Read workspace privacy settings

Read the workspace’s current retention configuration and deduplicated retained-contract inventory, including pending cleanup entries.

Access

Requires app_topolo_contracts.workspace:read and the intended authenticated organization and workspace. Select the permitted workspace through the supported resource-binding flow; do not add a workspace id to strict action input.

Steps

1. Select the authorized workspace and read privacy settings.
2. Inspect retention days/version and the contract ids, including any cleanup-pending titles.
3. Use privacy.preview for an exact contract before any separately authorized erasure.

Identifiers

• The contracts array combines scoped reviews and intakes by id; pending cleanup rows may remain after content records were removed.

Request

GET /api/privacy

Action: app_topolo_contracts.privacy.get.

Use the empty object {}. Resource/workspace selection belongs outside the action input; do not add undeclared fields.

Response and effects

• Reads reviews, intakes, pending erasure records and retention together; any failed sub-read refuses the whole result rather than silently reporting partial inventory.
• A pending cleanup entry is not a usable review and must not be represented as fully erased.
• Retention=null means no stored policy was returned in this successful read; a dependency failure must never be interpreted as no retention.

Examples

Example request and response

Request input:

{}

Illustrated response:

{
  "retention": {
    "days": 90,
    "version": 1,
    "approvedBy": "user_documentation_fixture",
    "approvedAt": "2026-10-21T00:00:00.000Z"
  },
  "contracts": [
    {
      "id": "11111111-1111-4111-8111-111111111111",
      "title": "Documentation specimen"
    }
  ]
}

HTTP 200 illustration. Hypothetical authorized operation only; inspect the action-specific fields and boundaries below.

Refusal or dependency failure

If: At least one required scoped review/intake/pending-erasure/retention read fails with a non-domain error; the route refuses instead of returning a partial inventory.

Request input:

{}

Source error-code excerpt (HTTP 503):

{
  "error": "contract_privacy_unavailable"
}

Restore failed privacy/storage reads through their owner; do not infer an empty inventory.

Refusal or dependency failure

If: The workspace grant and storage binding are present, but protection readiness or protected-database initialization fails before the action handler runs.

Request input:

{}

Source error-code excerpt (HTTP 503):

{
  "error": "contracts_protection_unavailable"
}

Preserve protection mode; do not downgrade it for a read.

No configured retention and no retained inventory

Request input:

{}

Illustrated response:

{
  "retention": null,
  "contracts": []
}

HTTP 200 illustration. A successful scoped empty snapshot is separate from unavailability.

Verify the result

• Compare the retention version and exact contract id with privacy.preview before configuring or erasing anything.

Recovery

• 503 contract_privacy_unavailable: Restore failed privacy/storage reads through their owner; do not infer an empty inventory.
• 503 contracts_protection_unavailable: Preserve protection mode; do not downgrade it for a read.
• 401 authentication_required: Outer authentication/authorization contract: Authenticate again or provide a valid Topolo API key. Reconcile uncertain earlier write effects before any retry.
• 403 permission_denied: Outer authentication/authorization contract: Grant the credential permission workspace:read and the required resource binding. Reconcile uncertain earlier write effects before any retry.
• 429 rate_limited: Outer authentication/authorization contract: Wait for Retry-After when present, then retry without parallel duplicate calls. Reconcile uncertain earlier write effects before any retry.

Read-only. Reconcile pending cleanup via its exact preview; do not create a replacement review to work around a privacy read failure.

Source and example limits — 21 October 2026: based on reviewed Contracts source 4bfd49a; current serving association is unverified. All requests, responses, approvals and document specimens shown are fictional and unrun. Offline schema/ZIP/XML checks do not prove application acceptance, legal completeness, provider outcomes or human approval.