owner": {
"id": "usr_owner",
"email": "usr_owner@example.test",
"name": "owner",
"phone": null,
"profilePicture": null,
"status": "active",
"emailVerified": 1,
"orgId": "org_example",
"orgName": "Fixture organization",
"orgSlug": "example",
"orgStatus": "active",
"role": "member",
"principalType": "organization_member",
"principalServices": [],
"launcherEligible": true,
"jobTitle": null,
"department": null,
"createdAt": 1,
"lastPasswordChange": null,
"passwordConfigured": false,
"token_version": 0,
"organizationMemberships": [
{
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "active",
"joinedAt": 1
}
],
"householdMemberships": [],
"membershipSummary": {
"organizations": [
{
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "active",
"joinedAt": 1
}
],
"households": []
},
"availableContexts": [
{
"type": "personal",
"id": "usr_owner",
"name": "owner",
"slug": "personal-usr_owner",
"role": "owner",
"status": "active",
"membershipStatus": "active"
},
{
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "active",
"joinedAt": 1
}
],
"activeContextType": "organization",
"activeContextId": "org_example",
"activeContext": {
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "active",
"joinedAt": 1
},
"selectedHouseholdId": null,
"selectedHousehold": null,
"householdId": null,
"householdName": null,
"householdSlug": null,
"accessRole": "owner"
},
"members": [],
"assignableUsers": [
{
"id": "usr_member",
"email": "usr_member@example.test",
"name": "member",
"phone": null,
"profilePicture": null,
"status": "active",
"emailVerified": 1,
"orgId": "org_example",
"orgName": "Fixture organization",
"orgSlug": "example",
"orgStatus": "active",
"role": "member",
"principalType": "organization_member",
"principalServices": [],
"launcherEligible": true,
"jobTitle": null,
"department": null,
"createdAt": 1,
"lastPasswordChange": null,
"passwordConfigured": false,
"token_version": 0,
"organizationMemberships": [
{
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "active",
"joinedAt": 1
}
],
"householdMemberships": [],
"membershipSummary": {
"organizations": [
{
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "active",
"joinedAt": 1
}
],
"households": []
},
"availableContexts": [
{
"type": "personal",
"id": "usr_member",
"name": "member",
"slug": "personal-usr_member",
"role": "owner",
"status": "active",
"membershipStatus": "active"
},
{
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "active",
"joinedAt": 1
}
],
"activeContextType": "organization",
"activeContextId": "org_example",
"activeContext": {
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "active",
"joinedAt": 1
},
"selectedHouseholdId": null,
"selectedHousehold": null,
"householdId": null,
"householdName": null,
"householdSlug": null
},
{
"id": "usr_new_owner",
"email": "usr_new_owner@example.test",
"name": "new_owner",
"phone": null,
"profilePicture": null,
"status": "active",
"emailVerified": 1,
"orgId": "org_example",
"orgName": "Fixture organization",
"orgSlug": "example",
"orgStatus": "active",
"role": "member",
"principalType": "organization_member",
"principalServices": [],
"launcherEligible": true,
"jobTitle": null,
"department": null,
"createdAt": 1,
"lastPasswordChange": null,
"passwordConfigured": false,
"token_version": 0,
"organizationMemberships": [
{
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "active",
"joinedAt": 1
}
],
"householdMemberships": [],
"membershipSummary": {
"organizations": [
{
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "active",
"joinedAt": 1
}
],
"households": []
},
"availableContexts": [
{
"type": "personal",
"id": "usr_new_owner",
"name": "new_owner",
"slug": "personal-usr_new_owner",
"role": "owner",
"status": "active",
"membershipStatus": "active"
},
{
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "active",
"joinedAt": 1
}
],
"activeContextType": "organization",
"activeContextId": "org_example",
"activeContext": {
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "active",
"joinedAt": 1
},
"selectedHouseholdId": null,
"selectedHousehold": null,
"householdId": null,
"householdName": null,
"householdSlug": null
},
{
"id": "usr_inactive",
"email": "usr_inactive@example.test",
"name": "inactive",
"phone": null,
"profilePicture": null,
"status": "active",
"emailVerified": 1,
"orgId": "org_example",
"orgName": "Fixture organization",
"orgSlug": "example",
"orgStatus": "active",
"role": "member",
"principalType": "organization_member",
"principalServices": [],
"launcherEligible": true,
"jobTitle": null,
"department": null,
"createdAt": 1,
"lastPasswordChange": null,
"passwordConfigured": false,
"token_version": 0,
"organizationMemberships": [
{
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "suspended",
"joinedAt": 1
}
],
"householdMemberships": [],
"membershipSummary": {
"organizations": [
{
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "suspended",
"joinedAt": 1
}
],
"households": []
},
"availableContexts": [
{
"type": "personal",
"id": "usr_inactive",
"name": "inactive",
"slug": "personal-usr_inactive",
"role": "owner",
"status": "active",
"membershipStatus": "active"
},
{
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "suspended",
"joinedAt": 1
}
],
"activeContextType": "organization",
"activeContextId": "org_example",
"activeContext": {
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "suspended",
"joinedAt": 1
},
"selectedHouseholdId": null,
"selectedHousehold": null,
"householdId": null,
"householdName": null,
"householdSlug": null
}
]
},
"timestamp": "2026-10-02T18:24:03.957Z"
}
Member listing distinguishes grant id from recipient userId
Input · payload.json:
{
"org_id": "org_example",
"app_id": "app_topolo_campaigns",
"resourceId": "ws_fixture_one"
}
CLI:
topolo actions validate app_topolo_auth.workspace_access.members.list --data @payload.json --json
topolo actions plan app_topolo_auth.workspace_access.members.list --data @payload.json --json
topolo actions call app_topolo_auth.workspace_access.members.list --data @payload.json --json
MCP call after validation and plan review:
{
"tool": "topolo_read_action",
"arguments": {
"actionId": "app_topolo_auth.workspace_access.members.list",
"input": {
"org_id": "org_example",
"app_id": "app_topolo_campaigns",
"resourceId": "ws_fixture_one"
}
}
}
Captured local handler response · HTTP 200:
{
"success": true,
"message": "Workspace members fetched",
"data": {
"resourceId": "ws_fixture_one",
"owner": {
"id": "usr_owner",
"email": "usr_owner@example.test",
"name": "owner",
"phone": null,
"profilePicture": null,
"status": "active",
"emailVerified": 1,
"orgId": "org_example",
"orgName": "Fixture organization",
"orgSlug": "example",
"orgStatus": "active",
"role": "member",
"principalType": "organization_member",
"principalServices": [],
"launcherEligible": true,
"jobTitle": null,
"department": null,
"createdAt": 1,
"lastPasswordChange": null,
"passwordConfigured": false,
"token_version": 0,
"organizationMemberships": [
{
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "active",
"joinedAt": 1
}
],
"householdMemberships": [],
"membershipSummary": {
"organizations": [
{
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "active",
"joinedAt": 1
}
],
"households": []
},
"availableContexts": [
{
"type": "personal",
"id": "usr_owner",
"name": "owner",
"slug": "personal-usr_owner",
"role": "owner",
"status": "active",
"membershipStatus": "active"
},
{
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "active",
"joinedAt": 1
}
],
"activeContextType": "organization",
"activeContextId": "org_example",
"activeContext": {
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "active",
"joinedAt": 1
},
"selectedHouseholdId": null,
"selectedHousehold": null,
"householdId": null,
"householdName": null,
"householdSlug": null,
"accessRole": "owner"
},
"members": [
{
"id": "rg_Pt2LKxHpEsi-",
"email": "usr_member@example.test",
"name": "member",
"phone": null,
"profilePicture": null,
"status": "active",
"emailVerified": 1,
"orgId": "org_example",
"orgName": "Fixture organization",
"orgSlug": "example",
"orgStatus": "active",
"role": "member",
"principalType": "organization_member",
"principalServices": [],
"launcherEligible": true,
"jobTitle": null,
"department": null,
"createdAt": 1790965443,
"lastPasswordChange": null,
"passwordConfigured": false,
"token_version": 0,
"organizationMemberships": [
{
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "active",
"joinedAt": 1
}
],
"householdMemberships": [],
"membershipSummary": {
"organizations": [
{
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "active",
"joinedAt": 1
}
],
"households": []
},
"availableContexts": [
{
"type": "personal",
"id": "usr_member",
"name": "member",
"slug": "personal-usr_member",
"role": "owner",
"status": "active",
"membershipStatus": "active"
},
{
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "active",
"joinedAt": 1
}
],
"activeContextType": "organization",
"activeContextId": "org_example",
"activeContext": {
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "active",
"joinedAt": 1
},
"selectedHouseholdId": null,
"selectedHousehold": null,
"householdId": null,
"householdName": null,
"householdSlug": null,
"userId": "usr_member",
"scope": "read",
"grantedBy": "usr_owner",
"accessRole": "member"
}
],
"assignableUsers": [
{
"id": "usr_new_owner",
"email": "usr_new_owner@example.test",
"name": "new_owner",
"phone": null,
"profilePicture": null,
"status": "active",
"emailVerified": 1,
"orgId": "org_example",
"orgName": "Fixture organization",
"orgSlug": "example",
"orgStatus": "active",
"role": "member",
"principalType": "organization_member",
"principalServices": [],
"launcherEligible": true,
"jobTitle": null,
"department": null,
"createdAt": 1,
"lastPasswordChange": null,
"passwordConfigured": false,
"token_version": 0,
"organizationMemberships": [
{
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "active",
"joinedAt": 1
}
],
"householdMemberships": [],
"membershipSummary": {
"organizations": [
{
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "active",
"joinedAt": 1
}
],
"households": []
},
"availableContexts": [
{
"type": "personal",
"id": "usr_new_owner",
"name": "new_owner",
"slug": "personal-usr_new_owner",
"role": "owner",
"status": "active",
"membershipStatus": "active"
},
{
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "active",
"joinedAt": 1
}
],
"activeContextType": "organization",
"activeContextId": "org_example",
"activeContext": {
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "active",
"joinedAt": 1
},
"selectedHouseholdId": null,
"selectedHousehold": null,
"householdId": null,
"householdName": null,
"householdSlug": null
},
{
"id": "usr_inactive",
"email": "usr_inactive@example.test",
"name": "inactive",
"phone": null,
"profilePicture": null,
"status": "active",
"emailVerified": 1,
"orgId": "org_example",
"orgName": "Fixture organization",
"orgSlug": "example",
"orgStatus": "active",
"role": "member",
"principalType": "organization_member",
"principalServices": [],
"launcherEligible": true,
"jobTitle": null,
"department": null,
"createdAt": 1,
"lastPasswordChange": null,
"passwordConfigured": false,
"token_version": 0,
"organizationMemberships": [
{
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "suspended",
"joinedAt": 1
}
],
"householdMemberships": [],
"membershipSummary": {
"organizations": [
{
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "suspended",
"joinedAt": 1
}
],
"households": []
},
"availableContexts": [
{
"type": "personal",
"id": "usr_inactive",
"name": "inactive",
"slug": "personal-usr_inactive",
"role": "owner",
"status": "active",
"membershipStatus": "active"
},
{
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "suspended",
"joinedAt": 1
}
],
"activeContextType": "organization",
"activeContextId": "org_example",
"activeContext": {
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "suspended",
"joinedAt": 1
},
"selectedHouseholdId": null,
"selectedHousehold": null,
"householdId": null,
"householdName": null,
"householdSlug": null
}
]
},
"timestamp": "2026-10-02T18:24:03.961Z"
}
New owner verifies one owner and previous owner admin membership
Input · payload.json:
{
"org_id": "org_example",
"app_id": "app_topolo_campaigns",
"resourceId": "ws_fixture_one"
}
CLI:
topolo actions validate app_topolo_auth.workspace_access.members.list --data @payload.json --json
topolo actions plan app_topolo_auth.workspace_access.members.list --data @payload.json --json
topolo actions call app_topolo_auth.workspace_access.members.list --data @payload.json --json
MCP call after validation and plan review:
{
"tool": "topolo_read_action",
"arguments": {
"actionId": "app_topolo_auth.workspace_access.members.list",
"input": {
"org_id": "org_example",
"app_id": "app_topolo_campaigns",
"resourceId": "ws_fixture_one"
}
}
}
Captured local handler response · HTTP 200:
{
"success": true,
"message": "Workspace members fetched",
"data": {
"resourceId": "ws_fixture_one",
"owner": {
"id": "usr_new_owner",
"email": "usr_new_owner@example.test",
"name": "new_owner",
"phone": null,
"profilePicture": null,
"status": "active",
"emailVerified": 1,
"orgId": "org_example",
"orgName": "Fixture organization",
"orgSlug": "example",
"orgStatus": "active",
"role": "member",
"principalType": "organization_member",
"principalServices": [],
"launcherEligible": true,
"jobTitle": null,
"department": null,
"createdAt": 1,
"lastPasswordChange": null,
"passwordConfigured": false,
"token_version": 0,
"organizationMemberships": [
{
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "active",
"joinedAt": 1
}
],
"householdMemberships": [],
"membershipSummary": {
"organizations": [
{
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "active",
"joinedAt": 1
}
],
"households": []
},
"availableContexts": [
{
"type": "personal",
"id": "usr_new_owner",
"name": "new_owner",
"slug": "personal-usr_new_owner",
"role": "owner",
"status": "active",
"membershipStatus": "active"
},
{
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "active",
"joinedAt": 1
}
],
"activeContextType": "organization",
"activeContextId": "org_example",
"activeContext": {
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "active",
"joinedAt": 1
},
"selectedHouseholdId": null,
"selectedHousehold": null,
"householdId": null,
"householdName": null,
"householdSlug": null,
"accessRole": "owner"
},
"members": [
{
"id": "rg_lx5TaQiKzIPo",
"email": "usr_owner@example.test",
"name": "owner",
"phone": null,
"profilePicture": null,
"status": "active",
"emailVerified": 1,
"orgId": "org_example",
"orgName": "Fixture organization",
"orgSlug": "example",
"orgStatus": "active",
"role": "member",
"principalType": "organization_member",
"principalServices": [],
"launcherEligible": true,
"jobTitle": null,
"department": null,
"createdAt": 1790965443,
"lastPasswordChange": null,
"passwordConfigured": false,
"token_version": 0,
"organizationMemberships": [
{
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "active",
"joinedAt": 1
}
],
"householdMemberships": [],
"membershipSummary": {
"organizations": [
{
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "active",
"joinedAt": 1
}
],
"households": []
},
"availableContexts": [
{
"type": "personal",
"id": "usr_owner",
"name": "owner",
"slug": "personal-usr_owner",
"role": "owner",
"status": "active",
"membershipStatus": "active"
},
{
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "active",
"joinedAt": 1
}
],
"activeContextType": "organization",
"activeContextId": "org_example",
"activeContext": {
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "active",
"joinedAt": 1
},
"selectedHouseholdId": null,
"selectedHousehold": null,
"householdId": null,
"householdName": null,
"householdSlug": null,
"userId": "usr_owner",
"scope": "admin",
"grantedBy": "usr_owner",
"accessRole": "member"
}
],
"assignableUsers": [
{
"id": "usr_member",
"email": "usr_member@example.test",
"name": "member",
"phone": null,
"profilePicture": null,
"status": "active",
"emailVerified": 1,
"orgId": "org_example",
"orgName": "Fixture organization",
"orgSlug": "example",
"orgStatus": "active",
"role": "member",
"principalType": "organization_member",
"principalServices": [],
"launcherEligible": true,
"jobTitle": null,
"department": null,
"createdAt": 1,
"lastPasswordChange": null,
"passwordConfigured": false,
"token_version": 0,
"organizationMemberships": [
{
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "active",
"joinedAt": 1
}
],
"householdMemberships": [],
"membershipSummary": {
"organizations": [
{
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "active",
"joinedAt": 1
}
],
"households": []
},
"availableContexts": [
{
"type": "personal",
"id": "usr_member",
"name": "member",
"slug": "personal-usr_member",
"role": "owner",
"status": "active",
"membershipStatus": "active"
},
{
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "active",
"joinedAt": 1
}
],
"activeContextType": "organization",
"activeContextId": "org_example",
"activeContext": {
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "active",
"joinedAt": 1
},
"selectedHouseholdId": null,
"selectedHousehold": null,
"householdId": null,
"householdName": null,
"householdSlug": null
},
{
"id": "usr_inactive",
"email": "usr_inactive@example.test",
"name": "inactive",
"phone": null,
"profilePicture": null,
"status": "active",
"emailVerified": 1,
"orgId": "org_example",
"orgName": "Fixture organization",
"orgSlug": "example",
"orgStatus": "active",
"role": "member",
"principalType": "organization_member",
"principalServices": [],
"launcherEligible": true,
"jobTitle": null,
"department": null,
"createdAt": 1,
"lastPasswordChange": null,
"passwordConfigured": false,
"token_version": 0,
"organizationMemberships": [
{
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "suspended",
"joinedAt": 1
}
],
"householdMemberships": [],
"membershipSummary": {
"organizations": [
{
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "suspended",
"joinedAt": 1
}
],
"households": []
},
"availableContexts": [
{
"type": "personal",
"id": "usr_inactive",
"name": "inactive",
"slug": "personal-usr_inactive",
"role": "owner",
"status": "active",
"membershipStatus": "active"
},
{
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "suspended",
"joinedAt": 1
}
],
"activeContextType": "organization",
"activeContextId": "org_example",
"activeContext": {
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "suspended",
"joinedAt": 1
},
"selectedHouseholdId": null,
"selectedHousehold": null,
"householdId": null,
"householdName": null,
"householdSlug": null
}
]
},
"timestamp": "2026-10-02T18:24:03.964Z"
}
Read current owner and remaining grants after partial transfer
Input · payload.json:
{
"org_id": "org_example",
"app_id": "app_topolo_campaigns",
"resourceId": "ws_fixture_one"
}
CLI:
topolo actions validate app_topolo_auth.workspace_access.members.list --data @payload.json --json
topolo actions plan app_topolo_auth.workspace_access.members.list --data @payload.json --json
topolo actions call app_topolo_auth.workspace_access.members.list --data @payload.json --json
MCP call after validation and plan review:
{
"tool": "topolo_read_action",
"arguments": {
"actionId": "app_topolo_auth.workspace_access.members.list",
"input": {
"org_id": "org_example",
"app_id": "app_topolo_campaigns",
"resourceId": "ws_fixture_one"
}
}
}
Captured local handler response · HTTP 200:
{
"success": true,
"message": "Workspace members fetched",
"data": {
"resourceId": "ws_fixture_one",
"owner": {
"id": "usr_new_owner",
"email": "usr_new_owner@example.test",
"name": "new_owner",
"phone": null,
"profilePicture": null,
"status": "active",
"emailVerified": 1,
"orgId": "org_example",
"orgName": "Fixture organization",
"orgSlug": "example",
"orgStatus": "active",
"role": "member",
"principalType": "organization_member",
"principalServices": [],
"launcherEligible": true,
"jobTitle": null,
"department": null,
"createdAt": 1,
"lastPasswordChange": null,
"passwordConfigured": false,
"token_version": 0,
"organizationMemberships": [
{
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "active",
"joinedAt": 1
}
],
"householdMemberships": [],
"membershipSummary": {
"organizations": [
{
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "active",
"joinedAt": 1
}
],
"households": []
},
"availableContexts": [
{
"type": "personal",
"id": "usr_new_owner",
"name": "new_owner",
"slug": "personal-usr_new_owner",
"role": "owner",
"status": "active",
"membershipStatus": "active"
},
{
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "active",
"joinedAt": 1
}
],
"activeContextType": "organization",
"activeContextId": "org_example",
"activeContext": {
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "active",
"joinedAt": 1
},
"selectedHouseholdId": null,
"selectedHousehold": null,
"householdId": null,
"householdName": null,
"householdSlug": null,
"accessRole": "owner"
},
"members": [
{
"id": "rg_OjH_N222AB5D",
"email": "usr_new_owner@example.test",
"name": "new_owner",
"phone": null,
"profilePicture": null,
"status": "active",
"emailVerified": 1,
"orgId": "org_example",
"orgName": "Fixture organization",
"orgSlug": "example",
"orgStatus": "active",
"role": "member",
"principalType": "organization_member",
"principalServices": [],
"launcherEligible": true,
"jobTitle": null,
"department": null,
"createdAt": 1790965443,
"lastPasswordChange": null,
"passwordConfigured": false,
"token_version": 0,
"organizationMemberships": [
{
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "active",
"joinedAt": 1
}
],
"householdMemberships": [],
"membershipSummary": {
"organizations": [
{
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "active",
"joinedAt": 1
}
],
"households": []
},
"availableContexts": [
{
"type": "personal",
"id": "usr_new_owner",
"name": "new_owner",
"slug": "personal-usr_new_owner",
"role": "owner",
"status": "active",
"membershipStatus": "active"
},
{
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "active",
"joinedAt": 1
}
],
"activeContextType": "organization",
"activeContextId": "org_example",
"activeContext": {
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "active",
"joinedAt": 1
},
"selectedHouseholdId": null,
"selectedHousehold": null,
"householdId": null,
"householdName": null,
"householdSlug": null,
"userId": "usr_new_owner",
"scope": "read_write",
"grantedBy": "usr_owner",
"accessRole": "member"
}
],
"assignableUsers": [
{
"id": "usr_owner",
"email": "usr_owner@example.test",
"name": "owner",
"phone": null,
"profilePicture": null,
"status": "active",
"emailVerified": 1,
"orgId": "org_example",
"orgName": "Fixture organization",
"orgSlug": "example",
"orgStatus": "active",
"role": "member",
"principalType": "organization_member",
"principalServices": [],
"launcherEligible": true,
"jobTitle": null,
"department": null,
"createdAt": 1,
"lastPasswordChange": null,
"passwordConfigured": false,
"token_version": 0,
"organizationMemberships": [
{
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "active",
"joinedAt": 1
}
],
"householdMemberships": [],
"membershipSummary": {
"organizations": [
{
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "active",
"joinedAt": 1
}
],
"households": []
},
"availableContexts": [
{
"type": "personal",
"id": "usr_owner",
"name": "owner",
"slug": "personal-usr_owner",
"role": "owner",
"status": "active",
"membershipStatus": "active"
},
{
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "active",
"joinedAt": 1
}
],
"activeContextType": "organization",
"activeContextId": "org_example",
"activeContext": {
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "active",
"joinedAt": 1
},
"selectedHouseholdId": null,
"selectedHousehold": null,
"householdId": null,
"householdName": null,
"householdSlug": null
},
{
"id": "usr_member",
"email": "usr_member@example.test",
"name": "member",
"phone": null,
"profilePicture": null,
"status": "active",
"emailVerified": 1,
"orgId": "org_example",
"orgName": "Fixture organization",
"orgSlug": "example",
"orgStatus": "active",
"role": "member",
"principalType": "organization_member",
"principalServices": [],
"launcherEligible": true,
"jobTitle": null,
"department": null,
"createdAt": 1,
"lastPasswordChange": null,
"passwordConfigured": false,
"token_version": 0,
"organizationMemberships": [
{
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "active",
"joinedAt": 1
}
],
"householdMemberships": [],
"membershipSummary": {
"organizations": [
{
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "active",
"joinedAt": 1
}
],
"households": []
},
"availableContexts": [
{
"type": "personal",
"id": "usr_member",
"name": "member",
"slug": "personal-usr_member",
"role": "owner",
"status": "active",
"membershipStatus": "active"
},
{
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "active",
"joinedAt": 1
}
],
"activeContextType": "organization",
"activeContextId": "org_example",
"activeContext": {
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "active",
"joinedAt": 1
},
"selectedHouseholdId": null,
"selectedHousehold": null,
"householdId": null,
"householdName": null,
"householdSlug": null
},
{
"id": "usr_inactive",
"email": "usr_inactive@example.test",
"name": "inactive",
"phone": null,
"profilePicture": null,
"status": "active",
"emailVerified": 1,
"orgId": "org_example",
"orgName": "Fixture organization",
"orgSlug": "example",
"orgStatus": "active",
"role": "member",
"principalType": "organization_member",
"principalServices": [],
"launcherEligible": true,
"jobTitle": null,
"department": null,
"createdAt": 1,
"lastPasswordChange": null,
"passwordConfigured": false,
"token_version": 0,
"organizationMemberships": [
{
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "suspended",
"joinedAt": 1
}
],
"householdMemberships": [],
"membershipSummary": {
"organizations": [
{
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "suspended",
"joinedAt": 1
}
],
"households": []
},
"availableContexts": [
{
"type": "personal",
"id": "usr_inactive",
"name": "inactive",
"slug": "personal-usr_inactive",
"role": "owner",
"status": "active",
"membershipStatus": "active"
},
{
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "suspended",
"joinedAt": 1
}
],
"activeContextType": "organization",
"activeContextId": "org_example",
"activeContext": {
"type": "organization",
"id": "org_example",
"name": "Fixture organization",
"slug": "example",
"status": "active",
"role": "member",
"membershipStatus": "suspended",
"joinedAt": 1
},
"selectedHouseholdId": null,
"selectedHousehold": null,
"householdId": null,
"householdName": null,
"householdSlug": null
}
]
},
"timestamp": "2026-10-02T18:24:03.965Z"
}
Verify the result
-
Compare data.owner.id with the intended owner; use members[].userId for recipients and members[].id for grant identity. Check for a redundant current-owner member entry after a failed transfer.
-
Choose candidates through authorized discovery and let the write validate active membership and app access. The 500-row directory does not prove the entire organization was examined.
Errors and recovery
Ordinary admin cannot manage an unowned workspace
Captured local refusal · HTTP 403:
{
"input": {
"org_id": "org_example",
"app_id": "app_topolo_campaigns",
"resourceId": "ws_fixture_one"
},
"response": {
"success": false,
"error": {
"message": "Only the workspace owner or organization owner can manage access",
"code": "FORBIDDEN",
"details": null,
"timestamp": "2026-10-02T18:24:03.963Z"
}
}
}
Missing workspace is refused
Captured local refusal · HTTP 404:
{
"input": {
"org_id": "org_example",
"app_id": "app_topolo_campaigns",
"resourceId": "ws_missing"
},
"response": {
"success": false,
"error": {
"message": "Workspace ownership not found",
"code": "NOT_FOUND",
"details": null,
"timestamp": "2026-10-02T18:24:03.963Z"
}
}
}
Published recovery guidance
-
VALIDATION_ERROR(HTTP 400): Correct the reported fields and use an existing active same-organization app member. Directory candidates alone do not prove eligibility. -
AUTH_ERROR(HTTP 401): Verify the intended authenticated identity and refresh an expired token if necessary. Do not change credential context automatically. -
FORBIDDEN(HTTP 403): Check consistent active organization context and exact workspace management authority. Personal/conflicting context is refused even with stale org metadata or platform roles. -
NOT_FOUND(HTTP 404): Refresh canonical workspace/member discovery. An already revoked member grant is absent; do not fabricate a stored grant. -
CONFLICT(HTTP 409): Read current owner and grants before reviewing any new decision. Do not grant/revoke the owner as a member or blindly repeat a completed/partial transfer. -
SERVER_ERROR(HTTP 500): Read current owner and member grants before retrying. Ownership may already have changed. Preserve a partial owner/grant state for authorized repair when customer actions cannot complete cleanup.
Recovery boundaries
Read-only. Refresh exact workspace discovery and management authority; preserve a partial transfer state for owner review.
Discovery and evidence
This record belongs to app_topolo_auth. Local tests prove real canonical workspace/grant SQL and handler responses with simulated identity, directory lookup, memberships and application assignment. They do not prove recipient sign-in, invitation delivery, owning-application resource enforcement, live permissions, deployment or production completion.