Erase Flow organization data

Erase eligible Flow-owned organization data with the literal ERASE confirmation.

Outcome

Erase eligible Flow-owned organization data with the literal ERASE confirmation.

Before you start

Verify authenticated identity, environment and the approved organization context before preparing an action.
The published application permission is privacy:write. The operation covers the authenticated organization; a workspace header does not narrow connection or privacy scope.
Authorize the documented mutation effects before CLI --confirm or MCP confirm:true. Fixture credentials and ids authorize no live operation.

Discover the target

topolo whoami --json
topolo actions get app_topolo_flow.organizations.data.erase --detail --json

Use the approved authenticated organization; do not infer scope from a fixture workspace.

Request

DELETE /api/organizations/{organizationId}/data

Inspect and test this action. Save the exact input object as payload.json; resource context is supplied separately.

Input fields

Field	Required	Meaning	Constraints
`organizationId`	Required	Exact authenticated organization id; privacy operates across all Flow workspaces.	{"minLength":1}
`confirmation`	Required	Literal ERASE after specific organization-wide destructive authorization.	{"const":"ERASE"}

View the full input schema through the action reference or CLI/MCP discovery.

Effects

Refuses active flows, running runs, pending approvals or retained Workflow instances. Disconnects Nexus connections before sequential execution/core deletes and verifies remaining row counts. Cross-service and split-database operations can partially succeed. Auth identity/canonical workspaces, delivered Notify data and backups under retention remain.

Interpret the response

Read $.data.organization_id for the returned organization identifier. An empty collection does not discover a target.

Require data.erased true and zero verification counts, then organization export/connection reads. No proof of immediate backup deletion or other-owner erasure is supplied.

View the complete success schema. Success examples below preserve the actual exported Worker responses; errors have their original refusal shapes. CLI/MCP add their transport envelope, and --detail requests the full CLI response.

Worked examples

Captured from the actual exported Flow Worker with both local SQLite D1 stores and all committed migrations, synthetic Auth identity/grants and simulated Nexus, archive and Workflow-acceptance transports. Fixture credentials and identifiers authorize no live operation. No live provider invocation, credential storage, notification delivery, metering acceptance, durable Workflow execution, deployment, backup erasure or production completion is established by these captures. Refused examples explain boundaries and must not be executed as successful workflows.

Refused request · HTTP 401

Actual exported Worker response with both local SQLite D1 databases and all committed migrations; synthetic Auth/grants and simulated Nexus/archive transport. No live credentials, provider calls, delivery, deployment or durable Workflow execution proof. Scenario: anonymous action.

Input · payload.json:

{
  "organizationId": "org_flow_fixture"
}

CLI:

topolo actions validate app_topolo_flow.organizations.data.erase --data @payload.json --json
topolo actions plan app_topolo_flow.organizations.data.erase --data @payload.json --json

Captured local response · HTTP 401:

{
  "error": "Authentication token required"
}

HTTP 401. The handler refused this request. Resolve the exact cause before retrying; invalid input can be refused by CLI validation before reaching the handler.

Successful request

Input · payload.json:

{
  "organizationId": "org_flow_fixture",
  "confirmation": "ERASE"
}

CLI:

topolo actions validate app_topolo_flow.organizations.data.erase --data @payload.json --json
topolo actions plan app_topolo_flow.organizations.data.erase --data @payload.json --json
topolo actions call app_topolo_flow.organizations.data.erase --data @payload.json --confirm --detail --json

MCP tool and arguments:

{
  "tool": "topolo_call_action",
  "arguments": {
    "actionId": "app_topolo_flow.organizations.data.erase",
    "input": {
      "organizationId": "org_flow_fixture",
      "confirmation": "ERASE"
    },
    "confirm": true
  }
}

Captured local response · HTTP 200:

{
  "success": true,
  "data": {
    "organization_id": "org_flow_fixture",
    "erased": true,
    "disconnected_nexus_connections": 0,
    "verification": {
      "core": {
        "flow_workspaces": 0,
        "flows": 0
      },
      "execution": {
        "runs": 0,
        "run_steps": 0,
        "flow_notification_outbox": 0,
        "flow_approval_requests": 0,
        "flow_connection_alerts": 0
      }
    },
    "retained": {
      "topolo_auth_identity_and_canonical_workspaces": true,
      "delivered_notifications_under_notify_policy": true,
      "encrypted_backups_until_retention_expiry": true
    }
  }
}

HTTP 200. Require data.erased true and zero verification counts, then organization export/connection reads. No proof of immediate backup deletion or other-owner erasure is supplied.

Refused request · HTTP 400

Input · payload.json:

{
  "organizationId": "org_flow_fixture",
  "confirmation": "wrong"
}

CLI:

topolo actions validate app_topolo_flow.organizations.data.erase --data @payload.json --json
topolo actions plan app_topolo_flow.organizations.data.erase --data @payload.json --json

Captured local response · HTTP 400:

{
  "success": false,
  "error": {
    "code": "invalid_action_input",
    "message": "Invalid action input for \"organizations.data.erase\".",
    "action": "organizations.data.erase",
    "issues": [
      {
        "path": "confirmation",
        "message": "Invalid input: expected \"ERASE\"",
        "code": "invalid_value"
      }
    ]
  }
}

HTTP 400. The handler refused this request. Resolve the exact cause before retrying; invalid input can be refused by CLI validation before reaching the handler.

Refused request · HTTP 409

Input · payload.json:

{
  "organizationId": "org_flow_fixture",
  "confirmation": "ERASE"
}

CLI:

topolo actions validate app_topolo_flow.organizations.data.erase --data @payload.json --json
topolo actions plan app_topolo_flow.organizations.data.erase --data @payload.json --json

Captured local response · HTTP 409:

{
  "success": false,
  "error": "active_flow_work_blocks_erasure",
  "data": {
    "active_flows": 0,
    "running_runs": 0,
    "pending_approvals": 1
  }
}

HTTP 409. The handler refused this request. Resolve the exact cause before retrying; invalid input can be refused by CLI validation before reaching the handler.

Verify the result

Require data.erased true and zero verification counts, then organization export/connection reads. No proof of immediate backup deletion or other-owner erasure is supplied.

Errors and recovery

active_flow_work_blocks_erasure (HTTP 409): After uncertain/partial erasure read actual organization stores and connections before an authorized retry. No rollback exists; never bypass active-work or retention blockers.
invalid_action_input (HTTP 400): After uncertain/partial erasure read actual organization stores and connections before an authorized retry. No rollback exists; never bypass active-work or retention blockers.
Authentication token required (HTTP 401): Authenticate normally in the approved environment and organization, verify identity, then rediscover the action and its granted resource before retrying.
organization_required (HTTP 403): Authenticate into the specifically approved organization. Do not guess a different organization or bypass the refusal.
action_permission_required (HTTP 403): The credential lacks the exact published application permission. Stop and obtain authorized access; changing target ids cannot grant it.
workflow_instance_retention_pending (HTTP 409): Wait for retained durable Workflow instances to expire; do not report erasure complete.
nexus_erasure_unavailable (HTTP 502): Read the actual retained scope and Nexus connection metadata before an authorized retry. Partial disconnection is possible; there is no cross-service transaction.
erasure_verification_failed (HTTP 500): Retain residual counts and request id. Investigate the exact remaining scope before repeating destructive work.

Preserve the exact status, response, request id and resource context. Runtime input validation, authentication and platform resource resolution can refuse a request before the handler. Dynamic dependency messages are not stable provider error codes.

Recovery boundary

After uncertain/partial erasure read actual organization stores and connections before an authorized retry. No rollback exists; never bypass active-work or retention blockers.

Export Flow organization data: Export redacted Flow-owned data across all workspaces in the authenticated organization.

Evidence

Captured from the actual exported Flow Worker with both local SQLite D1 stores and all committed migrations, synthetic Auth identity/grants and simulated Nexus, archive and Workflow-acceptance transports. Fixture credentials and identifiers authorize no live operation. No live provider invocation, credential storage, notification delivery, metering acceptance, durable Workflow execution, deployment, backup erasure or production completion is established by these captures. Original scenario labels and response digests are retained in the source fixtures.

Erase Flow organization data

Outcome

Before you start

Discover the target

Request

Input fields

Effects

Interpret the response

Worked examples

Refused request · HTTP 401

Successful request

Refused request · HTTP 400

Refused request · HTTP 409

Verify the result

Errors and recovery

Recovery boundary

Related actions

Evidence