Erase organization records

Deletes the authenticated organization’s Quro app and analytics records and corresponding discovered KV records, then checks that the included stores are empty. Backups are retained.

Outcome

Deletes the authenticated organization’s Quro app and analytics records and corresponding discovered KV records, then checks that the included stores are empty. Backups are retained.

Before you start

Verify identity, environment and the intended organization before discovery.
Discover the published privacy:write permission and the target policy.
This operation uses the authenticated organization and spans its Quro records, not one workspace.
Review and confirm the exact unchanged plan before execution. Example identifiers grant no live authority.

Discover the target

topolo whoami --json
topolo workspaces list topolo-quro --json
topolo actions get app_topolo_quro.organizations.data.erase --detail --json

Request

DELETE /api/organizations/data/erase

Inspect parameters and test this action.

Input fields

Field	Required	Meaning
`confirmation`	Yes	Literal ERASE for the reviewed authenticated organization. This spans all its Quro workspaces and retains backups.

Worked examples

Actual exported Quro Worker with local Miniflare D1/KV and every committed app/analytics migration. Auth, service tokens, Nexus, destination probes and platform archival are synthetic responses; outbound fetch is sealed. Notifications remain in the local outbox. No live redirect propagation, QR scan, destination health, provider delivery, archival or production erasure is established.

Save reviewed input as payload.json, replacing fixture identifiers through discovery.

topolo actions validate app_topolo_quro.organizations.data.erase --data @payload.json --json
topolo actions plan app_topolo_quro.organizations.data.erase --data @payload.json --confirm --json
topolo actions call app_topolo_quro.organizations.data.erase --data @payload.json --confirm --detail --json

MCP uses the same reviewed input and separately discovered resource binding:

{
  "tool": "topolo_prepare_action",
  "arguments": {
    "actionId": "app_topolo_quro.organizations.data.erase",
    "input": {
      "confirmation": "ERASE"
    },
    "confirm": true
  }
}

{
  "tool": "topolo_call_action",
  "arguments": {
    "actionId": "app_topolo_quro.organizations.data.erase",
    "input": {
      "confirmation": "ERASE"
    },
    "confirm": true,
    "detail": true
  }
}

Worked response 1 · HTTP 200

Input · payload.json:

{
  "confirmation": "ERASE"
}

Captured SDK response:

{
  "success": true,
  "organization_id": "org_quro_fixture",
  "erased": true,
  "remaining": {
    "app": 0,
    "analytics": 0,
    "kv": 0
  },
  "backups_retained": true
}

HTTP 200. Read organizations.data.export in the same identity and confirm the included stores are empty. Inspect remaining counts and backups_retained; do not infer backup deletion.

Verify the result

Read organizations.data.export in the same identity and confirm the included stores are empty. Inspect remaining counts and backups_retained; do not infer backup deletion.

Errors and recovery

HTTP 401 · auth_error: Authenticate again in the intended environment and organization.
HTTP 403 · action_permission_required: Inspect the actual refusal. The action permission and the verified workspace access are both required; a caller cannot name an ungranted workspace.

Inspect the original handler body as well as the SDK error code. These are observed local refusals, not an exhaustive provider-failure list.

Recovery boundary

Export and review the intended organization first. Quro publishes no restore action; printed codes can stop resolving. Retained backups are not an automatic rollback.

Export organization records: Returns organization-scoped app tables, analytics rows, redirect records and discovered scan namespaces without including credentials.