Outcome
Export Compose-owned documents, versions, comments, review requests, export attempts and workspace mirrors across the authenticated organization. This private-data export requires privacy:read and explicit authorization.
Before you start
- Verify the authenticated identity, environment and pinned organization before preparing an action.
- The published application permission is privacy:read. The path organizationId must equal the authenticated organization. This privacy action covers every Compose workspace in that organization.
- Authorize the documented effects or private-data export before CLI --confirm or MCP confirm:true. HTTP method alone does not establish a read-only operation.
Discover the target
topolo whoami --json
topolo actions get app_topolo_compose.organizations.data.export --detail --json
- Use the organization id from the authenticated identity. Organization export includes private content from every workspace; obtain the wider privacy authorization first.
Request
GET /api/organizations/{organizationId}/data
Save action input as payload.json. Inspect the plan for the exact path, query and body.
Inspect and test this action in the signed action console, then perform the verification below.
Input fields
| Field | Required | Type | Constraints |
|---|---|---|---|
organizationId | Required | string | {"minLength":1} |
Exact input schema:
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"type": "object",
"properties": {
"organizationId": {
"type": "string",
"minLength": 1
}
},
"required": [
"organizationId"
],
"additionalProperties": false
}
Effects
- Reads both Compose stores across every workspace of the authenticated organization, rather than only the selected workspace.
- Redacts structured credential fields; document text and source material remain private content.
- Auth identities and canonical workspaces, delivered notifications, provider usage and encrypted backups follow their own retention policies.
Interpret the response
Use response path $.data.organization_id for organization_data_export. An empty list does not discover a target.
Expect HTTP 200 with data.organization_id matching the requested authenticated organization. Inspect every core/history table and retained-policy statement; store the result in an authorized private destination. This is not an automatic backup restore command.
The success schema below was checked against captured handler responses. Optional structured generation metadata and integration-dependent values can vary. Error examples retain their actual refusal shapes.
Success schema:
{
"type": "object",
"required": [
"data"
],
"properties": {
"data": {
"type": "object",
"required": [
"organization_id",
"exported_at",
"credentials_included",
"stores",
"retained"
],
"properties": {
"organization_id": {
"type": "string"
},
"exported_at": {
"type": "string"
},
"credentials_included": {
"type": "boolean"
},
"stores": {
"type": "object",
"required": [
"core",
"history"
],
"properties": {
"core": {
"type": "object",
"required": [
"compose_workspaces",
"compose_documents",
"compose_document_comments",
"compose_document_review_requests",
"compose_document_export_attempts",
"compose_comment_mentions"
],
"properties": {
"compose_workspaces": {
"type": "array",
"items": {
"type": "object",
"required": [
"id",
"organization_id",
"status",
"created_at",
"updated_at"
],
"properties": {
"id": {
"type": "string"
},
"organization_id": {
"type": "string"
},
"status": {
"type": "string"
},
"created_at": {
"type": "string"
},
"updated_at": {
"type": "string"
}
}
}
},
"compose_documents": {
"type": "array",
"items": {
"type": "object",
"required": [
"id",
"organization_id",
"workspace_id",
"created_by_user_id",
"created_by_email",
"title",
"body_markdown",
"document_type",
"style_preset",
"audience",
"source_material",
"provider",
"model",
"created_at",
"updated_at",
"approval_status",
"approval_owner",
"approval_due_at",
"approval_notes",
"generation_contract",
"archived_at"
],
"properties": {
"id": {
"type": "string"
},
"organization_id": {
"type": "string"
},
"workspace_id": {
"type": "string"
},
"created_by_user_id": {
"type": "string"
},
"created_by_email": {
"type": "null"
},
"title": {
"type": "string"
},
"body_markdown": {
"type": "string"
},
"document_type": {
"type": "string"
},
"style_preset": {
"type": "null"
},
"audience": {
"type": "string"
},
"source_material": {
"type": "null"
},
"provider": {
"type": "null"
},
"model": {
"type": "null"
},
"created_at": {
"type": "string"
},
"updated_at": {
"type": "string"
},
"approval_status": {
"type": "string"
},
"approval_owner": {
"type": "null"
},
"approval_due_at": {
"type": "null"
},
"approval_notes": {
"type": "null"
},
"generation_contract": {
"type": "object",
"required": [
"apiToken",
"safe"
],
"properties": {
"apiToken": {
"type": "string"
},
"safe": {
"type": "string"
}
}
},
"archived_at": {
"type": "null"
}
}
}
},
"compose_document_comments": {
"type": "array",
"items": {
"type": "object",
"required": [
"id",
"document_id",
"organization_id",
"workspace_id",
"author_user_id",
"author_email",
"body",
"created_at"
],
"properties": {
"id": {
"type": "string"
},
"document_id": {
"type": "string"
},
"organization_id": {
"type": "string"
},
"workspace_id": {
"type": "string"
},
"author_user_id": {
"type": "string"
},
"author_email": {
"type": "null"
},
"body": {
"type": "string"
},
"created_at": {
"type": "string"
}
}
}
},
"compose_document_review_requests": {
"type": "array",
"items": {}
},
"compose_document_export_attempts": {
"type": "array",
"items": {
"type": "object",
"required": [
"id",
"document_id",
"organization_id",
"workspace_id",
"requested_by_user_id",
"format",
"status",
"error",
"created_at"
],
"properties": {
"id": {
"type": "string"
},
"document_id": {
"type": "string"
},
"organization_id": {
"type": "string"
},
"workspace_id": {
"type": "string"
},
"requested_by_user_id": {
"type": "string"
},
"format": {
"type": "string"
},
"status": {
"type": "string"
},
"error": {
"type": "null"
},
"created_at": {
"type": "string"
}
}
}
},
"compose_comment_mentions": {
"type": "array",
"items": {
"type": "object",
"required": [
"comment_id",
"mentioned_user_id",
"created_at"
],
"properties": {
"comment_id": {
"type": "string"
},
"mentioned_user_id": {
"type": "string"
},
"created_at": {
"type": "string"
}
}
}
}
}
},
"history": {
"type": "object",
"required": [
"compose_document_versions"
],
"properties": {
"compose_document_versions": {
"type": "array",
"items": {
"type": "object",
"required": [
"id",
"document_id",
"organization_id",
"workspace_id",
"created_by_user_id",
"created_by_email",
"title",
"body_markdown",
"document_type",
"style_preset",
"audience",
"source_material",
"provider",
"model",
"reason",
"created_at",
"generation_contract"
],
"properties": {
"id": {
"type": "string"
},
"document_id": {
"type": "string"
},
"organization_id": {
"type": "string"
},
"workspace_id": {
"type": "string"
},
"created_by_user_id": {
"type": "string"
},
"created_by_email": {
"type": "null"
},
"title": {
"type": "string"
},
"body_markdown": {
"type": "string"
},
"document_type": {
"type": "string"
},
"style_preset": {
"type": "null"
},
"audience": {
"type": "string"
},
"source_material": {
"type": "null"
},
"provider": {
"type": "null"
},
"model": {
"type": "null"
},
"reason": {
"type": "string"
},
"created_at": {
"type": "string"
},
"generation_contract": {
"type": "null"
}
}
}
}
}
}
}
},
"retained": {
"type": "object",
"required": [
"platform_identity_and_canonical_workspaces",
"delivered_notifications",
"ai_provider_execution_and_usage",
"encrypted_backups"
],
"properties": {
"platform_identity_and_canonical_workspaces": {
"type": "string"
},
"delivered_notifications": {
"type": "string"
},
"ai_provider_execution_and_usage": {
"type": "string"
},
"encrypted_backups": {
"type": "string"
}
}
}
}
}
}
}
Worked examples
Responses were captured from the actual Compose Worker using synthetic users, organizations, content and identifiers. Tests simulate Auth, Nexus, Notify, metering and platform workspace transport and use an in-memory D1 adapter or local SQLite. They prove local handler behavior, not live model correctness, provider cost, notification delivery, real workspace grants or cross-store atomicity. HTTP 204 responses are exactly empty strings in the SDK transport. Replace fixture identifiers through credential-scoped discovery. Refused examples demonstrate boundaries and must not be executed as successful workflows.
Successful request
Actual Compose Worker response. Auth, Nexus, notifications, metering and platform workspace transport are simulated. D1 is an in-memory adapter or local SQLite as stated by the test. This does not prove a live model completion or notification delivery. No request credentials are captured. Captured scenario: Compose organization data protection > enforces authentication, organization scope, and confirmation through the real worker routes.
Input · payload.json:
{
"organizationId": "org_test_1"
}
CLI:
topolo actions validate app_topolo_compose.organizations.data.export --data @payload.json --json
topolo actions plan app_topolo_compose.organizations.data.export --data @payload.json --json
topolo actions call app_topolo_compose.organizations.data.export --data @payload.json --confirm --json
MCP tool and arguments:
{
"tool": "topolo_call_action",
"arguments": {
"actionId": "app_topolo_compose.organizations.data.export",
"input": {
"organizationId": "org_test_1"
},
"confirm": true
}
}
Captured local response · HTTP 200:
{
"data": {
"organization_id": "org_test_1",
"exported_at": "2026-10-04T02:26:27.228Z",
"credentials_included": false,
"stores": {
"core": {
"compose_workspaces": [
{
"id": "ws_1",
"organization_id": "org_test_1",
"status": "active",
"created_at": "2026-08-02",
"updated_at": "2026-08-02"
}
],
"compose_documents": [
{
"id": "doc_org_test_1",
"organization_id": "org_test_1",
"workspace_id": "ws_1",
"created_by_user_id": "user_1",
"created_by_email": null,
"title": "Plan",
"body_markdown": "Private body",
"document_type": "general",
"style_preset": null,
"audience": "Leaders",
"source_material": null,
"provider": null,
"model": null,
"created_at": "2026-10-04 02:26:27",
"updated_at": "2026-10-04 02:26:27",
"approval_status": "draft",
"approval_owner": null,
"approval_due_at": null,
"approval_notes": null,
"generation_contract": {
"apiToken": "[REDACTED]",
"safe": "keep"
},
"archived_at": null
}
],
"compose_document_comments": [
{
"id": "comment_org_test_1",
"document_id": "doc_org_test_1",
"organization_id": "org_test_1",
"workspace_id": "ws_1",
"author_user_id": "user_1",
"author_email": null,
"body": "Review this",
"created_at": "2026-08-02"
}
],
"compose_document_review_requests": [],
"compose_document_export_attempts": [
{
"id": "export_org_test_1",
"document_id": "doc_org_test_1",
"organization_id": "org_test_1",
"workspace_id": "ws_1",
"requested_by_user_id": "user_1",
"format": "pdf",
"status": "ready",
"error": null,
"created_at": "2026-08-02"
}
],
"compose_comment_mentions": [
{
"comment_id": "comment_org_test_1",
"mentioned_user_id": "user_2",
"created_at": "2026-08-02"
}
]
},
"history": {
"compose_document_versions": [
{
"id": "version_org_test_1",
"document_id": "doc_org_test_1",
"organization_id": "org_test_1",
"workspace_id": "ws_1",
"created_by_user_id": "user_1",
"created_by_email": null,
"title": "Plan",
"body_markdown": "Version body",
"document_type": "general",
"style_preset": null,
"audience": "Leaders",
"source_material": null,
"provider": null,
"model": null,
"reason": "manual",
"created_at": "2026-10-04 02:26:27",
"generation_contract": null
}
]
}
},
"retained": {
"platform_identity_and_canonical_workspaces": "Topolo Auth",
"delivered_notifications": "Topolo Notify",
"ai_provider_execution_and_usage": "Topolo Nexus",
"encrypted_backups": "Platform backup retention policy"
}
}
}
HTTP 200. Expect HTTP 200 with data.organization_id matching the requested authenticated organization. Inspect every core/history table and retained-policy statement; store the result in an authorized private destination. This is not an automatic backup restore command.
Another supported request
Actual Compose Worker response. Auth, Nexus, notifications, metering and platform workspace transport are simulated. D1 is an in-memory adapter or local SQLite as stated by the test. This does not prove a live model completion or notification delivery. No request credentials are captured. Captured scenario: Compose organization data protection > the privacy permissions each route publishes > exports with privacy:read and erases with privacy:write.
Input · payload.json:
{
"organizationId": "org_test_1"
}
CLI:
topolo actions validate app_topolo_compose.organizations.data.export --data @payload.json --json
topolo actions plan app_topolo_compose.organizations.data.export --data @payload.json --json
topolo actions call app_topolo_compose.organizations.data.export --data @payload.json --confirm --json
MCP tool and arguments:
{
"tool": "topolo_call_action",
"arguments": {
"actionId": "app_topolo_compose.organizations.data.export",
"input": {
"organizationId": "org_test_1"
},
"confirm": true
}
}
Captured local response · HTTP 200:
{
"data": {
"organization_id": "org_test_1",
"exported_at": "2026-10-04T02:26:27.243Z",
"credentials_included": false,
"stores": {
"core": {
"compose_workspaces": [
{
"id": "ws_1",
"organization_id": "org_test_1",
"status": "active",
"created_at": "2026-08-02",
"updated_at": "2026-08-02"
}
],
"compose_documents": [
{
"id": "doc_org_test_1",
"organization_id": "org_test_1",
"workspace_id": "ws_1",
"created_by_user_id": "user_1",
"created_by_email": null,
"title": "Plan",
"body_markdown": "Private body",
"document_type": "general",
"style_preset": null,
"audience": "Leaders",
"source_material": null,
"provider": null,
"model": null,
"created_at": "2026-10-04 02:26:27",
"updated_at": "2026-10-04 02:26:27",
"approval_status": "draft",
"approval_owner": null,
"approval_due_at": null,
"approval_notes": null,
"generation_contract": {
"apiToken": "[REDACTED]",
"safe": "keep"
},
"archived_at": null
}
],
"compose_document_comments": [
{
"id": "comment_org_test_1",
"document_id": "doc_org_test_1",
"organization_id": "org_test_1",
"workspace_id": "ws_1",
"author_user_id": "user_1",
"author_email": null,
"body": "Review this",
"created_at": "2026-08-02"
}
],
"compose_document_review_requests": [],
"compose_document_export_attempts": [
{
"id": "export_org_test_1",
"document_id": "doc_org_test_1",
"organization_id": "org_test_1",
"workspace_id": "ws_1",
"requested_by_user_id": "user_1",
"format": "pdf",
"status": "ready",
"error": null,
"created_at": "2026-08-02"
}
],
"compose_comment_mentions": [
{
"comment_id": "comment_org_test_1",
"mentioned_user_id": "user_2",
"created_at": "2026-08-02"
}
]
},
"history": {
"compose_document_versions": [
{
"id": "version_org_test_1",
"document_id": "doc_org_test_1",
"organization_id": "org_test_1",
"workspace_id": "ws_1",
"created_by_user_id": "user_1",
"created_by_email": null,
"title": "Plan",
"body_markdown": "Version body",
"document_type": "general",
"style_preset": null,
"audience": "Leaders",
"source_material": null,
"provider": null,
"model": null,
"reason": "manual",
"created_at": "2026-10-04 02:26:27",
"generation_contract": null
}
]
}
},
"retained": {
"platform_identity_and_canonical_workspaces": "Topolo Auth",
"delivered_notifications": "Topolo Notify",
"ai_provider_execution_and_usage": "Topolo Nexus",
"encrypted_backups": "Platform backup retention policy"
}
}
}
HTTP 200. Expect HTTP 200 with data.organization_id matching the requested authenticated organization. Inspect every core/history table and retained-policy statement; store the result in an authorized private destination. This is not an automatic backup restore command.
Refused request · HTTP 401
Actual Compose Worker response. Auth, Nexus, notifications, metering and platform workspace transport are simulated. D1 is an in-memory adapter or local SQLite as stated by the test. This does not prove a live model completion or notification delivery. No request credentials are captured. Captured scenario: Compose organization data protection > enforces authentication, organization scope, and confirmation through the real worker routes.
Input · payload.json:
{
"organizationId": "org_test_1"
}
CLI:
topolo actions validate app_topolo_compose.organizations.data.export --data @payload.json --json
topolo actions plan app_topolo_compose.organizations.data.export --data @payload.json --json
Captured local response · HTTP 401:
{
"error": "Authentication token required"
}
HTTP 401. The handler refused this request. Resolve its exact cause before retrying; input validation can reject an invalid fixture before it reaches the handler.
Refused request · HTTP 403
Actual Compose Worker response. Auth, Nexus, notifications, metering and platform workspace transport are simulated. D1 is an in-memory adapter or local SQLite as stated by the test. This does not prove a live model completion or notification delivery. No request credentials are captured. Captured scenario: Compose organization data protection > enforces authentication, organization scope, and confirmation through the real worker routes.
Input · payload.json:
{
"organizationId": "org_other"
}
CLI:
topolo actions validate app_topolo_compose.organizations.data.export --data @payload.json --json
topolo actions plan app_topolo_compose.organizations.data.export --data @payload.json --json
Captured local response · HTTP 403:
{
"error": "organization_forbidden"
}
HTTP 403. The handler refused this request. Resolve its exact cause before retrying; input validation can reject an invalid fixture before it reaches the handler.
Refused request · HTTP 403
Actual Compose Worker response. Auth, Nexus, notifications, metering and platform workspace transport are simulated. D1 is an in-memory adapter or local SQLite as stated by the test. This does not prove a live model completion or notification delivery. No request credentials are captured. Captured scenario: Compose organization data protection > the privacy permissions each route publishes > refuses export without privacy:read.
Input · payload.json:
{
"organizationId": "org_test_1"
}
CLI:
topolo actions validate app_topolo_compose.organizations.data.export --data @payload.json --json
topolo actions plan app_topolo_compose.organizations.data.export --data @payload.json --json
Captured local response · HTTP 403:
{
"error": "permission_denied",
"permission": "privacy:read"
}
HTTP 403. The handler refused this request. Resolve its exact cause before retrying; input validation can reject an invalid fixture before it reaches the handler.
Verify the result
- Expect HTTP 200 with data.organization_id matching the requested authenticated organization.
- Inspect every core/history table and retained-policy statement; store the result in an authorized private destination. This is not an automatic backup restore command.
Errors and recovery
Authentication token required(HTTP 401): Refresh the authorized credential in the same environment and pinned organization; do not switch scope to bypass this refusal.organization_forbidden(HTTP 403): Verify the authenticated organization, application permission and granted workspace. For reviewer_required, use the legitimately assigned reviewer; requesting review grants no access.permission_denied(HTTP 403): Verify the authenticated organization, application permission and granted workspace. For reviewer_required, use the legitimately assigned reviewer; requesting review grants no access.
Auth, action-input validation and platform resource resolution can refuse a request before its handler. Retain the exact error, request id and context; requesting another context is not a legitimate way to bypass a refusal.
Recovery boundary
This action reads private data. Protect or remove your authorized exported copy according to its retention policy; it changes no Compose content.
Related actions
- Erase Compose organization data: Permanently erase Compose-owned data for the authenticated organization with literal confirmation ERASE. Documents in review or pending review requests block erasure; other platform services retain their own records.
Evidence
Responses were captured from the actual Compose Worker using synthetic users, organizations, content and identifiers. Tests simulate Auth, Nexus, Notify, metering and platform workspace transport and use an in-memory D1 adapter or local SQLite. They prove local handler behavior, not live model correctness, provider cost, notification delivery, real workspace grants or cross-store atomicity. HTTP 204 responses are exactly empty strings in the SDK transport. Replace fixture identifiers through credential-scoped discovery. Capture digests and test scenarios are retained in the source fixture records.