Erase Success organization data

Require exact ERASE confirmation, sequentially delete all eight local organization stores and verify zero counts. Auth identity/workspaces, delivered notifications and retained backups remain outside this action.

Outcome

Before you start

Verify the authenticated identity, exact environment and pinned approved organization context before preparing an action.
The published application permission is privacy:write. This is organization-wide and is not restricted by a workspace header; obtain the specific privacy purpose and authorization.
Authorize the documented mirror, notification, metering, privacy or archival effects before CLI --confirm or MCP confirm:true. A GET request can initialize a local mirror.

Discover the target

topolo whoami --json
topolo actions get app_topolo_success.organizations.data.erase --detail --json

Use the exact authenticated organization id. A workspace resource header does not narrow this action.

Request

DELETE /api/organizations/{organizationId}/data

Save action input as payload.json. Inspect the plan for the exact path, query and body.

Inspect and test this action in the signed action console, then perform the verification below.

Input fields

Field	Required	Type	Constraints
`organizationId`	Required	string	Exact organization id of the already authorized authenticated context; this action spans all of its Success workspaces.; {"minLength":1}
`confirmation`	Required	string	Must be exactly ERASE for irreversible organization-wide local deletion.; {}

Exact input schema:

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "organizationId": {
      "type": "string",
      "minLength": 1,
      "description": "Exact organization id of the already authorized authenticated context; this action spans all of its Success workspaces."
    },
    "confirmation": {
      "type": "string",
      "const": "ERASE",
      "description": "Must be exactly ERASE for irreversible organization-wide local deletion."
    }
  },
  "required": [
    "organizationId",
    "confirmation"
  ],
  "additionalProperties": false
}

Effects

Deletes account-linked renewal delivery rows first, then seven direct organization tables; mutations and verification are sequential and not a cross-store transaction.
A failure can occur after partial deletion; HTTP 500 verification counts are remaining local records, not a rollback.
Retains canonical Auth organization/user/grant/workspace identity, delivered Notify data under its policy and encrypted backups until expiry. No guard prevents later authorized requests from creating Success records again.

Interpret the response

Use response path $.data.organization_id for organization_privacy_erasure. An empty list does not discover a target.

Require success true, data.erased true, matching data.organization_id and every verification count zero. Read organizations.data.export separately if authorized to confirm local stores; do not describe this as platform-wide erasure or backup purge.

The success schema below was checked against captured handler responses. Delegated Auth profile fields and sanitized notification payload fields can vary; exact outer envelopes and SQL row fields are source-reviewed. Error examples retain their actual refusal shapes.

Success schema:

{
  "type": "object",
  "properties": {
    "success": {
      "const": true,
      "type": "boolean"
    },
    "data": {
      "type": "object",
      "properties": {
        "organization_id": {
          "type": "string",
          "description": "Source-defined string field."
        },
        "erased": {
          "const": true,
          "type": "boolean"
        },
        "verification": {
          "type": "object",
          "properties": {
            "success_notification_outbox": {
              "type": "integer",
              "description": "Remaining organization-owned row count; all must be zero."
            },
            "success_playbook_tasks": {
              "type": "integer",
              "description": "Remaining organization-owned row count; all must be zero."
            },
            "success_milestones": {
              "type": "integer",
              "description": "Remaining organization-owned row count; all must be zero."
            },
            "success_account_risks": {
              "type": "integer",
              "description": "Remaining organization-owned row count; all must be zero."
            },
            "success_health_score_changes": {
              "type": "integer",
              "description": "Remaining organization-owned row count; all must be zero."
            },
            "success_renewal_deliveries": {
              "type": "integer",
              "description": "Remaining organization-owned row count; all must be zero."
            },
            "success_accounts": {
              "type": "integer",
              "description": "Remaining organization-owned row count; all must be zero."
            },
            "success_workspaces": {
              "type": "integer",
              "description": "Remaining organization-owned row count; all must be zero."
            }
          },
          "required": [
            "success_notification_outbox",
            "success_playbook_tasks",
            "success_milestones",
            "success_account_risks",
            "success_health_score_changes",
            "success_renewal_deliveries",
            "success_accounts",
            "success_workspaces"
          ],
          "additionalProperties": false
        },
        "retained": {
          "type": "object",
          "properties": {
            "topolo_auth_identity_and_canonical_workspaces": {
              "type": "boolean",
              "const": true
            },
            "delivered_notifications_under_notify_policy": {
              "type": "boolean",
              "const": true
            },
            "encrypted_backups_until_retention_expiry": {
              "type": "boolean",
              "const": true
            }
          },
          "required": [
            "topolo_auth_identity_and_canonical_workspaces",
            "delivered_notifications_under_notify_policy",
            "encrypted_backups_until_retention_expiry"
          ],
          "additionalProperties": false
        }
      },
      "required": [
        "organization_id",
        "erased",
        "verification",
        "retained"
      ],
      "additionalProperties": false
    }
  },
  "required": [
    "success",
    "data"
  ],
  "additionalProperties": false
}

Worked examples

Actual exported Worker responses captured with real local SQLite D1 and all committed migrations, synthetic Auth identity/grants, simulated Notify/Nexus and canonical archive transport. Fixture ids are examples only. No live notification delivery, metering acceptance, privacy erasure, workspace archive or deployment is established by these tests. Refused examples demonstrate boundaries and must not be executed as successful workflows.

Refused request · HTTP 400

Actual exported Worker response with real local SQLite D1, synthetic Auth/grants and simulated Notify/Nexus/archive transport; no live delivery or deployment proof. Captured scenario: exact ERASE required.

Input · payload.json:

{
  "organizationId": "org_success_fixture",
  "confirmation": "erase"
}

CLI:

topolo actions validate app_topolo_success.organizations.data.erase --data @payload.json --json
topolo actions plan app_topolo_success.organizations.data.erase --data @payload.json --json

Captured local response · HTTP 400:

{
  "success": false,
  "error": {
    "code": "invalid_action_input",
    "message": "Invalid action input for \"organizations.data.erase\".",
    "action": "organizations.data.erase",
    "issues": [
      {
        "path": "confirmation",
        "message": "Invalid input: expected \"ERASE\"",
        "code": "invalid_value"
      }
    ]
  }
}

HTTP 400. The handler refused this request. Resolve its exact cause before retrying; input validation can reject an invalid fixture before it reaches the handler.

Successful request

Input · payload.json:

{
  "organizationId": "org_success_fixture",
  "confirmation": "ERASE"
}

CLI:

topolo actions validate app_topolo_success.organizations.data.erase --data @payload.json --json
topolo actions plan app_topolo_success.organizations.data.erase --data @payload.json --json
topolo actions call app_topolo_success.organizations.data.erase --data @payload.json --confirm --json

MCP tool and arguments:

{
  "tool": "topolo_call_action",
  "arguments": {
    "actionId": "app_topolo_success.organizations.data.erase",
    "input": {
      "organizationId": "org_success_fixture",
      "confirmation": "ERASE"
    },
    "confirm": true
  }
}

Captured local response · HTTP 200:

{
  "success": true,
  "data": {
    "organization_id": "org_success_fixture",
    "erased": true,
    "verification": {
      "success_notification_outbox": 0,
      "success_playbook_tasks": 0,
      "success_milestones": 0,
      "success_account_risks": 0,
      "success_health_score_changes": 0,
      "success_renewal_deliveries": 0,
      "success_accounts": 0,
      "success_workspaces": 0
    },
    "retained": {
      "topolo_auth_identity_and_canonical_workspaces": true,
      "delivered_notifications_under_notify_policy": true,
      "encrypted_backups_until_retention_expiry": true
    }
  }
}

HTTP 200. Require success true, data.erased true, matching data.organization_id and every verification count zero. Read organizations.data.export separately if authorized to confirm local stores; do not describe this as platform-wide erasure or backup purge.

Verify the result

Require success true, data.erased true, matching data.organization_id and every verification count zero.
Read organizations.data.export separately if authorized to confirm local stores; do not describe this as platform-wide erasure or backup purge.

Errors and recovery

invalid_action_input (HTTP 400): Correct only the input paths reported by the runtime or CLI validator; retain action id and exact context.
action_permission_required (HTTP 403): The verified credential lacks the action permission. Stop this action and request the appropriate authorized grant; an identifier or organization ownership does not grant it.
organization_forbidden (HTTP 403): The path organizationId must match the verified organization context.
erase_confirmation_required (HTTP 400): The direct handler requires exact ERASE; CLI/runtime input validation may return invalid_action_input first.
erasure_verification_failed (HTTP 500): Deletion has already run and records remain. Preserve named counts/request id, inspect authorized local export and escalate; do not report completion or an automatic rollback.

Auth, action-input validation and platform resource resolution can refuse a request before its handler. Retain the exact error, request id and context; requesting another context is not a legitimate way to bypass a refusal.

Recovery boundary

No restore is published. Export only if separately authorized before erasure; after an ambiguous failure read the remaining stores and escalate before another explicitly authorized erase attempt.

Export Success organization data: Return all eight local Success stores for the authenticated organization across every workspace, with parsed and sanitized payload fields. Canonical Auth identity, delivered Notify data, provider credentials and backups are excluded.

Evidence

Actual exported Worker responses captured with real local SQLite D1 and all committed migrations, synthetic Auth identity/grants, simulated Notify/Nexus and canonical archive transport. Fixture ids are examples only. No live notification delivery, metering acceptance, privacy erasure, workspace archive or deployment is established by these tests. Capture digests and test scenarios are retained in the source fixture records.