Archive empty Quro workspace

Checks the verified workspace is empty, asks Auth to archive it, then removes Quro’s identity-only mirror. A successful response is HTTP 204 with no body.

Outcome

Checks the verified workspace is empty, asks Auth to archive it, then removes Quro’s identity-only mirror. A successful response is HTTP 204 with no body.

Before you start

Verify identity, environment and the intended organization before discovery.
Discover the published workspace:delete permission and the target policy.
Select an accessible canonical Auth workspace and set WORKSPACE_ID to its returned id. Workspace binding is separate from input.
Review and confirm the exact unchanged plan before execution. Example identifiers grant no live authority.

Discover the target

topolo whoami --json
topolo workspaces list topolo-quro --json
topolo actions get app_topolo_quro.workspaces.delete --detail --json

workspaceId: Exact canonical Auth workspace id. It must match the separately selected workspace binding and must be empty in Quro.

Request

DELETE /api/quro/workspaces/{workspaceId}

Inspect parameters and test this action.

Input fields

Field	Required	Meaning
`workspaceId`	Yes	Exact canonical Auth workspace id. It must match the separately selected workspace binding and must be empty in Quro.

Worked examples

Actual exported Quro Worker with local Miniflare D1/KV and every committed app/analytics migration. Auth, service tokens, Nexus, destination probes and platform archival are synthetic responses; outbound fetch is sealed. Notifications remain in the local outbox. No live redirect propagation, QR scan, destination health, provider delivery, archival or production erasure is established.

Save reviewed input as payload.json, replacing fixture identifiers through discovery.

topolo actions validate app_topolo_quro.workspaces.delete --data @payload.json --json
topolo actions plan app_topolo_quro.workspaces.delete --resource-type workspace --resource-id "$WORKSPACE_ID" --data @payload.json --confirm --json
topolo actions call app_topolo_quro.workspaces.delete --resource-type workspace --resource-id "$WORKSPACE_ID" --data @payload.json --confirm --detail --json

MCP uses the same reviewed input and separately discovered resource binding:

{
  "tool": "topolo_prepare_action",
  "arguments": {
    "actionId": "app_topolo_quro.workspaces.delete",
    "input": {
      "workspaceId": "ws_quro_fixture"
    },
    "resourceType": "workspace",
    "resourceId": "ws_quro_fixture",
    "confirm": true
  }
}

{
  "tool": "topolo_call_action",
  "arguments": {
    "actionId": "app_topolo_quro.workspaces.delete",
    "input": {
      "workspaceId": "ws_quro_fixture"
    },
    "resourceType": "workspace",
    "resourceId": "ws_quro_fixture",
    "confirm": true,
    "detail": true
  }
}

Worked response 1 · HTTP 409 · workspace_not_empty

Input · payload.json:

{
  "workspaceId": "ws_quro_fixture"
}

Captured SDK response:

{
  "success": false,
  "error": "workspace_not_empty"
}

HTTP 409. Read the returned reason and current state. A duplicate slug or non-empty workspace must be reconciled before any retry.

Worked response 2 · HTTP 204

Input · payload.json:

{
  "workspaceId": "ws_quro_fixture"
}

Captured SDK response:

HTTP 204. Use canonical Auth workspace discovery to confirm archival. An SDK request projects the empty body as an empty string. The synthetic archive response in these examples is not a live platform archival.

Verify the result

Use canonical Auth workspace discovery to confirm archival. An SDK request projects the empty body as an empty string. The synthetic archive response in these examples is not a live platform archival.

Errors and recovery

HTTP 409 · workspace_not_empty: Read the returned reason and current state. A duplicate slug or non-empty workspace must be reconciled before any retry.
HTTP 403 · workspace_forbidden: Inspect the actual refusal. The action permission and the verified workspace access are both required; a caller cannot name an ungranted workspace.
HTTP 401 · auth_error: Authenticate again in the intended environment and organization.
HTTP 403 · action_permission_required: Inspect the actual refusal. The action permission and the verified workspace access are both required; a caller cannot name an ungranted workspace.

Inspect the original handler body as well as the SDK error code. These are observed local refusals, not an exhaustive provider-failure list.

Recovery boundary

Empty every workspace-scoped table through authorized operations before requesting archival. Records in notification/export/history tables can also block emptiness. Quro publishes no unarchive action.