Export Home organization privacy scope

Outcome

Report the authenticated organization’s Home privacy scope. Home stores no local organization data, so stores is empty; Auth identity, provider credentials and backups are explicitly excluded.

Before you start

• Verify the authenticated identity, environment and pinned personal or organization context before preparing an action.
• The published application permission is privacy:read. The path organizationId must match the authenticated organization. Personal context cannot perform this organization operation.
• Authorize the documented engagement, privacy or archival effects before CLI --confirm or MCP confirm:true. A GET request can have effects.

Discover the target

topolo whoami --json
topolo actions get app_topolo_home.organizations.data.export --detail --json

• Use the organization id from the authenticated identity. Home holds no local stores; canonical identity and workspace data belong to Auth.

Request

GET /api/organizations/{organizationId}/data

Save action input as payload.json. Inspect the plan for the exact path, query and body.

Inspect and test this action in the signed action console, then perform the verification below.

Input fields

Exact input schema:

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "organizationId": {
      "type": "string",
      "minLength": 1
    }
  },
  "required": [
    "organizationId"
  ],
  "additionalProperties": false
}

Effects

• Returns an organization-scoped privacy report with credentials_included false and stores {}.
• Exports no canonical Auth identity, household, grants or workspace records.
• Does not constitute a full platform backup or a full organization export.

Interpret the response

Use response path $.data.organization_id for organization_privacy_export. An empty list does not discover a target.

Confirm data.organization_id matches the authenticated organization and stores is empty. Inspect excluded fields; obtain canonical identity and other application data through their separately authorized published actions.

The success schema below was checked against captured handler responses. Signed identity and household metadata can vary. Error examples retain their actual refusal shapes.

Success schema:

{
  "type": "object",
  "required": [
    "success",
    "data"
  ],
  "properties": {
    "success": {
      "type": "boolean"
    },
    "data": {
      "type": "object",
      "required": [
        "organization_id",
        "exported_at",
        "credentials_included",
        "stores",
        "excluded"
      ],
      "properties": {
        "organization_id": {
          "type": "string"
        },
        "exported_at": {
          "type": "string"
        },
        "credentials_included": {
          "type": "boolean"
        },
        "stores": {
          "type": "object",
          "required": [],
          "properties": {},
          "additionalProperties": false
        },
        "excluded": {
          "type": "object",
          "required": [
            "platform_identity",
            "provider_credentials",
            "backups"
          ],
          "properties": {
            "platform_identity": {
              "type": "string"
            },
            "provider_credentials": {
              "type": "string"
            },
            "backups": {
              "type": "string"
            }
          },
          "additionalProperties": false
        }
      },
      "additionalProperties": false
    }
  },
  "additionalProperties": false
}

Worked examples

Actual Home Worker response with synthetic identity and identifiers. Auth grants, platform archival and Nexus usage transport are simulated; Home has no local database. This does not prove live platform archival or Nexus delivery. No request credentials are captured. Captured requests use synthetic principals and identifiers. Registration supports the personal household context; organization privacy and archival require an actual authorized organization context and cannot be inferred from personal access. Refused examples demonstrate boundaries and must not be executed as successful workflows.

Successful request

Actual Home Worker response with synthetic identity and identifiers. Auth grants, platform archival and Nexus usage transport are simulated; Home has no local database. This does not prove live platform archival or Nexus delivery. No request credentials are captured. Captured scenario: privacy export honestly reports no Home stores and erasure retains platform identity.

Input · payload.json:

{
  "organizationId": "org_home_fixture"
}

CLI:

topolo actions validate app_topolo_home.organizations.data.export --data @payload.json --json
topolo actions plan app_topolo_home.organizations.data.export --data @payload.json --json
topolo actions call app_topolo_home.organizations.data.export --data @payload.json --confirm --json

MCP tool and arguments:

{
  "tool": "topolo_call_action",
  "arguments": {
    "actionId": "app_topolo_home.organizations.data.export",
    "input": {
      "organizationId": "org_home_fixture"
    },
    "confirm": true
  }
}

Captured local response · HTTP 200:

{
  "success": true,
  "data": {
    "organization_id": "org_home_fixture",
    "exported_at": "2026-10-04T03:16:34.132Z",
    "credentials_included": false,
    "stores": {},
    "excluded": {
      "platform_identity": "Topolo Auth owns canonical organization, user, household, grant, and workspace identity.",
      "provider_credentials": "Topolo Home stores no provider credentials.",
      "backups": "Encrypted backups follow the platform backup retention and erasure schedule."
    }
  }
}

HTTP 200. Confirm data.organization_id matches the authenticated organization and stores is empty. Inspect excluded fields; obtain canonical identity and other application data through their separately authorized published actions.

Refused request · HTTP 403

Actual Home Worker response with synthetic identity and identifiers. Auth grants, platform archival and Nexus usage transport are simulated; Home has no local database. This does not prove live platform archival or Nexus delivery. No request credentials are captured. Captured scenario: privacy actions refuse another organization and insufficient permission.

Input · payload.json:

{
  "organizationId": "org_other"
}

CLI:

topolo actions validate app_topolo_home.organizations.data.export --data @payload.json --json
topolo actions plan app_topolo_home.organizations.data.export --data @payload.json --json

Captured local response · HTTP 403:

{
  "error": "forbidden"
}

HTTP 403. The handler refused this request. Resolve its exact cause before retrying; input validation can reject an invalid fixture before it reaches the handler.

Refused request · HTTP 403

Actual Home Worker response with synthetic identity and identifiers. Auth grants, platform archival and Nexus usage transport are simulated; Home has no local database. This does not prove live platform archival or Nexus delivery. No request credentials are captured. Captured scenario: privacy actions refuse another organization and insufficient permission.

Input · payload.json:

{
  "organizationId": "org_home_fixture"
}

CLI:

topolo actions validate app_topolo_home.organizations.data.export --data @payload.json --json
topolo actions plan app_topolo_home.organizations.data.export --data @payload.json --json

Captured local response · HTTP 403:

{
  "error": "forbidden"
}

HTTP 403. The handler refused this request. Resolve its exact cause before retrying; input validation can reject an invalid fixture before it reaches the handler.

Refused request · HTTP 403

Actual Home Worker response with synthetic identity and identifiers. Auth grants, platform archival and Nexus usage transport are simulated; Home has no local database. This does not prove live platform archival or Nexus delivery. No request credentials are captured. Captured scenario: personal context cannot invoke organization privacy or workspace archival.

Input · payload.json:

{
  "organizationId": "org_home_fixture"
}

CLI:

topolo actions validate app_topolo_home.organizations.data.export --data @payload.json --json
topolo actions plan app_topolo_home.organizations.data.export --data @payload.json --json

Captured local response · HTTP 403:

{
  "error": "organization_required"
}

HTTP 403. The handler refused this request. Resolve its exact cause before retrying; input validation can reject an invalid fixture before it reaches the handler.

Verify the result

• Confirm data.organization_id matches the authenticated organization and stores is empty.
• Inspect excluded fields; obtain canonical identity and other application data through their separately authorized published actions.

Errors and recovery

• forbidden (HTTP 403): Verify the authenticated organization, exact permission and platform workspace grant; a supplied id never grants access.
• organization_required (HTTP 403): Verify the authenticated organization, exact permission and platform workspace grant; a supplied id never grants access.

Auth, action-input validation and platform resource resolution can refuse a request before its handler. Retain the exact error, request id and context; requesting another context is not a legitimate way to bypass a refusal.

Recovery boundary

This read changes no stored state. Handle the returned organization report under the approved privacy purpose.

Related actions

• Acknowledge Home organization erasure scope: Confirm that Home holds no local organization stores to erase. Requires privacy:write and the exact ERASE literal; preserves Auth identity, canonical workspaces and backups under their retention policies.

Evidence

Actual Home Worker response with synthetic identity and identifiers. Auth grants, platform archival and Nexus usage transport are simulated; Home has no local database. This does not prove live platform archival or Nexus delivery. No request credentials are captured. Captured requests use synthetic principals and identifiers. Registration supports the personal household context; organization privacy and archival require an actual authorized organization context and cannot be inferred from personal access. Capture digests and test scenarios are retained in the source fixture records.