Topolo Docs Topolo Platform
Open workspace

Erase Spaces organization data

Delete all currently tracked Spaces organization rows and objects, verify residual tracked counts, and report retained backups.

Outcome

Delete all currently tracked Spaces organization rows and objects, verify residual tracked counts, and report retained backups.

Before you start

  • Verify the authenticated identity, exact environment and pinned approved organization context before preparing an action.
  • The published application permission is privacy:write. This is organization-wide and is not restricted by a workspace header; obtain the specific privacy purpose and authorization.
  • Authorize the documented storage, publication, invitation, notification, metering, privacy or archival effects before CLI --confirm or MCP confirm:true.

Discover the target

topolo whoami --json
topolo actions get app_topolo_spaces.organizations.data.erase --detail --json
  • Use the exact authenticated organization id. A workspace resource header does not narrow this action.

Request

DELETE /api/organizations/data/erase

Save action input as payload.json. Inspect the plan for the exact path, query and body.

Inspect and test this action in the signed action console, then perform the verification below.

Input fields

FieldRequiredTypeConstraints
confirmationRequiredstringExact literal ERASE after approved organization-wide privacy scope and retained export review.; {}

View the complete input schema in the action console. The same schema is available through CLI and MCP action discovery.

Effects

  • Requires exact input confirmation ERASE and organization-wide privacy authorization; a workspace resource does not narrow this operation.
  • Discovers R2 keys through current asset and export rows, deletes those objects and verifies absence, then erases collaboration, processing, assets and core rows. There is no transaction across four databases and object storage.
  • Orphaned R2 bytes whose metadata was already removed by spaces.delete are not discovered or erased. The response reports backups_retained:true; Auth identity, other services, delivered notifications and downloaded copies remain. Later authorized writes can create new local data.

Interpret the response

The response does not discover a new resource id. Retain exact input/context identifiers; nullable or absence responses are not canonical identifier discovery.

Confirm erased:true and every remaining count equals zero, then read organizations.data.export for the same organization. Zero tracked counts do not establish absence of orphan objects, backups, other-service records or separately downloaded exports. A failure can leave partial deletion; preserve its request id and escalate the precise residual scope.

The success schema was checked against captured handler responses. Delegated Auth identity and canonical widget context fields can vary; exact Spaces envelopes and all thirteen SQL export table sets are source-reviewed against the migrated local schema. Error responses can be plain text; the original refusal body is retained. Error examples retain their actual refusal shapes.

View the complete success schema in the action console. The worked examples below retain complete raw captured Worker responses. CLI responses have a transport envelope and can be bounded unless --detail is requested; action discovery supplies the exact schema.

Worked examples

Real isolated local D1/R2 and source handlers with synthetic Auth/workspace discovery, queue transport, notification delivery and metering. Arbitrary fixture SOG bytes demonstrate handler state only, not valid Gaussian data, renderer quality, deployed processing or live effects. Annotation rows are seeded directly into isolated fixture storage because no annotation mutation is published. Refused examples demonstrate boundaries and must not be executed as successful workflows.

Successful request

Actual local Worker response; all four migrated D1 databases and R2 are real. Auth identity/workspace discovery, queue transport, notification delivery and metering are simulated or disabled. Captured scenario: minimal.

Input · payload.json:

{
  "confirmation": "ERASE"
}

CLI:

topolo actions validate app_topolo_spaces.organizations.data.erase --data @payload.json --json
topolo actions plan app_topolo_spaces.organizations.data.erase --data @payload.json --json
topolo actions call app_topolo_spaces.organizations.data.erase --data @payload.json --confirm --detail --json

MCP tool and arguments:

{
  "tool": "topolo_call_action",
  "arguments": {
    "actionId": "app_topolo_spaces.organizations.data.erase",
    "input": {
      "confirmation": "ERASE"
    },
    "confirm": true
  }
}

Captured local response · HTTP 200:

{
  "success": true,
  "organization_id": "org_spaces_fixture",
  "erased": true,
  "remaining": {
    "core": 0,
    "assets": 0,
    "processing": 0,
    "collaboration": 0,
    "asset_objects": 0
  },
  "backups_retained": true
}

HTTP 200. Confirm erased:true and every remaining count equals zero, then read organizations.data.export for the same organization. Zero tracked counts do not establish absence of orphan objects, backups, other-service records or separately downloaded exports. A failure can leave partial deletion; preserve its request id and escalate the precise residual scope.

Another supported request

Actual local Worker response; all four migrated D1 databases and R2 are real. Auth identity/workspace discovery, queue transport, notification delivery and metering are simulated or disabled. Captured scenario: workflow.

Input · payload.json:

{
  "confirmation": "ERASE"
}

CLI:

topolo actions validate app_topolo_spaces.organizations.data.erase --data @payload.json --json
topolo actions plan app_topolo_spaces.organizations.data.erase --data @payload.json --json
topolo actions call app_topolo_spaces.organizations.data.erase --data @payload.json --confirm --detail --json

MCP tool and arguments:

{
  "tool": "topolo_call_action",
  "arguments": {
    "actionId": "app_topolo_spaces.organizations.data.erase",
    "input": {
      "confirmation": "ERASE"
    },
    "confirm": true
  }
}

Captured local response · HTTP 200:

{
  "success": true,
  "organization_id": "org_spaces_fixture",
  "erased": true,
  "remaining": {
    "core": 0,
    "assets": 0,
    "processing": 0,
    "collaboration": 0,
    "asset_objects": 0
  },
  "backups_retained": true
}

HTTP 200. Confirm erased:true and every remaining count equals zero, then read organizations.data.export for the same organization. Zero tracked counts do not establish absence of orphan objects, backups, other-service records or separately downloaded exports. A failure can leave partial deletion; preserve its request id and escalate the precise residual scope.

Another supported request

Actual local Worker response; all four migrated D1 databases and R2 are real. Auth identity/workspace discovery, queue transport, notification delivery and metering are simulated or disabled. Captured scenario: privacy.

Input · payload.json:

{
  "confirmation": "ERASE"
}

CLI:

topolo actions validate app_topolo_spaces.organizations.data.erase --data @payload.json --json
topolo actions plan app_topolo_spaces.organizations.data.erase --data @payload.json --json
topolo actions call app_topolo_spaces.organizations.data.erase --data @payload.json --confirm --detail --json

MCP tool and arguments:

{
  "tool": "topolo_call_action",
  "arguments": {
    "actionId": "app_topolo_spaces.organizations.data.erase",
    "input": {
      "confirmation": "ERASE"
    },
    "confirm": true
  }
}

Captured local response · HTTP 200:

{
  "success": true,
  "organization_id": "org_spaces_fixture",
  "erased": true,
  "remaining": {
    "core": 0,
    "assets": 0,
    "processing": 0,
    "collaboration": 0,
    "asset_objects": 0
  },
  "backups_retained": true
}

HTTP 200. Confirm erased:true and every remaining count equals zero, then read organizations.data.export for the same organization. Zero tracked counts do not establish absence of orphan objects, backups, other-service records or separately downloaded exports. A failure can leave partial deletion; preserve its request id and escalate the precise residual scope.

Verify the result

  • Confirm erased:true and every remaining count equals zero, then read organizations.data.export for the same organization.
  • Zero tracked counts do not establish absence of orphan objects, backups, other-service records or separately downloaded exports. A failure can leave partial deletion; preserve its request id and escalate the precise residual scope.

Errors and recovery

  • organization_context_required (HTTP 403): Stop and authenticate into the approved owning organization. Preserve the actual denial; a resource id does not grant organization access.
  • ConfirmationRequired (HTTP 400): The handler needs exact ERASE, and the catalog still requires explicit confirmation/authorization. Validate input and approve the organization-wide effects before execution.

A plain-text server refusal is surfaced by CLI/MCP as http_error with its HTTP status and requestId; its text is not a structured service error.code. Auth, action-input validation and platform resource resolution can refuse a request before its handler. Retain the exact error, request id and context; requesting another context is not a legitimate way to bypass a refusal.

Recovery boundary

Deleted local rows and tracked object bytes have no published restoration action. Do not repeat an uncertain destructive request without checking the same organization scope and retained export; orphan objects and backups need a separately governed lifecycle.

Evidence

Real isolated local D1/R2 and source handlers with synthetic Auth/workspace discovery, queue transport, notification delivery and metering. Arbitrary fixture SOG bytes demonstrate handler state only, not valid Gaussian data, renderer quality, deployed processing or live effects. Annotation rows are seeded directly into isolated fixture storage because no annotation mutation is published. Capture digests and test scenarios are retained in the source fixture records.