Archive workspace

Outcome

Archives the specifically authorized, empty canonical workspace through Auth and removes One’s local workspace mirrors.

Before you start

• Verify the intended environment, authenticated identity and explicitly authorized ownership context.
• Discover the published workspace:delete permission and any required resource grant.
• Approve the actual effects before confirming the unchanged planned request. Fixture identifiers, recipients and provider responses authorize no live operation.

Discover the target

topolo whoami --json
topolo actions get app_topolo_one.workspaces.delete --detail --json
topolo workspaces list topolo-one --json

• workspaceId: Exact canonical Auth workspace id with the required grant; bind workspace resource context separately.

Request

DELETE /api/workspaces/{workspaceId}

Inspect and test this action.

Input fields

Inspect nested fields.

Interpret the response

Re-discover canonical Auth workspaces and inspect the exact workspace id. A successful local fixture proves only the simulated Auth acknowledgement plus actual local KV cleanup.

Inspect the declared output schema and captured variants.

Worked examples

Actual exported One Worker with local Miniflare D1/KV. Authentication, application discovery, checkout, billing and remote widget providers are controlled synthetic responses; outbound access is sealed. No live provider outcome is established.

Save the reviewed input below as payload.json; substitute discovered identifiers and bind credential/resource context separately. CLI:

topolo actions validate app_topolo_one.workspaces.delete --data @payload.json --json
topolo actions plan app_topolo_one.workspaces.delete --resource-type workspace --resource-id "$ONE_WORKSPACE_ID" --data @payload.json --json
topolo actions call app_topolo_one.workspaces.delete --resource-type workspace --resource-id "$ONE_WORKSPACE_ID" --data @payload.json --confirm --detail --json

MCP planning and execution use the same reviewed input:

{
  "tool": "topolo_prepare_action",
  "arguments": {
    "actionId": "app_topolo_one.workspaces.delete",
    "input": {
      "workspaceId": "ws_fixture_empty"
    },
    "resourceType": "workspace",
    "resourceId": "REPLACE_WITH_GRANTED_WORKSPACE_ID"
  }
}

{
  "tool": "topolo_call_action",
  "arguments": {
    "actionId": "app_topolo_one.workspaces.delete",
    "input": {
      "workspaceId": "ws_fixture_empty"
    },
    "resourceType": "workspace",
    "resourceId": "REPLACE_WITH_GRANTED_WORKSPACE_ID",
    "confirm": true,
    "detail": true
  }
}

Refused request · HTTP 401 · auth_error

Input · payload.json:

{
  "workspaceId": "ws_fixture_empty"
}

Captured response:

{
  "error": "Token validation failed"
}

Authenticate using the required credential type for this action; service-only actions require the registered Auth service identity.

Successful response · HTTP 200

Input · payload.json:

{
  "workspaceId": "ws_fixture_empty"
}

Captured response:

{
  "ok": true,
  "workspaceId": "ws_fixture_empty"
}

Re-discover canonical Auth workspaces and inspect the exact workspace id. A successful local fixture proves only the simulated Auth acknowledgement plus actual local KV cleanup.

Refused request · HTTP 409 · workspace_not_empty

Input · payload.json:

{
  "workspaceId": "ws_fixture_occupied"
}

Captured response:

{
  "error": "This workspace still holds Topolo One data",
  "code": "workspace_not_empty"
}

Inspect the exact workspace contents and resolve only approved records before archival.

Verify the result

• Re-discover canonical Auth workspaces and inspect the exact workspace id. A successful local fixture proves only the simulated Auth acknowledgement plus actual local KV cleanup.

Errors and recovery

• auth_error (HTTP 401): Authenticate using the required credential type for this action; service-only actions require the registered Auth service identity.
• workspace_not_empty (HTTP 409): Inspect the exact workspace contents and resolve only approved records before archival.

These are observed local refusals; inspect the raw error body because one SDK code can represent several handler messages. Preserve the request id when available.

Recovery boundary

Archive cannot be undone by One. Resolve workspace_not_empty by inspecting its contents; do not erase unrelated data merely to make archival pass.

Evidence

Actual exported One Worker with local Miniflare D1/KV. Authentication, application discovery, checkout, billing and remote widget providers are controlled synthetic responses; outbound access is sealed. No live provider outcome is established.