Topolo Docs Topolo Platform
Open workspace

Archive empty Sign workspace

Confirm that the granted Sign workspace has no retained records, ask Auth to archive it and remove its local mirror after Auth acceptance. Success is HTTP 204 without a body.

Outcome

Confirm that the granted Sign workspace has no retained records, ask Auth to archive it and remove its local mirror after Auth acceptance. Success is HTTP 204 without a body.

Before you start

  • Verify the environment, authenticated identity and specifically approved organization context.
  • The published application permission is workspace:delete. Resolve and bind the exact canonical Sign workspace. A supplied id or organization membership alone grants no workspace access.
  • Session callers require admin workspace access. API-key resource binding is verified by Auth; never treat a caller-supplied header as an independent grant.
  • Approve the documented mutation and actual recipient/document targets before CLI --confirm or MCP confirm:true. A synthetic fixture authorizes no live agreement, notification or data deletion.

Discover the target

topolo whoami --json
topolo actions get app_topolo_sign.workspaces.delete --detail --json
topolo resources topolo-sign --json
topolo workspaces list topolo-sign --json
  • Set SIGN_WORKSPACE_ID to the exact granted workspace returned by discovery.

Request

DELETE /api/workspaces/{workspaceId}

Inspect and test this action. Save the reviewed input as payload.json. Supply resource context separately.

Input fields

FieldRequiredMeaningConstraints
workspaceIdRequiredExact granted canonical workspace id. Archive requires admin access, workspace:delete and an empty existing local mirror.{"minLength":1}

Read the complete input schema.

Effects

  • Archives an empty non-default Sign workspace and asks the platform to release it.
  • Refused while the workspace still holds envelopes or templates.

Interpret the response

HTTP 204 has no response body or returned workspace id. Retain the verified input workspaceId and verify through canonical Auth workspace discovery.

Retain the input workspaceId; HTTP 204 has no response payload. Read the canonical Auth workspace lifecycle state in the same app and organization; compare the exact workspace id. A local mirror deletion is not evidence of unrelated data erasure.

Inspect the success schema. CLI/MCP add their transport envelope; --detail requests the full CLI result. HTTP 204 contains no JSON payload.

Worked examples

Captured from the exported Sign Worker with the existing SQLite-backed D1 harness applying all core, envelope and audit migrations to one local database, in-memory R2 and synthetic Auth/workspace/archive/Notify transports. These examples prove local validation, persistence and artifact production. They do not prove separate deployed D1 topology, real recipient consent, provider delivery or a live signed agreement. All identities, signing links and documents are synthetic; replace identifiers through authorized discovery and never execute a fixture against a live organization. Binary download examples use the released SDK binary projection; tests Base64-decode and compare original bytes, lengths and server SHA-256 headers.

Supported request · Archive an empty granted workspace after synthetic Auth acceptance

Input · payload.json:

{
  "workspaceId": "ws_default"
}

CLI:

topolo actions validate app_topolo_sign.workspaces.delete --data @payload.json --json
topolo actions plan app_topolo_sign.workspaces.delete --resource-type workspace --resource-id "$SIGN_WORKSPACE_ID" --data @payload.json --json
topolo actions call app_topolo_sign.workspaces.delete --resource-type workspace --resource-id "$SIGN_WORKSPACE_ID" --data @payload.json --confirm --detail --json

MCP tool and arguments:

{
  "tool": "topolo_call_action",
  "arguments": {
    "actionId": "app_topolo_sign.workspaces.delete",
    "input": {
      "workspaceId": "ws_default"
    },
    "resourceType": "workspace",
    "resourceId": "<exact granted id from discovery>",
    "confirm": true,
    "detail": true
  }
}

Captured exported Worker response · HTTP 204:

null

HTTP 204. Retain the input workspaceId; HTTP 204 has no response payload. Read the canonical Auth workspace lifecycle state in the same app and organization; compare the exact workspace id. A local mirror deletion is not evidence of unrelated data erasure.

Refused request · HTTP 401

Input · payload.json:

{
  "workspaceId": "ws_default"
}

CLI:

topolo actions validate app_topolo_sign.workspaces.delete --data @payload.json --json
topolo actions plan app_topolo_sign.workspaces.delete --resource-type workspace --resource-id "$SIGN_WORKSPACE_ID" --data @payload.json --json

Captured exported Worker response · HTTP 401:

{
  "error": "Token validation failed"
}

HTTP 401. Resolve the exact refusal before retrying. This request is not a successful workflow.

Refused request · HTTP 403

Input · payload.json:

{
  "workspaceId": "ws_default"
}

CLI:

topolo actions validate app_topolo_sign.workspaces.delete --data @payload.json --json
topolo actions plan app_topolo_sign.workspaces.delete --resource-type workspace --resource-id "$SIGN_WORKSPACE_ID" --data @payload.json --json

Captured exported Worker response · HTTP 403:

{
  "error": "This workspace requires admin access",
  "code": "workspace_access_insufficient"
}

HTTP 403. Resolve the exact refusal before retrying. This request is not a successful workflow.

Verify the result

  • Retain the input workspaceId; HTTP 204 has no response payload.
  • Read the canonical Auth workspace lifecycle state in the same app and organization; compare the exact workspace id. A local mirror deletion is not evidence of unrelated data erasure.

Errors and recovery

  • organization_required (HTTP 403): The token carries no organization scope. Re-authenticate against the organization that owns the workspace and retry.
  • workspace_not_found (HTTP 404): The verified workspace has no existing local Sign mirror. Resolve it through canonical Auth workspace discovery; bootstrap does not return a workspace id.
  • workspace_not_empty (HTTP 409): The workspace still holds envelopes or templates. Signing records are not dropped to make an archive succeed — keep the workspace, or move the work elsewhere first.
  • workspace_archive_refused (HTTP 409): Auth refused archival with HTTP 409; Sign retains its local mirror. Preserve the request id and inspect the canonical lifecycle state before a retry.
  • workspace_archive_refused (HTTP 502): Auth did not accept archival. Sign retains its local mirror. Verify canonical workspace state before retrying; do not treat this as an archived workspace.
  • auth_error (HTTP 401): Reauthenticate in the same approved context before retrying.
  • workspace_access_insufficient (HTTP 403): Discover the actual workspace grant and obtain the documented required access; do not retry with a guessed workspace or broader organization.

Some existing refusals return a human message as error rather than a stable code; preserve the actual response, status and request id. Platform validation, authentication and resource checks can refuse before the handler.

Recovery boundary

A released workspace cannot be recreated with its identity. This path is only reachable for an empty workspace, so no signing records are lost.

Evidence

Captured from the exported Sign Worker with the existing SQLite-backed D1 harness applying all core, envelope and audit migrations to one local database, in-memory R2 and synthetic Auth/workspace/archive/Notify transports. These examples prove local validation, persistence and artifact production. They do not prove separate deployed D1 topology, real recipient consent, provider delivery or a live signed agreement. All identities, signing links and documents are synthetic; replace identifiers through authorized discovery and never execute a fixture against a live organization. Binary download examples use the released SDK binary projection; tests Base64-decode and compare original bytes, lengths and server SHA-256 headers.