Acknowledge Home organization erasure scope

Confirm that Home holds no local organization stores to erase. Requires privacy:write and the exact ERASE literal; preserves Auth identity, canonical workspaces and backups under their retention policies.

Outcome

Before you start

Verify the authenticated identity, environment and pinned personal or organization context before preparing an action.
The published application permission is privacy:write. The path organizationId must match the authenticated organization. Personal context cannot perform this organization operation.
Authorize the documented engagement, privacy or archival effects before CLI --confirm or MCP confirm:true. A GET request can have effects.

Discover the target

topolo whoami --json
topolo actions get app_topolo_home.organizations.data.erase --detail --json

Use the organization id from the authenticated identity. Home holds no local stores; canonical identity and workspace data belong to Auth.

Request

DELETE /api/organizations/{organizationId}/data

Save action input as payload.json. Inspect the plan for the exact path, query and body.

Inspect and test this action in the signed action console, then perform the verification below.

Input fields

Field	Required	Type	Constraints
`organizationId`	Required	string	{"minLength":1}
`confirmation`	Required	string	{}

Exact input schema:

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "organizationId": {
      "type": "string",
      "minLength": 1
    },
    "confirmation": {
      "type": "string",
      "const": "ERASE"
    }
  },
  "required": [
    "organizationId",
    "confirmation"
  ],
  "additionalProperties": false
}

Effects

Acknowledges erased:true with verification {} because Home holds no local stores.
Deletes no workspace mirrors: Home has none.
Retains Topolo Auth identity and canonical workspaces, plus encrypted backups until their retention expiry.

Interpret the response

Use response path $.data.organization_id for organization_privacy_erasure. An empty list does not discover a target.

Confirm data.organization_id, erased:true, verification:{} and both retained flags. Do not report organization-wide erasure, household deletion, workspace archival or backup purge from this acknowledgement.

The success schema below was checked against captured handler responses. Signed identity and household metadata can vary. Error examples retain their actual refusal shapes.

Success schema:

{
  "type": "object",
  "required": [
    "success",
    "data"
  ],
  "properties": {
    "success": {
      "type": "boolean"
    },
    "data": {
      "type": "object",
      "required": [
        "organization_id",
        "erased",
        "verification",
        "retained"
      ],
      "properties": {
        "organization_id": {
          "type": "string"
        },
        "erased": {
          "type": "boolean"
        },
        "verification": {
          "type": "object",
          "required": [],
          "properties": {},
          "additionalProperties": false
        },
        "retained": {
          "type": "object",
          "required": [
            "topolo_auth_identity_and_canonical_workspaces",
            "encrypted_backups_until_retention_expiry"
          ],
          "properties": {
            "topolo_auth_identity_and_canonical_workspaces": {
              "type": "boolean"
            },
            "encrypted_backups_until_retention_expiry": {
              "type": "boolean"
            }
          },
          "additionalProperties": false
        }
      },
      "additionalProperties": false
    }
  },
  "additionalProperties": false
}

Worked examples

Actual Home Worker response with synthetic identity and identifiers. Auth grants, platform archival and Nexus usage transport are simulated; Home has no local database. This does not prove live platform archival or Nexus delivery. No request credentials are captured. Captured requests use synthetic principals and identifiers. Registration supports the personal household context; organization privacy and archival require an actual authorized organization context and cannot be inferred from personal access. Refused examples demonstrate boundaries and must not be executed as successful workflows.

Successful request

Input · payload.json:

{
  "organizationId": "org_home_fixture",
  "confirmation": "ERASE"
}

CLI:

topolo actions validate app_topolo_home.organizations.data.erase --data @payload.json --json
topolo actions plan app_topolo_home.organizations.data.erase --data @payload.json --json
topolo actions call app_topolo_home.organizations.data.erase --data @payload.json --confirm --json

MCP tool and arguments:

{
  "tool": "topolo_call_action",
  "arguments": {
    "actionId": "app_topolo_home.organizations.data.erase",
    "input": {
      "organizationId": "org_home_fixture",
      "confirmation": "ERASE"
    },
    "confirm": true
  }
}

Captured local response · HTTP 200:

{
  "success": true,
  "data": {
    "organization_id": "org_home_fixture",
    "erased": true,
    "verification": {},
    "retained": {
      "topolo_auth_identity_and_canonical_workspaces": true,
      "encrypted_backups_until_retention_expiry": true
    }
  }
}

HTTP 200. Confirm data.organization_id, erased:true, verification:{} and both retained flags. Do not report organization-wide erasure, household deletion, workspace archival or backup purge from this acknowledgement.

Refused request · HTTP 403

Input · payload.json:

{
  "organizationId": "org_other",
  "confirmation": "ERASE"
}

CLI:

topolo actions validate app_topolo_home.organizations.data.erase --data @payload.json --json
topolo actions plan app_topolo_home.organizations.data.erase --data @payload.json --json

Captured local response · HTTP 403:

{
  "error": "forbidden"
}

HTTP 403. The handler refused this request. Resolve its exact cause before retrying; input validation can reject an invalid fixture before it reaches the handler.

Refused request · HTTP 403

Input · payload.json:

{
  "organizationId": "org_home_fixture",
  "confirmation": "ERASE"
}

CLI:

topolo actions validate app_topolo_home.organizations.data.erase --data @payload.json --json
topolo actions plan app_topolo_home.organizations.data.erase --data @payload.json --json

Captured local response · HTTP 403:

{
  "error": "forbidden"
}

HTTP 403. The handler refused this request. Resolve its exact cause before retrying; input validation can reject an invalid fixture before it reaches the handler.

Refused request · HTTP 403

Input · payload.json:

{
  "organizationId": "org_home_fixture",
  "confirmation": "ERASE"
}

CLI:

topolo actions validate app_topolo_home.organizations.data.erase --data @payload.json --json
topolo actions plan app_topolo_home.organizations.data.erase --data @payload.json --json

Captured local response · HTTP 403:

{
  "error": "organization_required"
}

HTTP 403. The handler refused this request. Resolve its exact cause before retrying; input validation can reject an invalid fixture before it reaches the handler.

Refused request · HTTP 400

Input · payload.json:

{
  "confirmation": "erase",
  "organizationId": "org_home_fixture"
}

CLI:

topolo actions validate app_topolo_home.organizations.data.erase --data @payload.json --json
topolo actions plan app_topolo_home.organizations.data.erase --data @payload.json --json

Captured local response · HTTP 400:

{
  "success": false,
  "error": "erase_confirmation_required"
}

HTTP 400. The handler refused this request. Resolve its exact cause before retrying; input validation can reject an invalid fixture before it reaches the handler.

Verify the result

Confirm data.organization_id, erased:true, verification:{} and both retained flags.
Do not report organization-wide erasure, household deletion, workspace archival or backup purge from this acknowledgement.

Errors and recovery

forbidden (HTTP 403): Verify the authenticated organization, exact permission and platform workspace grant; a supplied id never grants access.
organization_required (HTTP 403): Verify the authenticated organization, exact permission and platform workspace grant; a supplied id never grants access.
erase_confirmation_required (HTTP 400): Send the exact ERASE literal only for an authorized privacy operation.

Auth, action-input validation and platform resource resolution can refuse a request before its handler. Retain the exact error, request id and context; requesting another context is not a legitimate way to bypass a refusal.

Recovery boundary

No local data is deleted by this current implementation. No restore or organization-wide erasure is provided.

Export Home organization privacy scope: Report the authenticated organization’s Home privacy scope. Home stores no local organization data, so stores is empty; Auth identity, provider credentials and backups are explicitly excluded.

Evidence

Actual Home Worker response with synthetic identity and identifiers. Auth grants, platform archival and Nexus usage transport are simulated; Home has no local database. This does not prove live platform archival or Nexus delivery. No request credentials are captured. Captured requests use synthetic principals and identifiers. Registration supports the personal household context; organization privacy and archival require an actual authorized organization context and cannot be inferred from personal access. Capture digests and test scenarios are retained in the source fixture records.

Acknowledge Home organization erasure scope

Outcome

Before you start

Discover the target

Request

Input fields

Effects

Interpret the response

Worked examples

Successful request

Refused request · HTTP 403

Refused request · HTTP 403

Refused request · HTTP 403

Refused request · HTTP 400

Verify the result

Errors and recovery

Recovery boundary

Related actions

Evidence