Outcome
Export all local Feed stores for the authenticated organization, including readable protected fields and per-workspace KV configuration and assignments. This operation is organization-wide and is not limited by a workspace header.
Before you start
- Verify the authenticated identity, exact environment and pinned approved organization context before preparing an action.
- Development stores content without encryption and uses scoped SHA-256 identifier hashes. Staging and production require envelope encryption and a provisioned application root; missing custody does not permit plaintext.
- The published application permission is workspace:read. This is organization-wide and is not restricted by a workspace header; obtain the specific privacy purpose and authorization.
- Authorize the documented mirror, security, external-fetch, reporting, privacy or archival effects before CLI --confirm or MCP confirm:true. A GET request can initialize a local mirror.
Discover the target
topolo whoami --json
topolo actions get app_topolo_feed.privacy.export --detail --json
- Use the authenticated organization scope. A workspace header does not narrow this route; the canary is environment-wide.
Request
GET /api/privacy
Save action input as payload.json. Inspect the plan for the exact path, query and body.
Inspect and test this action in the signed action console, then perform the verification below.
Input fields
Supply an empty input object; credential and resource context are separate.
Exact input schema:
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"type": "object",
"properties": {},
"additionalProperties": false
}
Effects
- Returns nine store arrays: workspaces, devices, impressions, digests, anomalies, sources, source_sync_runs, feed_configuration and device_state.
- Decrypts protected data for the authorized privacy requester. Omits credentialHash from assignments, device_ref from device rows and device_fingerprint from impressions.
- total sums the array lengths, not unique devices or bytes. Canonical Auth identity, encryption keys and external backups are not included.
Interpret the response
Use response path $.export.organization_id for organization_privacy_export. An empty list does not discover a target.
Confirm export.organization_id matches the approved authenticated organization and inspect the nine store arrays under the authorized privacy purpose. Empty fixture arrays exercise the envelope, not every populated schema. An export is not an executable backup restore or a platform-wide export.
The success schema below was checked against captured handler responses. Polymorphic configuration and protected device assignment fields vary; exact envelope and SQL row fields are source-reviewed. Error examples retain their actual refusal shapes.
Success schema:
{
"type": "object",
"properties": {
"export": {
"type": "object",
"properties": {
"organization_id": {
"type": "string"
},
"exported_at": {
"type": "string"
},
"stores": {
"type": "object",
"properties": {
"workspaces": {
"type": "array",
"items": {
"type": "object",
"properties": {
"id": {
"type": "string"
},
"organization_id": {
"type": "string"
},
"status": {
"type": "string",
"enum": [
"active",
"archived"
]
},
"created_at": {
"type": "string"
},
"updated_at": {
"type": "string"
}
},
"required": [
"id",
"organization_id",
"status",
"created_at",
"updated_at"
],
"additionalProperties": false
}
},
"devices": {
"type": "array",
"items": {
"type": "object",
"properties": {
"workspace_id": {
"type": "string"
},
"device_id": {
"type": "string"
},
"manufacturer": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
]
},
"model": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
]
},
"os_version": {
"anyOf": [
{
"type": "number"
},
{
"type": "null"
}
]
},
"first_seen": {
"type": "number"
},
"last_seen": {
"type": "number"
}
},
"required": [
"workspace_id",
"device_id",
"manufacturer",
"model",
"os_version",
"first_seen",
"last_seen"
],
"additionalProperties": false
}
},
"impressions": {
"type": "array",
"items": {
"type": "object",
"properties": {
"id": {
"type": "string"
},
"workspace_id": {
"type": "string"
},
"device_id": {
"type": "string"
},
"media_id": {
"type": "string"
},
"event_type": {
"type": "string"
},
"timestamp": {
"type": "number"
},
"duration": {
"type": "number"
},
"metadata": {}
},
"required": [
"id",
"workspace_id",
"device_id",
"media_id",
"event_type",
"timestamp",
"duration",
"metadata"
],
"additionalProperties": false
}
},
"digests": {
"type": "array",
"items": {
"type": "object",
"properties": {
"id": {
"type": "string"
},
"organization_id": {
"type": "string"
},
"workspace_id": {
"type": "string"
},
"window_start": {
"type": "number"
},
"window_end": {
"type": "number"
},
"summary_json": {
"type": "array",
"items": {
"type": "object",
"properties": {
"event_type": {
"type": "string"
},
"event_count": {
"type": "number"
},
"total_duration": {
"type": "number"
}
},
"required": [
"event_type",
"event_count",
"total_duration"
],
"additionalProperties": false
}
},
"created_at": {
"type": "string"
}
},
"required": [
"id",
"organization_id",
"workspace_id",
"window_start",
"window_end",
"summary_json",
"created_at"
],
"additionalProperties": false
}
},
"anomalies": {
"type": "array",
"items": {
"type": "object",
"properties": {
"id": {
"type": "string"
},
"organization_id": {
"type": "string"
},
"workspace_id": {
"type": "string"
},
"metric": {
"type": "string"
},
"observed_value": {
"type": "number"
},
"threshold_value": {
"type": "number"
},
"window_start": {
"type": "number"
},
"window_end": {
"type": "number"
},
"status": {
"type": "string",
"enum": [
"open",
"resolved"
]
},
"created_at": {
"type": "string"
}
},
"required": [
"id",
"organization_id",
"workspace_id",
"metric",
"observed_value",
"threshold_value",
"window_start",
"window_end",
"status",
"created_at"
],
"additionalProperties": false
}
},
"sources": {
"type": "array",
"items": {
"type": "object",
"properties": {
"id": {
"type": "string"
},
"organization_id": {
"type": "string"
},
"workspace_id": {
"type": "string"
},
"name": {
"type": "string"
},
"endpoint_url": {
"type": "string"
},
"last_synced_at": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
]
},
"last_error": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
]
},
"created_at": {
"type": "string"
},
"updated_at": {
"type": "string"
}
},
"required": [
"id",
"organization_id",
"workspace_id",
"name",
"endpoint_url",
"last_synced_at",
"last_error",
"created_at",
"updated_at"
],
"additionalProperties": false
}
},
"source_sync_runs": {
"type": "array",
"items": {
"type": "object",
"properties": {
"id": {
"type": "string"
},
"source_id": {
"type": "string"
},
"organization_id": {
"type": "string"
},
"workspace_id": {
"type": "string"
},
"status": {
"type": "string",
"enum": [
"completed",
"failed"
]
},
"error": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
]
},
"started_at": {
"type": "string"
},
"completed_at": {
"type": "string"
}
},
"required": [
"id",
"source_id",
"organization_id",
"workspace_id",
"status",
"error",
"started_at",
"completed_at"
],
"additionalProperties": false
}
},
"feed_configuration": {
"type": "array",
"items": {
"type": "object",
"properties": {
"key": {
"type": "string"
},
"value": {}
},
"required": [
"key",
"value"
],
"additionalProperties": false
}
},
"device_state": {
"type": "array",
"items": {
"type": "object",
"properties": {
"workspace_id": {
"type": "string"
},
"devices": {
"type": "array",
"items": {
"type": "string"
}
},
"assignments": {
"type": "array",
"items": {
"type": "object",
"properties": {
"deviceId": {
"type": "string"
},
"workspaceId": {
"type": "string"
},
"updatedAt": {
"type": "string"
},
"updatedBy": {
"type": "string"
}
},
"additionalProperties": true,
"description": "Stored protected assignment decrypted for export with credentialHash removed. Other configuration fields depend on the installed device assignment."
}
}
},
"required": [
"workspace_id",
"devices",
"assignments"
],
"additionalProperties": false
}
}
},
"required": [
"workspaces",
"devices",
"impressions",
"digests",
"anomalies",
"sources",
"source_sync_runs",
"feed_configuration",
"device_state"
],
"additionalProperties": false
},
"total": {
"type": "number"
}
},
"required": [
"organization_id",
"exported_at",
"stores",
"total"
],
"additionalProperties": false
}
},
"required": [
"export"
],
"additionalProperties": false
}
Worked examples
Actual Feed Worker response using synthetic Auth, workspace grants, in-memory D1/KV and simulated source/notification transport. No live provider, encryption audit, device enrollment or external delivery is established. Credentials are excluded or explicitly redacted. SQL result shapes are also reviewed against migrations and handlers; empty captures do not exercise every populated export store. Live publication and read-back are separate environment evidence. Refused examples demonstrate boundaries and must not be executed as successful workflows.
Refused request · HTTP 401
Actual Feed Worker response using synthetic Auth, workspace grants, in-memory D1/KV and simulated source/notification transport. No live provider, encryption audit, device enrollment or external delivery is established. Credentials are excluded or explicitly redacted. Captured scenario: privacy administration is authenticated, permission-gated, and confirmation-gated.
Input · payload.json:
{}
CLI:
topolo actions validate app_topolo_feed.privacy.export --data @payload.json --json
topolo actions plan app_topolo_feed.privacy.export --data @payload.json --json
Captured local response · HTTP 401:
{
"error": "Authentication token required"
}
HTTP 401. The handler refused this request. Resolve its exact cause before retrying; input validation can reject an invalid fixture before it reaches the handler.
Successful request
Actual Feed Worker response using synthetic Auth, workspace grants, in-memory D1/KV and simulated source/notification transport. No live provider, encryption audit, device enrollment or external delivery is established. Credentials are excluded or explicitly redacted. Captured scenario: privacy administration is authenticated, permission-gated, and confirmation-gated.
Input · payload.json:
{}
CLI:
topolo actions validate app_topolo_feed.privacy.export --data @payload.json --json
topolo actions plan app_topolo_feed.privacy.export --data @payload.json --json
topolo actions call app_topolo_feed.privacy.export --data @payload.json --confirm --json
MCP tool and arguments:
{
"tool": "topolo_call_action",
"arguments": {
"actionId": "app_topolo_feed.privacy.export",
"input": {},
"confirm": true
}
}
Captured local response · HTTP 200:
{
"export": {
"organization_id": "org_acme",
"exported_at": "2026-10-04T04:12:42.914Z",
"stores": {
"workspaces": [],
"devices": [],
"impressions": [],
"digests": [],
"anomalies": [],
"sources": [],
"source_sync_runs": [],
"feed_configuration": [],
"device_state": []
},
"total": 0
}
}
HTTP 200. Confirm export.organization_id matches the approved authenticated organization and inspect the nine store arrays under the authorized privacy purpose. Empty fixture arrays exercise the envelope, not every populated schema. An export is not an executable backup restore or a platform-wide export.
Refused request · HTTP 500
Actual Feed Worker response using synthetic Auth, workspace grants, in-memory D1/KV and simulated source/notification transport. No live provider, encryption audit, device enrollment or external delivery is established. Credentials are excluded or explicitly redacted. Captured scenario: unexpected privacy storage failures use the bounded global error contract.
Input · payload.json:
{}
CLI:
topolo actions validate app_topolo_feed.privacy.export --data @payload.json --json
topolo actions plan app_topolo_feed.privacy.export --data @payload.json --json
Captured local response · HTTP 500:
{
"error": "Internal Server Error",
"error_code": "feed_internal_error"
}
HTTP 500. The handler refused this request. Resolve its exact cause before retrying; input validation can reject an invalid fixture before it reaches the handler.
Verify the result
- Confirm export.organization_id matches the approved authenticated organization and inspect the nine store arrays under the authorized privacy purpose.
- Empty fixture arrays exercise the envelope, not every populated schema. An export is not an executable backup restore or a platform-wide export.
Errors and recovery
Authentication token required(HTTP 401): Verify the active organization, application permission and granted workspace; an id or query parameter does not grant access.feed_internal_error(HTTP 500): Inspect the exact handler refusal and correct the target, window, URL or confirmation before preparing another authorized request.
Auth, action-input validation and platform resource resolution can refuse a request before its handler. Retain the exact error, request id and context; requesting another context is not a legitimate way to bypass a refusal.
Recovery boundary
No state is changed. Securely handle the private export under the approved purpose; Feed publishes no restore/import action.
Related actions
- Erase Feed organization stores: Erase local Feed organization records and workspace KV data sequentially, then retain a hashed erasure receipt for 2,557 days. Requires exact ERASE confirmation; preserves canonical Auth identity and encryption keys.
Evidence
Actual Feed Worker response using synthetic Auth, workspace grants, in-memory D1/KV and simulated source/notification transport. No live provider, encryption audit, device enrollment or external delivery is established. Credentials are excluded or explicitly redacted. SQL result shapes are also reviewed against migrations and handlers; empty captures do not exercise every populated export store. Live publication and read-back are separate environment evidence. Capture digests and test scenarios are retained in the source fixture records.