Topolo Docs Topolo Platform
Open workspace

Export Flow organization data

Export redacted Flow-owned data across all workspaces in the authenticated organization.

Outcome

Export redacted Flow-owned data across all workspaces in the authenticated organization.

Before you start

  • Verify authenticated identity, environment and the approved organization context before preparing an action.
  • The published application permission is privacy:read. The operation covers the authenticated organization; a workspace header does not narrow connection or privacy scope.

Discover the target

topolo whoami --json
topolo actions get app_topolo_flow.organizations.data.export --detail --json
  • Use the approved authenticated organization; do not infer scope from a fixture workspace.

Request

GET /api/organizations/{organizationId}/data

Inspect and test this action. Save the exact input object as payload.json; resource context is supplied separately.

Input fields

FieldRequiredMeaningConstraints
organizationIdRequiredExact authenticated organization id; privacy operates across all Flow workspaces.{"minLength":1}

View the full input schema through the action reference or CLI/MCP discovery.

Effects

  • Reads two core and five execution tables, Nexus connection metadata and retained Workflow status metadata. Secret-shaped fields and parsed JSON are recursively redacted. This is not narrowed by a workspace resource header; Auth identity, provider credentials, delivered Notify data and backups are excluded.

Interpret the response

Read $.data.organization_id for the returned organization identifier. An empty collection does not discover a target.

Check data.organization_id, credentials_included false, stores and excluded scope. Keep the export private and use retained canonical run/step records for payload evidence.

View the complete success schema. Success examples below preserve the actual exported Worker responses; errors have their original refusal shapes. CLI/MCP add their transport envelope, and --detail requests the full CLI response.

Worked examples

Captured from the actual exported Flow Worker with both local SQLite D1 stores and all committed migrations, synthetic Auth identity/grants and simulated Nexus, archive and Workflow-acceptance transports. Fixture credentials and identifiers authorize no live operation. No live provider invocation, credential storage, notification delivery, metering acceptance, durable Workflow execution, deployment, backup erasure or production completion is established by these captures. Refused examples explain boundaries and must not be executed as successful workflows.

Refused request · HTTP 401

Actual exported Worker response with both local SQLite D1 databases and all committed migrations; synthetic Auth/grants and simulated Nexus/archive transport. No live credentials, provider calls, delivery, deployment or durable Workflow execution proof. Scenario: anonymous action.

Input · payload.json:

{
  "organizationId": "org_flow_fixture"
}

CLI:

topolo actions validate app_topolo_flow.organizations.data.export --data @payload.json --json
topolo actions plan app_topolo_flow.organizations.data.export --data @payload.json --json

Captured local response · HTTP 401:

{
  "error": "Authentication token required"
}

HTTP 401. The handler refused this request. Resolve the exact cause before retrying; invalid input can be refused by CLI validation before reaching the handler.

Refused request · HTTP 403

Actual exported Worker response with both local SQLite D1 databases and all committed migrations; synthetic Auth/grants and simulated Nexus/archive transport. No live credentials, provider calls, delivery, deployment or durable Workflow execution proof. Scenario: other organization.

Input · payload.json:

{
  "organizationId": "org_other_fixture"
}

CLI:

topolo actions validate app_topolo_flow.organizations.data.export --data @payload.json --json
topolo actions plan app_topolo_flow.organizations.data.export --data @payload.json --json

Captured local response · HTTP 403:

{
  "error": "organization_forbidden"
}

HTTP 403. The handler refused this request. Resolve the exact cause before retrying; invalid input can be refused by CLI validation before reaching the handler.

Successful request

Actual exported Worker response with both local SQLite D1 databases and all committed migrations; synthetic Auth/grants and simulated Nexus/archive transport. No live credentials, provider calls, delivery, deployment or durable Workflow execution proof. Scenario: organizations.data.export.

Input · payload.json:

{
  "organizationId": "org_flow_fixture"
}

CLI:

topolo actions validate app_topolo_flow.organizations.data.export --data @payload.json --json
topolo actions plan app_topolo_flow.organizations.data.export --data @payload.json --json
topolo actions call app_topolo_flow.organizations.data.export --data @payload.json --detail --json

MCP tool and arguments:

{
  "tool": "topolo_read_action",
  "arguments": {
    "actionId": "app_topolo_flow.organizations.data.export",
    "input": {
      "organizationId": "org_flow_fixture"
    }
  }
}

Captured local response · HTTP 200:

{
  "success": true,
  "data": {
    "organization_id": "org_flow_fixture",
    "exported_at": "2026-10-05T16:42:02.130Z",
    "credentials_included": false,
    "stores": {
      "core": {
        "flow_workspaces": [
          {
            "id": "ws_flow_fixture",
            "organization_id": "org_flow_fixture",
            "status": "active",
            "created_at": "2026-10-05T16:42:02.068Z",
            "updated_at": "2026-10-05T16:42:02.068Z"
          }
        ],
        "flows": [
          {
            "id": "flow_6eca1fcc65ff496dbcaa",
            "organization_id": "org_flow_fixture",
            "workspace_id": "ws_flow_fixture",
            "name": "Manual fixture",
            "description": null,
            "status": "draft",
            "graph": {
              "nodes": [
                {
                  "id": "trigger",
                  "type": "trigger",
                  "position": {
                    "x": 0,
                    "y": 0
                  },
                  "data": {
                    "kind": "trigger.manual"
                  }
                },
                {
                  "id": "transform",
                  "type": "logic",
                  "position": {
                    "x": 240,
                    "y": 0
                  },
                  "data": {
                    "kind": "core.transform",
                    "config": {
                      "assignments": {
                        "message": "{{trigger.message}}"
                      }
                    }
                  }
                }
              ],
              "edges": [
                {
                  "id": "trigger-transform",
                  "source": "trigger",
                  "target": "transform"
                }
              ]
            },
            "trigger_type": "manual",
            "webhook_secret": "[REDACTED]",
            "schedule_cron": null,
            "schedule_next_run_at": null,
            "event_type": null,
            "created_by": "usr_flow_fixture",
            "created_at": 1791218522068,
            "updated_at": 1791218522068,
            "last_run_at": null,
            "last_run_status": null,
            "run_count": 0,
            "success_count": 0,
            "error_count": 0
          }
        ]
      },
      "execution": {
        "runs": [],
        "run_steps": [],
        "flow_notification_outbox": [],
        "flow_approval_requests": [],
        "flow_connection_alerts": []
      },
      "nexus_connection_metadata": [],
      "workflow_instance_metadata": []
    },
    "excluded": {
      "nexus_credentials": "Nexus owns encrypted provider credentials; Flow exports metadata only.",
      "workflow_instance_payloads": "Transient Workflow copies are represented by the canonical redacted D1 run and step records.",
      "platform_identity": "Topolo Auth owns canonical organization, user, grant, and workspace identity.",
      "delivered_notifications": "Topolo Notify owns delivered notification payloads and recipient preferences.",
      "backups": "Encrypted backups follow the platform backup retention and erasure schedule."
    }
  }
}

HTTP 200. Check data.organization_id, credentials_included false, stores and excluded scope. Keep the export private and use retained canonical run/step records for payload evidence.

Refused request · HTTP 502

Actual exported Worker response with both local SQLite D1 databases and all committed migrations; synthetic Auth/grants and simulated Nexus/archive transport. No live credentials, provider calls, delivery, deployment or durable Workflow execution proof. Scenario: Nexus export unavailable.

Input · payload.json:

{
  "organizationId": "org_flow_fixture"
}

CLI:

topolo actions validate app_topolo_flow.organizations.data.export --data @payload.json --json
topolo actions plan app_topolo_flow.organizations.data.export --data @payload.json --json

Captured local response · HTTP 502:

{
  "success": false,
  "error": "nexus_export_unavailable"
}

HTTP 502. The handler refused this request. Resolve the exact cause before retrying; invalid input can be refused by CLI validation before reaching the handler.

Verify the result

  • Check data.organization_id, credentials_included false, stores and excluded scope. Keep the export private and use retained canonical run/step records for payload evidence.

Errors and recovery

  • Authentication token required (HTTP 401): Authenticate normally in the approved environment and organization, verify identity, then rediscover the action and its granted resource before retrying.
  • nexus_export_unavailable (HTTP 502): Retry the same read after a dependency recovers; do not substitute a workspace-only export or claim it includes excluded owners.
  • organization_forbidden (HTTP 403): Retry the same read after a dependency recovers; do not substitute a workspace-only export or claim it includes excluded owners.
  • organization_required (HTTP 403): Authenticate into the specifically approved organization. Do not guess a different organization or bypass the refusal.
  • action_permission_required (HTTP 403): The credential lacks the exact published application permission. Stop and obtain authorized access; changing target ids cannot grant it.

Preserve the exact status, response, request id and resource context. Runtime input validation, authentication and platform resource resolution can refuse a request before the handler. Dynamic dependency messages are not stable provider error codes.

Recovery boundary

Retry the same read after a dependency recovers; do not substitute a workspace-only export or claim it includes excluded owners.

Evidence

Captured from the actual exported Flow Worker with both local SQLite D1 stores and all committed migrations, synthetic Auth identity/grants and simulated Nexus, archive and Workflow-acceptance transports. Fixture credentials and identifiers authorize no live operation. No live provider invocation, credential storage, notification delivery, metering acceptance, durable Workflow execution, deployment, backup erasure or production completion is established by these captures. Original scenario labels and response digests are retained in the source fixtures.