Action and scope
app_topolo_developers.workspaces.data.erase
DELETE /api/developer-console/workspaces/{workspaceId}/data
Permanently erase selected Developers-owned workspace data and projections, with explicit cross-store and recovery limits.
Before you start
Use the intended environment, authenticated identity and organization. Discover the canonical app-scoped Developers workspace through supported Auth workspace discovery, then use the same actual workspaceId in the action input and resource binding. A path/header is a request, not an access grant. Platform membership resolution is required; an organization role alone is not proof of a sufficient workspace grant.
Required application permission: app_topolo_developers.workspace:delete. Platform workspace minimum access requested by the route: admin. Service permission and the actual workspace authorization are separate checks.
This is a declared destructive action requiring explicit caller confirmation. No example or public guide authorizes executing it.
Input
workspaceId— required, nonempty string. It must match the actual platform-approved workspace resource.- Additional input properties are not accepted. Do not add a JSON confirmation flag.
What it does
This action is irreversible for the selected app-owned data. The input contains workspaceId only: confirmation is an execution/tool requirement, not a confirm property to add to the JSON. Obtain explicit approval for this actual target and scope before CLI --confirm or MCP confirmation. Take and protect any separately authorized export needed before erasure; export is not a complete restore image.
The source first captures app/profile IDs, requests vector deletion for those app IDs, purges their action partitions, purges their application catalog partitions, then deletes app icon objects. It next deletes matching catalog collection/directory/registry/overlay rows, workspace API-key resource declarations and P2P capabilities, mobile artifact rows, build requests (including legacy null-workspace rows for the captured profiles), sync failures for captured apps, and the selected workspace control tables: payout events/accounts, commerce, submissions, assurance, apps and profiles. It finally deletes workspace identity mirrors from integrations, artifacts and control.
The sequence has no cross-service/database transaction. Per-app partition purges run in parallel within their stage, and a failed parallel stage may already have some successful purges. R2 deletion loops batches of up to1000 keys. Concurrent writes or data moved while IDs are captured are not protected by a global snapshot. The source relies on configured child-table cascades for further dependent records; it is not an independently verified all-provider purge.
Auth owns the canonical workspace and credentials. This route does not call the Auth archive/credential endpoints or prove every downstream provider copy was erased; P2P/API-key resource declaration deletion is not proof of deleting independently owned live credentials/capabilities. R2 coverage here is app icon prefixes, not every mobile artifact binary.
Success returns erased, workspaceId, organizationId, appIds, vectorsDeleted, actionPartitionsRemoved, catalogPartitionsRemoved, iconObjectsDeleted and rowsDeleted by the five store groups. vectorsDeleted is the captured app-ID count after the deletion request returns, not a per-vector removal receipt. Partition counts count purge results reporting removed. Mirror DELETE counts and possible cascade effects are not separately enumerated by rowsDeleted; the wrapper is not an independent global-erasure certificate.
The descriptor suggests checking an empty later export. That is not universal: the profile/mirror removals can make full context resolution refuse, or an enabled organization can recreate a local profile/mirror on a later read. A nonempty or refused later export alone is not proof the original attempt failed or permission to erase again.
Worked examples — synthetic and unrun
Every identifier, value, store result and response below is fictional. The full bodies are conditional illustrations of the pinned source branches; no live action or test was run.
Selected app-owned records and projections are erased
SYNTHETIC / UNRUN. Conditional fictional stores: one app and one profile, one API-resource row and one P2P row, one artifact row, one build request, three catalog rows, one icon object, and both app partition purge calls return removed:true. Each listed DELETE returns the shown count. The three mirror DELETE calls also succeed, but their counts are not included in rowsDeleted. No Auth workspace archival or credential deletion is implied.
Request input:
{
"workspaceId": "ws_synthetic_developers"
}
Illustrative HTTP 200 response under the stated fictional preconditions. No action was executed.
{
"success": true,
"message": "Developer workspace data erased successfully.",
"data": {
"erased": true,
"workspaceId": "ws_synthetic_developers",
"organizationId": "org_synthetic_developers",
"appIds": [
"app_synthetic_owned"
],
"vectorsDeleted": 1,
"actionPartitionsRemoved": 1,
"catalogPartitionsRemoved": 1,
"iconObjectsDeleted": 1,
"rowsDeleted": {
"control": 2,
"integrations": 2,
"artifacts": 1,
"intake": 1,
"catalog": 3
}
}
}
An already empty set of selected stores
SYNTHETIC / UNRUN. Conditional handler illustration: a valid context is supplied, no apps/profiles/selected rows remain, optional icon storage is absent and mirror cleanup succeeds. It does not establish that a second full authenticated HTTP request after erasure will resolve the same context or be safe to repeat.
Request input:
{
"workspaceId": "ws_synthetic_developers"
}
Illustrative HTTP 200 response under the stated fictional preconditions. No action was executed.
{
"success": true,
"message": "Developer workspace data erased successfully.",
"data": {
"erased": true,
"workspaceId": "ws_synthetic_developers",
"organizationId": "org_synthetic_developers",
"appIds": [],
"vectorsDeleted": 0,
"actionPartitionsRemoved": 0,
"catalogPartitionsRemoved": 0,
"iconObjectsDeleted": 0,
"rowsDeleted": {
"control": 0,
"integrations": 0,
"artifacts": 0,
"intake": 0,
"catalog": 0
}
}
}
The path targets a different workspace
SYNTHETIC / UNRUN. After resolving the caller context, the path workspaceId differs from the platform-confirmed workspace. The data-erasure function is not entered; context effects are separate.
Request input:
{
"workspaceId": "ws_synthetic_developers"
}
Illustrative HTTP 403 response under the stated fictional preconditions. No action was executed.
{
"success": false,
"error": {
"message": "You do not have access to this workspace."
}
}
Failure after earlier irreversible effects
SYNTHETIC / UNRUN. Conditional fixture: vector removal, action/catalog partition purges and icon deletion have completed; a subsequent catalog DELETE throws Error("Synthetic catalog cleanup failure."). The outer source handler emits this error, with no partial-count response and no rollback. Preserve the uncertain scope and use the source owner to reconcile before any further destructive request.
Request input:
{
"workspaceId": "ws_synthetic_developers"
}
Illustrative HTTP 500 response under the stated fictional preconditions. No action was executed.
{
"success": false,
"error": {
"message": "Synthetic catalog cleanup failure."
}
}
Errors and recovery
This is an explanatory label, not a wire error.code. The source message is You do not have access to this workspace. Reconcile URL/input and actual platform-approved resource context; do not substitute an unauthorized target.
This is an explanatory label, not a stable wire code. The outer handler returns an Error message; preserve the request and UNKNOWN/partial effects. There is no source rollback of erased rows, partitions, vectors or icons. After any lost/error response preserve the original target, time, request identifier, response and any available owner receipts; stop automatic retries. Have the current Developers/provider owners reconcile each affected store and stage. A later empty/refused/nonempty export is not sufficient alone. Any further erase or attempted reconstruction requires its own explicit authority.
Other authentication, service-permission, workspace-grant and shared-context failures may occur before these source branches. Their exact deployed envelopes are not asserted here. The descriptor’s generic labels do not make these illustrated messages stable machine codes.
Verify the result
Reconcile each selected store/projection and actual available provider receipts through supported authorized owner tools, including profiles and workspace mirrors. Do not fabricate receipts from displayed counters.
Account for vectorsDeleted being a requested-ID count and rowsDeleted omitting mirror removals; HTTP200 is not a global/provider-compliance certificate.
Retain partial/UNKNOWN outcomes. Do not issue another destructive action simply because verification cannot resolve the former workspace context.
Recovery boundary
There is no source rollback of erased rows, partitions, vectors or icons. After any lost/error response preserve the original target, time, request identifier, response and any available owner receipts; stop automatic retries. Have the current Developers/provider owners reconcile each affected store and stage. A later empty/refused/nonempty export is not sufficient alone. Any further erase or attempted reconstruction requires its own explicit authority.
Source and limits
Reviewed against Topolo-io/TopoloDevelopers@7b89bd3b39092cdc29f87540847bf99a243f0a40:apps/api/functions/api/developer-console/workspace-data-routes.ts and the application action declaration at 7b89bd3b39092cdc29f87540847bf99a243f0a40. Shared context, workspace access and response wrappers were reviewed at the same revision. The retained data-protection test source was read for its fixtures only; it was not imported or run. Source/declaration association is not proof of serving runtime, completed provider effects or automatic Knowledge invocation.
Change log
- 2026-10-23: Documented this action’s exact schemas, source behavior, conditional complete request/response examples, authorization, verification and recovery limits. Distinguished source behavior from misleading catalog shortcuts. This records a documentation change, not an executed data operation.