Delete QR code

Outcome

Soft-deletes a code, sets status_id to inactive and writes a redirect tombstone. The historical D1 record remains, and repeated deletion can still succeed.

Before you start

• Verify identity, environment and the intended organization before discovery.
• Discover the published codes:write permission and the target policy.
• Select an accessible canonical Auth workspace and set WORKSPACE_ID to its returned id. Workspace binding is separate from input.
• Review and confirm the exact unchanged plan before execution. Example identifiers grant no live authority.

Discover the target

topolo whoami --json
topolo workspaces list topolo-quro --json
topolo actions get app_topolo_quro.qurocodes.delete --detail --json

• id_or_slug: Exact id converted to a string, or exact slug. Numeric strings are interpreted as ids; a human display name is not an identifier.

Request

DELETE /qurocodes/{id_or_slug}

Inspect parameters and test this action.

Input fields

Worked examples

Actual exported Quro Worker with local Miniflare D1/KV and every committed app/analytics migration. Auth, service tokens, Nexus, destination probes and platform archival are synthetic responses; outbound fetch is sealed. Notifications remain in the local outbox. No live redirect propagation, QR scan, destination health, provider delivery, archival or production erasure is established.

Save reviewed input as payload.json, replacing fixture identifiers through discovery.

topolo actions validate app_topolo_quro.qurocodes.delete --data @payload.json --json
topolo actions plan app_topolo_quro.qurocodes.delete --resource-type workspace --resource-id "$WORKSPACE_ID" --data @payload.json --confirm --json
topolo actions call app_topolo_quro.qurocodes.delete --resource-type workspace --resource-id "$WORKSPACE_ID" --data @payload.json --confirm --detail --json

MCP uses the same reviewed input and separately discovered resource binding:

{
  "tool": "topolo_prepare_action",
  "arguments": {
    "actionId": "app_topolo_quro.qurocodes.delete",
    "input": {
      "id_or_slug": "basic-fixture"
    },
    "resourceType": "workspace",
    "resourceId": "ws_quro_fixture",
    "confirm": true
  }
}

{
  "tool": "topolo_call_action",
  "arguments": {
    "actionId": "app_topolo_quro.qurocodes.delete",
    "input": {
      "id_or_slug": "basic-fixture"
    },
    "resourceType": "workspace",
    "resourceId": "ws_quro_fixture",
    "confirm": true,
    "detail": true
  }
}

Worked response 1 · HTTP 200

Input · payload.json:

{
  "id_or_slug": "basic-fixture"
}

Captured SDK response:

{
  "success": true,
  "message": "QURO code deleted successfully"
}

HTTP 200. Use an exact qurocodes.get and inspect deleted_at plus status_id=2; confirm omission from qurocodes.list. Separately verify distributed redirects stop serving the intended target.

Worked response 2 · HTTP 200

Input · payload.json:

{
  "id_or_slug": "1"
}

Captured SDK response:

{
  "success": true,
  "message": "QURO code deleted successfully"
}

HTTP 200. Use an exact qurocodes.get and inspect deleted_at plus status_id=2; confirm omission from qurocodes.list. Separately verify distributed redirects stop serving the intended target.

Worked response 3 · HTTP 404 · QURO code not found

Input · payload.json:

{
  "id_or_slug": "missing-fixture"
}

Captured SDK response:

{
  "success": false,
  "error": "QURO code not found"
}

HTTP 404. Discover the exact record id or slug in the same workspace before retrying.

Verify the result

• Use an exact qurocodes.get and inspect deleted_at plus status_id=2; confirm omission from qurocodes.list. Separately verify distributed redirects stop serving the intended target.

Errors and recovery

• HTTP 404 · http_error: Discover the exact record id or slug in the same workspace before retrying.
• HTTP 401 · auth_error: Authenticate again in the intended environment and organization.
• HTTP 403 · action_permission_required: Inspect the actual refusal. The action permission and the verified workspace access are both required; a caller cannot name an ungranted workspace.

Inspect the original handler body as well as the SDK error code. These are observed local refusals, not an exhaustive provider-failure list.

Recovery boundary

Quro publishes no restore action for the deletion marker. Export and review distribution first. Do not treat an exact HTTP 200 read as failed deletion or blindly recreate the same slug.

Related actions

• Get QR code: Reads one code by exact numeric id or slug within the verified workspace, including its design, scan count and series. Exact reads can return soft-deleted records.
• List QR codes: Lists non-deleted workspace codes with filters, page metadata, tier counts and scan counts; basic codes remain in the same canonical inventory.

Evidence

Actual exported Quro Worker with local Miniflare D1/KV and every committed app/analytics migration. Auth, service tokens, Nexus, destination probes and platform archival are synthetic responses; outbound fetch is sealed. Notifications remain in the local outbox. No live redirect propagation, QR scan, destination health, provider delivery, archival or production erasure is established.