Erase organization data

Outcome

Deletes the authenticated organization’s Blog articles, revisions and workspace rows. Declared D1 foreign-key cascades remove dependent publication, settings, media-metadata, template, search and domain records. Stored R2 objects are not purged by this handler. External custom hostnames and queued or scheduled provider work are not detached or canceled here. Do not claim complete provider or storage erasure.

Before you start

• Verify identity and the intended environment with topolo whoami before selecting an explicitly authorized organization.
• Discover the published privacy:write permission.
• This action uses the authenticated user and organization; it does not require a separate workspace binding.
• Review the actual state change and confirm the unchanged plan before execution. Fixture ids and provider responses grant no live authority.

Discover the target

topolo whoami --json
topolo actions get app_topolo_blog.organizations.data.erase --detail --json
topolo workspaces list topolo-blog --json

• organizationId: Exact authenticated organization id. Export and erasure span that organization, not just the selected workspace.

Request

DELETE /api/organizations/{organizationId}/data

Inspect parameters and test this action.

Input fields

Worked examples

Documentation source snapshot: TopoloBlog 80d6961207a4ca688b7e9edb947dda720051ad32 (tree 534a285e739a27c1ea9e2c187ce8863824f6c590). The examples retain local fixture captures labeled baseline 2c64c35bf291a47bb3a0c597dcea46ccb47e2a08; their exact executed working tree is not established here. They were not rerun at this documentation snapshot. The production catalog marker topolo.app.json is not a deployed worker revision. Recovery metadata read-back on 18 October 2026 associates the current production Blog API and web deployments with this source through the 17 October release receipt. This establishes applicable deployed source; it does not make these examples current production captures.

Actual exported Blog Worker, local Miniflare D1/R2 and all committed migrations. Auth, Insights, DNS, Cloudflare for SaaS, error reporting, queue and scheduled-workflow boundaries are synthetic and outbound fetch is sealed. No deployed provider, delivery or scheduled execution outcome is established. English examples use the packaged test translation release; article checks and widget labels follow the verified request locale. No live translation release is proved by this fixture.

Save a reviewed input as payload.json. Replace fixture identifiers using discovery in the authorized context.

topolo actions validate app_topolo_blog.organizations.data.erase --data @payload.json --json
topolo actions plan app_topolo_blog.organizations.data.erase --data @payload.json --confirm --json
topolo actions call app_topolo_blog.organizations.data.erase --data @payload.json --confirm --detail --json

MCP uses the same reviewed input. Replace the synthetic workspace resourceId through discovery when a binding is shown:

{
  "tool": "topolo_prepare_action",
  "arguments": {
    "actionId": "app_topolo_blog.organizations.data.erase",
    "input": {
      "organizationId": "org_blog_fixture",
      "confirmation": "ERASE"
    },
    "confirm": true
  }
}

{
  "tool": "topolo_call_action",
  "arguments": {
    "actionId": "app_topolo_blog.organizations.data.erase",
    "input": {
      "organizationId": "org_blog_fixture",
      "confirmation": "ERASE"
    },
    "confirm": true,
    "detail": true
  }
}

Refused request · HTTP 403 · organization_forbidden

Input · payload.json:

{
  "organizationId": "org_foreign_fixture",
  "confirmation": "ERASE"
}

Source-reviewed illustration (retained local fixture response; not a current production capture):

{
  "error": "organization_forbidden"
}

Verify the active organization, exact permission and workspace grant. A foreign organization cannot be substituted for the authenticated owner.

Successful response · HTTP 200

Input · payload.json:

{
  "organizationId": "org_blog_fixture",
  "confirmation": "ERASE"
}

Source-reviewed illustration (retained local fixture response; not a current production capture):

{
  "data": {
    "organizationId": "org_blog_fixture",
    "erased": true
  }
}

Call app_topolo_blog.organizations.data.export for the same organization and confirm it comes back empty.

Refused request · HTTP 401 · auth_error

Input · payload.json:

{
  "organizationId": "org_blog_fixture",
  "confirmation": "ERASE"
}

Source-reviewed illustration (retained local fixture response; not a current production capture):

{
  "error": "Authentication token required"
}

Sign in again in the intended environment using a valid credential. Preserve the returned handler message; SDK auth_error can represent several authentication refusals.

Verify the result

• Read organizations.data.export in the same authorized organization and verify empty articles and revisions. Inspect storage and external-provider cleanup separately: an erased database response does not prove R2 objects or hostname provisioning were removed.

Errors and recovery

• HTTP 403 · organization_forbidden: Verify the active organization, exact permission and workspace grant. A foreign organization cannot be substituted for the authenticated owner.
• HTTP 401 · auth_error: Sign in again in the intended environment using a valid credential. Preserve the returned handler message; SDK auth_error can represent several authentication refusals.

Inspect the raw handler error as well as the SDK code. These examples establish observed local refusals, not every possible provider failure.

Recovery boundary

There is no restore. Take organizations.data.export and keep the payload before erasing.

Evidence

Actual exported Blog Worker, local Miniflare D1/R2 and all committed migrations. Auth, Insights, DNS, Cloudflare for SaaS, error reporting, queue and scheduled-workflow boundaries are synthetic and outbound fetch is sealed. No deployed provider, delivery or scheduled execution outcome is established. English examples use the packaged test translation release; article checks and widget labels follow the verified request locale. No live translation release is proved by this fixture.

Documentation history

18 October 2026: Architecture reviewed the retained action guide against the pinned source declaration and named implementation boundaries, qualified local-capture provenance, and prepared paired human and agent amendments. This review does not record a product release, new fixture execution or publication.

2026-10-18: Architecture accepted the paired coauthor delta and qualified the current 80D deployment association from existing Recovery evidence. Examples remain source-reviewed retained-fixture illustrations; no new execution or guide publication is recorded.