Topolo Docs Topolo Platform
Open workspace

Erase Feed organization stores

Erase local Feed organization records and workspace KV data sequentially, then retain a hashed erasure receipt for 2,557 days. Requires exact ERASE confirmation; preserves canonical Auth identity and encryption keys.

Outcome

Erase local Feed organization records and workspace KV data sequentially, then retain a hashed erasure receipt for 2,557 days. Requires exact ERASE confirmation; preserves canonical Auth identity and encryption keys.

Before you start

  • Verify the authenticated identity, exact environment and pinned approved organization context before preparing an action.
  • Development stores content without encryption and uses scoped SHA-256 identifier hashes. Staging and production require envelope encryption and a provisioned application root; missing custody does not permit plaintext.
  • The published application permission is workspace:delete. This is organization-wide and is not restricted by a workspace header; obtain the specific privacy purpose and authorization.
  • Authorize the documented mirror, security, external-fetch, reporting, privacy or archival effects before CLI --confirm or MCP confirm:true. A GET request can initialize a local mirror.

Discover the target

topolo whoami --json
topolo actions get app_topolo_feed.privacy.delete --detail --json
  • Use the authenticated organization scope. A workspace header does not narrow this route; the canary is environment-wide.

Request

DELETE /api/privacy

Save action input as payload.json. Inspect the plan for the exact path, query and body.

Inspect and test this action in the signed action console, then perform the verification below.

Input fields

FieldRequiredTypeConstraints
confirmationRequiredstringExact ERASE literal for an explicitly authorized organization-wide Feed privacy erasure; it is not a grant of authority.; {}

Exact input schema:

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "confirmation": {
      "type": "string",
      "const": "ERASE",
      "description": "Exact ERASE literal for an explicitly authorized organization-wide Feed privacy erasure; it is not a grant of authority."
    }
  },
  "required": [
    "confirmation"
  ],
  "additionalProperties": false
}

Effects

  • Deletes reporting, impressions, devices, workspace mirrors and selected workspace configuration, device-list and assignment KV entries. Removes the organization workspace mappings.
  • The D1 and KV operations are sequential and not atomic. An error may occur after partial erasure. deleted_rows combines D1 changes and KV operations; it is not a platform or provider purge certificate.
  • Retains global configuration, encryption roots/data keys and a hashed organization receipt for 2557 days. No Auth workspace archival or external backup purge occurs.
  • Device analytics ingestion checks an active erasure receipt when its workspace mirror is found and can return organization_erased (410); the receipt is not a universal gate for every Feed action.

Interpret the response

This action can return no new resource identifier. Follow the specific response verification and do not invent a target id.

Inspect erasure.erased, erased_at and deleted_rows, then perform a separately authorized privacy.export to inspect remaining Feed stores. Retain the receipt and any request id. A 200 result does not prove canonical identity, another application, external device storage or provider backups were erased.

The success schema below was checked against captured handler responses. Polymorphic configuration and protected device assignment fields vary; exact envelope and SQL row fields are source-reviewed. Error examples retain their actual refusal shapes.

Success schema:

{
  "type": "object",
  "properties": {
    "erasure": {
      "type": "object",
      "properties": {
        "erased": {
          "type": "boolean",
          "const": true
        },
        "erased_at": {
          "type": "string"
        },
        "deleted_rows": {
          "type": "number"
        }
      },
      "required": [
        "erased",
        "erased_at",
        "deleted_rows"
      ],
      "additionalProperties": false
    }
  },
  "required": [
    "erasure"
  ],
  "additionalProperties": false
}

Worked examples

Actual Feed Worker response using synthetic Auth, workspace grants, in-memory D1/KV and simulated source/notification transport. No live provider, encryption audit, device enrollment or external delivery is established. Credentials are excluded or explicitly redacted. SQL result shapes are also reviewed against migrations and handlers; empty captures do not exercise every populated export store. Live publication and read-back are separate environment evidence. Refused examples demonstrate boundaries and must not be executed as successful workflows.

Refused request · HTTP 403

Actual Feed Worker response using synthetic Auth, workspace grants, in-memory D1/KV and simulated source/notification transport. No live provider, encryption audit, device enrollment or external delivery is established. Credentials are excluded or explicitly redacted. Captured scenario: privacy administration is authenticated, permission-gated, and confirmation-gated.

Input · payload.json:

{
  "confirmation": "ERASE"
}

CLI:

topolo actions validate app_topolo_feed.privacy.delete --data @payload.json --json
topolo actions plan app_topolo_feed.privacy.delete --data @payload.json --json

Captured local response · HTTP 403:

{
  "error": "forbidden"
}

HTTP 403. The handler refused this request. Resolve its exact cause before retrying; input validation can reject an invalid fixture before it reaches the handler.

Refused request · HTTP 400

Actual Feed Worker response using synthetic Auth, workspace grants, in-memory D1/KV and simulated source/notification transport. No live provider, encryption audit, device enrollment or external delivery is established. Credentials are excluded or explicitly redacted. Captured scenario: privacy administration is authenticated, permission-gated, and confirmation-gated.

Input · payload.json:

{}

CLI:

topolo actions validate app_topolo_feed.privacy.delete --data @payload.json --json
topolo actions plan app_topolo_feed.privacy.delete --data @payload.json --json

Captured local response · HTTP 400:

{
  "success": false,
  "error": {
    "code": "invalid_action_input",
    "message": "Invalid action input for \"privacy.delete\".",
    "action": "privacy.delete",
    "issues": [
      {
        "path": "confirmation",
        "message": "Invalid input: expected \"ERASE\"",
        "code": "invalid_value"
      }
    ]
  }
}

HTTP 400. The handler refused this request. Resolve its exact cause before retrying; input validation can reject an invalid fixture before it reaches the handler.

Successful request

Actual Feed Worker response using synthetic Auth, workspace grants, in-memory D1/KV and simulated source/notification transport. No live provider, encryption audit, device enrollment or external delivery is established. Credentials are excluded or explicitly redacted. Captured scenario: privacy administration is authenticated, permission-gated, and confirmation-gated.

Input · payload.json:

{
  "confirmation": "ERASE"
}

CLI:

topolo actions validate app_topolo_feed.privacy.delete --data @payload.json --json
topolo actions plan app_topolo_feed.privacy.delete --data @payload.json --json
topolo actions call app_topolo_feed.privacy.delete --data @payload.json --confirm --json

MCP tool and arguments:

{
  "tool": "topolo_call_action",
  "arguments": {
    "actionId": "app_topolo_feed.privacy.delete",
    "input": {
      "confirmation": "ERASE"
    },
    "confirm": true
  }
}

Captured local response · HTTP 200:

{
  "erasure": {
    "erased": true,
    "erased_at": "2026-10-04T04:12:42.916Z",
    "deleted_rows": 0
  }
}

HTTP 200. Inspect erasure.erased, erased_at and deleted_rows, then perform a separately authorized privacy.export to inspect remaining Feed stores. Retain the receipt and any request id. A 200 result does not prove canonical identity, another application, external device storage or provider backups were erased.

Verify the result

  • Inspect erasure.erased, erased_at and deleted_rows, then perform a separately authorized privacy.export to inspect remaining Feed stores.
  • Retain the receipt and any request id. A 200 result does not prove canonical identity, another application, external device storage or provider backups were erased.

Errors and recovery

  • forbidden (HTTP 403): Verify the active organization, application permission and granted workspace; an id or query parameter does not grant access.

Auth, action-input validation and platform resource resolution can refuse a request before its handler. Retain the exact error, request id and context; requesting another context is not a legitimate way to bypass a refusal.

Recovery boundary

There is no published restore. Obtain explicit organization privacy authorization before this action; exact ERASE and transport confirmation do not grant that authorization. After an uncertain result, inspect remaining stores before any separately approved continuation.

  • Export Feed organization data: Export all local Feed stores for the authenticated organization, including readable protected fields and per-workspace KV configuration and assignments. This operation is organization-wide and is not limited by a workspace header.

Evidence

Actual Feed Worker response using synthetic Auth, workspace grants, in-memory D1/KV and simulated source/notification transport. No live provider, encryption audit, device enrollment or external delivery is established. Credentials are excluded or explicitly redacted. SQL result shapes are also reviewed against migrations and handlers; empty captures do not exercise every populated export store. Live publication and read-back are separate environment evidence. Capture digests and test scenarios are retained in the source fixture records.