Erase Insights organization data

Outcome

Erase this environment’s Insights organization rows and archive/report objects, then report verification counts.

Before you start

• Verify the exact identity, environment and approved organization with topolo whoami before discovering this action.
• Inspect the credential-scoped action and canonical resource discovery. Examples use synthetic resources; replace their handles only with separately verified targets.
• Validate the complete input and review the action plan. Mutation and organization-inventory actions require explicit confirmation; a successful shape check does not prove a runtime grant.
• organizationId must equal the authenticated organization. A workspace context does not narrow this organization-wide operation.

Discover the target

topolo whoami --json
topolo apps get topolo-insights --json
topolo actions get app_topolo_insights.organizations.data.erase --detail --json
topolo resources topolo-insights --json

Request

DELETE /api/organizations/{organizationId}/data · permission privacy:write · confirmation required.

Inspect schemas and test this action in the signed action console. The complete field schema is also available through CLI/MCP action discovery.

Effects and scope

• Requires privacy:write, the authenticated organization id, exact confirmation ERASE and an explicitly confirmed action plan. Workspace selection does not reduce scope.
• Lists and deletes raw archive/report objects at the selected environment/organization prefix, then deletes workspace_settings with cascading D1 children. D1 and R2 operations are sequential, not one atomic transaction.
• Returns ok, deletion outcomes and verified remaining counts. deleted.databaseRows is a boolean emptiness result, not a number of deleted rows. Repeating a completed erase can return success with zero objects.
• Does not erase Auth organization/workspace identity, other environment prefixes, Analytics Engine sink points, external copies or provider backups. It is not a claim of complete platform-wide privacy erasure.
• Queued envelopes are not explicitly removed. Missing erased receipts can make later processing skip them, but queue drain/provider state is not proven by this response.

Interpret the response

• Require ok true and all verified.databaseRows/rawEventArchives/generatedReports counts zero.
• Read organizations.data.export for the same organization/environment to check all inventories. Record the excluded stores and any cross-store partial failure.
• Confirm the reviewed organization-wide scope before calling; the counts-only export cannot serve as a restoration backup.

Worked requests and responses

Actual exported Insights worker, all nine migrated D1 scripts and isolated local R2. Auth identity/grants/archive transport, queue delivery and Analytics Engine sink are synthetic; local queue processing is called explicitly. Notify and Nexus are disabled. No live website, provider, paid usage or deployed data erasure is tested. Successful and refused captures below are separate examples. A refused response is a boundary, not a successful task.

permission-refusals · refusal 1 · HTTP 403

Actual exported Insights worker, all nine migrated D1 scripts and isolated local R2. Auth identity/grants/archive transport, queue delivery and Analytics Engine sink are synthetic; local queue processing is called explicitly. Notify and Nexus are disabled. No live website, provider, paid usage or deployed data erasure is tested. Selected synthetic workspace: ws_insights_merge. Fixture handles authorize no live request.

Input · payload.json:

{
  "organizationId": "organization_example",
  "confirmation": "ERASE"
}

CLI:

topolo actions validate app_topolo_insights.organizations.data.erase --data @payload.json --json
topolo actions plan app_topolo_insights.organizations.data.erase --data @payload.json --confirm --json

Captured raw Worker result

{
  "success": false,
  "error": {
    "code": "action_permission_required",
    "message": "Action \"organizations.data.erase\" requires permission \"privacy:write\".",
    "action": "organizations.data.erase"
  }
}

HTTP 403. The credential lacks the declared action permission. Inspect credential-scoped discovery in the same approved context; workspace role does not replace the permission.

CLI/MCP adds its transport envelope; CLI --detail retains the full action result.

privacy · refusal 2 · HTTP 403

Actual exported Insights worker, all nine migrated D1 scripts and isolated local R2. Auth identity/grants/archive transport, queue delivery and Analytics Engine sink are synthetic; local queue processing is called explicitly. Notify and Nexus are disabled. No live website, provider, paid usage or deployed data erasure is tested. Selected synthetic workspace: ws_insights_merge. Fixture handles authorize no live request.

Input · payload.json:

{
  "organizationId": "org_other",
  "confirmation": "ERASE"
}

CLI:

topolo actions validate app_topolo_insights.organizations.data.erase --data @payload.json --json
topolo actions plan app_topolo_insights.organizations.data.erase --data @payload.json --confirm --json

Captured raw Worker result

{
  "error": "organization_forbidden"
}

HTTP 403. Use the authenticated organization id discovered through whoami; selecting a workspace does not authorize another organization.

CLI/MCP adds its transport envelope; CLI --detail retains the full action result.

privacy · success 3 · HTTP 200

Actual exported Insights worker, all nine migrated D1 scripts and isolated local R2. Auth identity/grants/archive transport, queue delivery and Analytics Engine sink are synthetic; local queue processing is called explicitly. Notify and Nexus are disabled. No live website, provider, paid usage or deployed data erasure is tested. Selected synthetic workspace: ws_insights_merge. Fixture handles authorize no live request.

Input · payload.json:

{
  "organizationId": "org_insights_fixture",
  "confirmation": "ERASE"
}

CLI:

topolo actions validate app_topolo_insights.organizations.data.erase --data @payload.json --json
topolo actions plan app_topolo_insights.organizations.data.erase --data @payload.json --confirm --json
topolo actions call app_topolo_insights.organizations.data.erase --data @payload.json --confirm --detail --json

MCP tool and arguments:

{
  "tool": "topolo_call_action",
  "arguments": {
    "actionId": "app_topolo_insights.organizations.data.erase",
    "input": {
      "organizationId": "org_insights_fixture",
      "confirmation": "ERASE"
    },
    "confirm": true
  }
}

Captured raw Worker result

{
  "ok": true,
  "organizationId": "org_insights_fixture",
  "erasedAt": "2026-10-04T08:52:49.483Z",
  "deleted": {
    "databaseRows": true,
    "rawEventArchives": 2,
    "generatedReports": 1
  },
  "verified": {
    "databaseRows": 0,
    "rawEventArchives": 0,
    "generatedReports": 0
  }
}

HTTP 200. Require ok true and all verified.databaseRows/rawEventArchives/generatedReports counts zero. Read organizations.data.export for the same organization/environment to check all inventories. Record the excluded stores and any cross-store partial failure. Confirm the reviewed organization-wide scope before calling; the counts-only export cannot serve as a restoration backup.

CLI/MCP adds its transport envelope; CLI --detail retains the full action result.

privacy · success 4 · HTTP 200

Actual exported Insights worker, all nine migrated D1 scripts and isolated local R2. Auth identity/grants/archive transport, queue delivery and Analytics Engine sink are synthetic; local queue processing is called explicitly. Notify and Nexus are disabled. No live website, provider, paid usage or deployed data erasure is tested. Selected synthetic workspace: ws_insights_merge. Fixture handles authorize no live request.

Input · payload.json:

{
  "organizationId": "org_insights_fixture",
  "confirmation": "ERASE"
}

CLI:

topolo actions validate app_topolo_insights.organizations.data.erase --data @payload.json --json
topolo actions plan app_topolo_insights.organizations.data.erase --data @payload.json --confirm --json
topolo actions call app_topolo_insights.organizations.data.erase --data @payload.json --confirm --detail --json

MCP tool and arguments:

{
  "tool": "topolo_call_action",
  "arguments": {
    "actionId": "app_topolo_insights.organizations.data.erase",
    "input": {
      "organizationId": "org_insights_fixture",
      "confirmation": "ERASE"
    },
    "confirm": true
  }
}

Captured raw Worker result

{
  "ok": true,
  "organizationId": "org_insights_fixture",
  "erasedAt": "2026-10-04T08:52:49.545Z",
  "deleted": {
    "databaseRows": true,
    "rawEventArchives": 0,
    "generatedReports": 0
  },
  "verified": {
    "databaseRows": 0,
    "rawEventArchives": 0,
    "generatedReports": 0
  }
}

HTTP 200. Require ok true and all verified.databaseRows/rawEventArchives/generatedReports counts zero. Read organizations.data.export for the same organization/environment to check all inventories. Record the excluded stores and any cross-store partial failure. Confirm the reviewed organization-wide scope before calling; the counts-only export cannot serve as a restoration backup.

CLI/MCP adds its transport envelope; CLI --detail retains the full action result.

Verify the outcome

• Require ok true and all verified.databaseRows/rawEventArchives/generatedReports counts zero.
• Read organizations.data.export for the same organization/environment to check all inventories. Record the excluded stores and any cross-store partial failure.
• Confirm the reviewed organization-wide scope before calling; the counts-only export cannot serve as a restoration backup.

Errors and recovery

• action_permission_required (HTTP 403): The credential lacks the declared action permission. Inspect credential-scoped discovery in the same approved context; workspace role does not replace the permission.
• organization_forbidden (HTTP 403): Use the authenticated organization id discovered through whoami; selecting a workspace does not authorize another organization.

Only observed refusals are listed. This does not promise that external dependencies or every invalid payload have been exhaustively exercised.

Recovery boundary

No restore action or row/object export is provided. If a cross-store operation fails, inspect the inventory in the same approved environment and organization; do not broaden scope or claim complete erasure until verification counts pass.

Related actions

• app_topolo_insights.organizations.data.export: Return database row counts and object metadata for the authenticated organization in this environment.

Evidence and limits

Actual exported Insights worker, all nine migrated D1 scripts and isolated local R2. Auth identity/grants/archive transport, queue delivery and Analytics Engine sink are synthetic; local queue processing is called explicitly. Notify and Nexus are disabled. No live website, provider, paid usage or deployed data erasure is tested.