Archive Home workspace through Auth

Request platform archival of the exact granted Home workspace. Requires workspace:delete, an organization context and an admin grant; Home keeps no database or workspace mirror and delegates the archival decision to Auth.

Outcome

Before you start

Verify the authenticated identity, environment and pinned personal or organization context before preparing an action.
The published application permission is workspace:delete. Discover a granted Home workspace and require admin access; a supplied identifier does not grant access.
Authorize the documented engagement, privacy or archival effects before CLI --confirm or MCP confirm:true. A GET request can have effects.

Discover the target

topolo whoami --json
topolo actions get app_topolo_home.workspaces.delete --detail --json
topolo resources topolo-home --json
topolo workspaces list topolo-home --json

Select the granted admin workspace id as HOME_WORKSPACE_ID. Fixture ids confer no live access.

Request

DELETE /api/workspaces/{workspaceId}

Save action input as payload.json. Inspect the plan for the exact path, query and body. Set HOME_WORKSPACE_ID from granted resource discovery.

Inspect and test this action in the signed action console, then perform the verification below.

Input fields

Field	Required	Type	Constraints
`workspaceId`	Required	string	{"minLength":1}

Exact input schema:

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "workspaceId": {
      "type": "string",
      "minLength": 1
    }
  },
  "required": [
    "workspaceId"
  ],
  "additionalProperties": false
}

Effects

Resolves the requested workspace against platform grants and requires admin access.
Forwards an archival request to Auth, including the acting user and authenticated organization.
Home has no local tables or mirrors to remove; platform refusal leaves the action unsuccessful.

Interpret the response

Use response path $.workspaceId for workspace. An empty list does not discover a target.

Expect HTTP 200 with ok:true and the exact workspaceId. Read the platform workspace catalog for Home and confirm the workspace no longer appears as active. The acknowledgement is not a physical identity-deletion receipt.

The success schema below was checked against captured handler responses. Signed identity and household metadata can vary. Error examples retain their actual refusal shapes.

Success schema:

{
  "type": "object",
  "required": [
    "ok",
    "workspaceId"
  ],
  "properties": {
    "ok": {
      "type": "boolean"
    },
    "workspaceId": {
      "type": "string"
    }
  },
  "additionalProperties": false
}

Worked examples

Actual Home Worker response with synthetic identity and identifiers. Auth grants, platform archival and Nexus usage transport are simulated; Home has no local database. This does not prove live platform archival or Nexus delivery. No request credentials are captured. Captured requests use synthetic principals and identifiers. Registration supports the personal household context; organization privacy and archival require an actual authorized organization context and cannot be inferred from personal access. Refused examples demonstrate boundaries and must not be executed as successful workflows.

Refused request · HTTP 403

Input · payload.json:

{
  "workspaceId": "ws_home_fixture"
}

CLI:

topolo actions validate app_topolo_home.workspaces.delete --data @payload.json --json
topolo actions plan app_topolo_home.workspaces.delete --resource-type workspace --resource-id "$HOME_WORKSPACE_ID" --data @payload.json --json

Captured local response · HTTP 403:

{
  "error": "organization_required"
}

HTTP 403. The handler refused this request. Resolve its exact cause before retrying; input validation can reject an invalid fixture before it reaches the handler.

Successful request

Input · payload.json:

{
  "workspaceId": "ws_home_fixture"
}

CLI:

topolo actions validate app_topolo_home.workspaces.delete --data @payload.json --json
topolo actions plan app_topolo_home.workspaces.delete --resource-type workspace --resource-id "$HOME_WORKSPACE_ID" --data @payload.json --json
topolo actions call app_topolo_home.workspaces.delete --resource-type workspace --resource-id "$HOME_WORKSPACE_ID" --data @payload.json --confirm --json

MCP tool and arguments:

{
  "tool": "topolo_call_action",
  "arguments": {
    "actionId": "app_topolo_home.workspaces.delete",
    "input": {
      "workspaceId": "ws_home_fixture"
    },
    "resourceType": "workspace",
    "resourceId": "<identifier returned by granted resource discovery>",
    "confirm": true
  }
}

Captured local response · HTTP 200:

{
  "ok": true,
  "workspaceId": "ws_home_fixture"
}

HTTP 200. Expect HTTP 200 with ok:true and the exact workspaceId. Read the platform workspace catalog for Home and confirm the workspace no longer appears as active. The acknowledgement is not a physical identity-deletion receipt.

Refused request · HTTP 403

Input · payload.json:

{
  "workspaceId": "ws_home_fixture"
}

CLI:

topolo actions validate app_topolo_home.workspaces.delete --data @payload.json --json
topolo actions plan app_topolo_home.workspaces.delete --resource-type workspace --resource-id "$HOME_WORKSPACE_ID" --data @payload.json --json

Captured local response · HTTP 403:

{
  "error": "You do not have access to this workspace",
  "code": "workspace_forbidden"
}

HTTP 403. The handler refused this request. Resolve its exact cause before retrying; input validation can reject an invalid fixture before it reaches the handler.

Refused request · HTTP 403

Input · payload.json:

{
  "workspaceId": "ws_home_fixture"
}

CLI:

topolo actions validate app_topolo_home.workspaces.delete --data @payload.json --json
topolo actions plan app_topolo_home.workspaces.delete --resource-type workspace --resource-id "$HOME_WORKSPACE_ID" --data @payload.json --json

Captured local response · HTTP 403:

{
  "error": "This workspace requires admin access",
  "code": "workspace_access_insufficient"
}

HTTP 403. The handler refused this request. Resolve its exact cause before retrying; input validation can reject an invalid fixture before it reaches the handler.

Refused request · HTTP 409

Input · payload.json:

{
  "workspaceId": "ws_home_fixture"
}

CLI:

topolo actions validate app_topolo_home.workspaces.delete --data @payload.json --json
topolo actions plan app_topolo_home.workspaces.delete --resource-type workspace --resource-id "$HOME_WORKSPACE_ID" --data @payload.json --json

Captured local response · HTTP 409:

{
  "error": "workspace_archive_refused"
}

HTTP 409. The handler refused this request. Resolve its exact cause before retrying; input validation can reject an invalid fixture before it reaches the handler.

Verify the result

Expect HTTP 200 with ok:true and the exact workspaceId.
Read the platform workspace catalog for Home and confirm the workspace no longer appears as active. The acknowledgement is not a physical identity-deletion receipt.

Errors and recovery

organization_required (HTTP 403): Verify the authenticated organization, exact permission and platform workspace grant; a supplied id never grants access.
workspace_forbidden (HTTP 403): Verify the authenticated organization, exact permission and platform workspace grant; a supplied id never grants access.
workspace_access_insufficient (HTTP 403): Verify the authenticated organization, exact permission and platform workspace grant; a supplied id never grants access.
workspace_archive_refused (HTTP 409): Retain the platform refusal and request id; resolve its stated cause through published operations before retrying.

Auth, action-input validation and platform resource resolution can refuse a request before its handler. Retain the exact error, request id and context; requesting another context is not a legitimate way to bypass a refusal.

Recovery boundary

No restore action is published by Home. Do not recreate an identity or infer recoverability; retain the archival receipt and inspect the platform’s published lifecycle policy.

Evidence

Actual Home Worker response with synthetic identity and identifiers. Auth grants, platform archival and Nexus usage transport are simulated; Home has no local database. This does not prove live platform archival or Nexus delivery. No request credentials are captured. Captured requests use synthetic principals and identifiers. Registration supports the personal household context; organization privacy and archival require an actual authorized organization context and cannot be inferred from personal access. Capture digests and test scenarios are retained in the source fixture records.