Delete local application record

Outcome

Deletes One’s local applications D1 entry, subject to system-app protection.

Before you start

• Verify the intended environment, authenticated identity and explicitly authorized ownership context.
• Discover the published apps:write permission and any required resource grant.
• Approve the actual effects before confirming the unchanged planned request. Fixture identifiers, recipients and provider responses authorize no live operation.

Discover the target

topolo whoami --json
topolo actions get app_topolo_one.apps.delete --detail --json

• id: Exact identifier retained from the corresponding create response or permitted list; dashboard ids and local application ids are distinct.

Request

DELETE /api/apps/{id}

Inspect and test this action.

Input fields

Inspect nested fields.

Interpret the response

Inspect deletedApp.id and success. Auth registration and entitlement records remain separate; this does not prove a launcher tile disappeared.

Inspect the declared output schema and captured variants.

Worked examples

Actual exported One Worker with local Miniflare D1/KV. Authentication, application discovery, checkout, billing and remote widget providers are controlled synthetic responses; outbound access is sealed. No live provider outcome is established.

Save the reviewed input below as payload.json; substitute discovered identifiers and bind credential/resource context separately. CLI:

topolo actions validate app_topolo_one.apps.delete --data @payload.json --json
topolo actions plan app_topolo_one.apps.delete --data @payload.json --json
topolo actions call app_topolo_one.apps.delete --data @payload.json --confirm --detail --json

MCP planning and execution use the same reviewed input:

{
  "tool": "topolo_prepare_action",
  "arguments": {
    "actionId": "app_topolo_one.apps.delete",
    "input": {
      "id": "del-app"
    }
  }
}

{
  "tool": "topolo_call_action",
  "arguments": {
    "actionId": "app_topolo_one.apps.delete",
    "input": {
      "id": "del-app"
    },
    "confirm": true,
    "detail": true
  }
}

Successful response · HTTP 200

Input · payload.json:

{
  "id": "del-app"
}

Captured response:

{
  "success": true,
  "message": "Application \"Del\" deleted successfully",
  "deletedApp": {
    "id": "del-app",
    "name": "Del"
  }
}

Inspect deletedApp.id and success. Auth registration and entitlement records remain separate; this does not prove a launcher tile disappeared.

Refused request · HTTP 403 · forbidden

Input · payload.json:

{
  "id": "sys-app"
}

Captured response:

{
  "error": "FORBIDDEN",
  "message": "Cannot delete system applications"
}

Inspect system-app protection and the permitted operation before changing the request.

Refused request · HTTP 404 · http_error

Input · payload.json:

{
  "id": "missing-del"
}

Captured response:

{
  "error": "NOT_FOUND",
  "message": "Application not found"
}

Inspect the retained raw error body and request details before correcting or retrying; this SDK code groups multiple distinct handler refusals.

Refused request · HTTP 401 · auth_error

Input · payload.json:

{
  "id": "del-app"
}

Captured response:

{
  "error": "Token validation failed"
}

Authenticate using the required credential type for this action; service-only actions require the registered Auth service identity.

Verify the result

• Inspect deletedApp.id and success. Auth registration and entitlement records remain separate; this does not prove a launcher tile disappeared.

Errors and recovery

• forbidden (HTTP 403): Inspect system-app protection and the permitted operation before changing the request.
• http_error (HTTP 404): Inspect the retained raw error body and request details before correcting or retrying; this SDK code groups multiple distinct handler refusals.
• auth_error (HTTP 401): Authenticate using the required credential type for this action; service-only actions require the registered Auth service identity.

These are observed local refusals; inspect the raw error body because one SDK code can represent several handler messages. Preserve the request id when available.

Recovery boundary

Recreate an intentionally removed local record from its retained fields through apps.create. Discover uncertain results through authorized operator inspection before retrying.

Related actions

• Create local application record: Create One’s local D1 application record; Auth registration and launcher entitlements are separate.

Evidence

Actual exported One Worker with local Miniflare D1/KV. Authentication, application discovery, checkout, billing and remote widget providers are controlled synthetic responses; outbound access is sealed. No live provider outcome is established.