Outcome
Return all eight local Success stores for the authenticated organization across every workspace, with parsed and sanitized payload fields. Canonical Auth identity, delivered Notify data, provider credentials and backups are excluded.
Before you start
- Verify the authenticated identity, exact environment and pinned approved organization context before preparing an action.
- The published application permission is privacy:read. This is organization-wide and is not restricted by a workspace header; obtain the specific privacy purpose and authorization.
- Authorize the documented mirror, notification, metering, privacy or archival effects before CLI --confirm or MCP confirm:true. A GET request can initialize a local mirror.
Discover the target
topolo whoami --json
topolo actions get app_topolo_success.organizations.data.export --detail --json
- Use the exact authenticated organization id. A workspace resource header does not narrow this action.
Request
GET /api/organizations/{organizationId}/data
Save action input as payload.json. Inspect the plan for the exact path, query and body.
Inspect and test this action in the signed action console, then perform the verification below.
Input fields
| Field | Required | Type | Constraints |
|---|---|---|---|
organizationId | Required | string | Exact organization id of the already authorized authenticated context; this action spans all of its Success workspaces.; {"minLength":1} |
Exact input schema:
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"type": "object",
"properties": {
"organizationId": {
"type": "string",
"minLength": 1,
"description": "Exact organization id of the already authorized authenticated context; this action spans all of its Success workspaces."
}
},
"required": [
"organizationId"
],
"additionalProperties": false
}
Effects
- Reads all local organization-owned rows, including renewal rows linked through accounts; no pagination or local workspace mirror creation.
- Recursively redacts secret-shaped keys and parses structured JSON strings. Malformed structured fields become [REDACTED]; this mechanism is not proof that arbitrary free-text content contains no sensitive data.
- A workspace resource header does not narrow organization-wide export.
Interpret the response
Use response path $.data.organization_id for organization_privacy_export. An empty list does not discover a target.
Confirm data.organization_id, credentials_included false and all eight store arrays. Empty stores still return the metadata/exclusion envelope. Handle the exported customer data under its authorized privacy purpose; excluded stores require their owner workflows.
The success schema below was checked against captured handler responses. Delegated Auth profile fields and sanitized notification payload fields can vary; exact outer envelopes and SQL row fields are source-reviewed. Error examples retain their actual refusal shapes.
Success schema:
{
"type": "object",
"properties": {
"success": {
"const": true,
"type": "boolean"
},
"data": {
"type": "object",
"properties": {
"organization_id": {
"type": "string",
"description": "Source-defined string field."
},
"exported_at": {
"type": "string",
"description": "Source-defined string field."
},
"credentials_included": {
"const": false,
"type": "boolean"
},
"stores": {
"type": "object",
"properties": {
"success_notification_outbox": {
"type": "array",
"items": {
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "Source-defined string field."
},
"organization_id": {
"type": "string",
"description": "Source-defined string field."
},
"workspace_id": {
"type": "string",
"description": "Source-defined string field."
},
"created_at": {
"type": "string",
"description": "Source-defined string field."
},
"updated_at": {
"type": "string",
"description": "Source-defined string field."
},
"event_type": {
"type": "string",
"description": "Source-defined string field."
},
"user_id": {
"type": "string",
"description": "Source-defined string field."
},
"idempotency_key": {
"type": "string",
"description": "Source-defined string field."
},
"data_json": {
"anyOf": [
{
"type": "object",
"additionalProperties": true
},
{
"type": "array",
"items": {}
},
{
"type": "string"
},
{
"type": "number"
},
{
"type": "boolean"
},
{
"type": "null"
}
],
"description": "Parsed and recursively sanitized event payload; valid JSON has dynamic event-specific fields, malformed content becomes [REDACTED]."
},
"status": {
"type": "string",
"enum": [
"pending",
"sent",
"failed"
]
},
"attempts": {
"type": "integer",
"description": "Source-defined integer."
},
"last_error": {
"anyOf": [
{
"type": "string",
"description": "Source-defined string field."
},
{
"type": "null"
}
]
},
"sent_at": {
"anyOf": [
{
"type": "string",
"description": "Source-defined string field."
},
{
"type": "null"
}
]
}
},
"required": [
"id",
"organization_id",
"workspace_id",
"created_at",
"updated_at",
"event_type",
"user_id",
"idempotency_key",
"data_json",
"status",
"attempts",
"last_error",
"sent_at"
],
"additionalProperties": false
}
},
"success_playbook_tasks": {
"type": "array",
"items": {
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "Source-defined string field."
},
"organization_id": {
"type": "string",
"description": "Source-defined string field."
},
"workspace_id": {
"type": "string",
"description": "Source-defined string field."
},
"created_at": {
"type": "string",
"description": "Source-defined string field."
},
"updated_at": {
"type": "string",
"description": "Source-defined string field."
},
"account_id": {
"type": "string",
"description": "Source-defined string field."
},
"title": {
"type": "string",
"description": "Source-defined string field."
},
"recipient_user_id": {
"type": "string",
"description": "Source-defined string field."
},
"due_at": {
"type": "string",
"description": "Source-defined string field."
},
"status": {
"type": "string",
"enum": [
"pending",
"completed"
]
},
"due_notification_queued_at": {
"anyOf": [
{
"type": "string",
"description": "Source-defined string field."
},
{
"type": "null"
}
]
},
"completed_at": {
"anyOf": [
{
"type": "string",
"description": "Source-defined string field."
},
{
"type": "null"
}
]
}
},
"required": [
"id",
"organization_id",
"workspace_id",
"created_at",
"updated_at",
"account_id",
"title",
"recipient_user_id",
"due_at",
"status",
"due_notification_queued_at",
"completed_at"
],
"additionalProperties": false
}
},
"success_milestones": {
"type": "array",
"items": {
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "Source-defined string field."
},
"organization_id": {
"type": "string",
"description": "Source-defined string field."
},
"workspace_id": {
"type": "string",
"description": "Source-defined string field."
},
"created_at": {
"type": "string",
"description": "Source-defined string field."
},
"updated_at": {
"type": "string",
"description": "Source-defined string field."
},
"account_id": {
"type": "string",
"description": "Source-defined string field."
},
"name": {
"type": "string",
"description": "Source-defined string field."
},
"recipient_user_id": {
"type": "string",
"description": "Source-defined string field."
},
"status": {
"type": "string",
"enum": [
"pending",
"reached"
]
},
"reached_at": {
"anyOf": [
{
"type": "string",
"description": "Source-defined string field."
},
{
"type": "null"
}
]
}
},
"required": [
"id",
"organization_id",
"workspace_id",
"created_at",
"updated_at",
"account_id",
"name",
"recipient_user_id",
"status",
"reached_at"
],
"additionalProperties": false
}
},
"success_account_risks": {
"type": "array",
"items": {
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "Source-defined string field."
},
"account_id": {
"type": "string",
"description": "Source-defined string field."
},
"organization_id": {
"type": "string",
"description": "Source-defined string field."
},
"workspace_id": {
"type": "string",
"description": "Source-defined string field."
},
"recipient_user_id": {
"type": "string",
"description": "Source-defined string field."
},
"created_at": {
"type": "string",
"description": "Source-defined string field."
},
"health_score": {
"type": "integer",
"description": "Source-defined integer."
},
"risk_threshold": {
"type": "integer",
"description": "Source-defined integer."
},
"status": {
"type": "string",
"enum": [
"open",
"resolved"
]
},
"resolved_at": {
"anyOf": [
{
"type": "string",
"description": "Source-defined string field."
},
{
"type": "null"
}
]
}
},
"required": [
"id",
"account_id",
"organization_id",
"workspace_id",
"recipient_user_id",
"created_at",
"health_score",
"risk_threshold",
"status",
"resolved_at"
],
"additionalProperties": false
}
},
"success_health_score_changes": {
"type": "array",
"items": {
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "Source-defined string field."
},
"account_id": {
"type": "string",
"description": "Source-defined string field."
},
"organization_id": {
"type": "string",
"description": "Source-defined string field."
},
"workspace_id": {
"type": "string",
"description": "Source-defined string field."
},
"changed_at": {
"type": "string",
"description": "Source-defined string field."
},
"previous_score": {
"type": "integer",
"description": "Source-defined integer."
},
"current_score": {
"type": "integer",
"description": "Source-defined integer."
}
},
"required": [
"id",
"account_id",
"organization_id",
"workspace_id",
"changed_at",
"previous_score",
"current_score"
],
"additionalProperties": false
}
},
"success_renewal_deliveries": {
"type": "array",
"items": {
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "Source-defined string field."
},
"account_id": {
"type": "string",
"description": "Source-defined string field."
},
"renewal_at": {
"type": "string",
"description": "Source-defined string field."
},
"created_at": {
"type": "string",
"description": "Source-defined string field."
},
"window_days": {
"type": "integer",
"description": "Source-defined integer."
}
},
"required": [
"id",
"account_id",
"renewal_at",
"created_at",
"window_days"
],
"additionalProperties": false
}
},
"success_accounts": {
"type": "array",
"items": {
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "Source-defined string field."
},
"organization_id": {
"type": "string",
"description": "Source-defined string field."
},
"workspace_id": {
"type": "string",
"description": "Source-defined string field."
},
"created_at": {
"type": "string",
"description": "Source-defined string field."
},
"updated_at": {
"type": "string",
"description": "Source-defined string field."
},
"name": {
"type": "string",
"description": "Source-defined string field."
},
"owner_user_id": {
"type": "string",
"description": "Source-defined string field."
},
"health_score": {
"type": "integer",
"minimum": 0,
"maximum": 100
},
"risk_threshold": {
"type": "integer",
"minimum": 0,
"maximum": 100
},
"risk_status": {
"type": "string",
"enum": [
"healthy",
"at_risk"
]
},
"renewal_at": {
"anyOf": [
{
"type": "string",
"description": "Source-defined string field."
},
{
"type": "null"
}
]
}
},
"required": [
"id",
"organization_id",
"workspace_id",
"created_at",
"updated_at",
"name",
"owner_user_id",
"health_score",
"risk_threshold",
"risk_status",
"renewal_at"
],
"additionalProperties": false
}
},
"success_workspaces": {
"type": "array",
"items": {
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "Source-defined string field."
},
"organization_id": {
"type": "string",
"description": "Source-defined string field."
},
"created_at": {
"type": "string",
"description": "Source-defined string field."
},
"updated_at": {
"type": "string",
"description": "Source-defined string field."
},
"status": {
"type": "string",
"enum": [
"active",
"archived"
]
}
},
"required": [
"id",
"organization_id",
"created_at",
"updated_at",
"status"
],
"additionalProperties": false
}
}
},
"required": [
"success_notification_outbox",
"success_playbook_tasks",
"success_milestones",
"success_account_risks",
"success_health_score_changes",
"success_renewal_deliveries",
"success_accounts",
"success_workspaces"
],
"additionalProperties": false
},
"excluded": {
"type": "object",
"properties": {
"platform_identity": {
"type": "string",
"description": "Source-defined string field."
},
"delivered_notifications": {
"type": "string",
"description": "Source-defined string field."
},
"provider_credentials": {
"type": "string",
"description": "Source-defined string field."
},
"backups": {
"type": "string",
"description": "Source-defined string field."
}
},
"required": [
"platform_identity",
"delivered_notifications",
"provider_credentials",
"backups"
],
"additionalProperties": false
}
},
"required": [
"organization_id",
"exported_at",
"credentials_included",
"stores",
"excluded"
],
"additionalProperties": false
}
},
"required": [
"success",
"data"
],
"additionalProperties": false
}
Worked examples
Actual exported Worker responses captured with real local SQLite D1 and all committed migrations, synthetic Auth identity/grants, simulated Notify/Nexus and canonical archive transport. Fixture ids are examples only. No live notification delivery, metering acceptance, privacy erasure, workspace archive or deployment is established by these tests. Refused examples demonstrate boundaries and must not be executed as successful workflows.
Successful request
Actual exported Worker response with real local SQLite D1, synthetic Auth/grants and simulated Notify/Nexus/archive transport; no live delivery or deployment proof. Captured scenario: empty organization stores.
Input · payload.json:
{
"organizationId": "org_success_fixture"
}
CLI:
topolo actions validate app_topolo_success.organizations.data.export --data @payload.json --json
topolo actions plan app_topolo_success.organizations.data.export --data @payload.json --json
topolo actions call app_topolo_success.organizations.data.export --data @payload.json --confirm --json
MCP tool and arguments:
{
"tool": "topolo_call_action",
"arguments": {
"actionId": "app_topolo_success.organizations.data.export",
"input": {
"organizationId": "org_success_fixture"
},
"confirm": true
}
}
Captured local response · HTTP 200:
{
"success": true,
"data": {
"organization_id": "org_success_fixture",
"exported_at": "2026-10-04T05:10:05.366Z",
"credentials_included": false,
"stores": {
"success_notification_outbox": [],
"success_playbook_tasks": [],
"success_milestones": [],
"success_account_risks": [],
"success_health_score_changes": [],
"success_renewal_deliveries": [],
"success_accounts": [],
"success_workspaces": []
},
"excluded": {
"platform_identity": "Topolo Auth owns canonical organization, user, grant, and workspace identity.",
"delivered_notifications": "Topolo Notify owns delivered notification payloads and recipient preferences.",
"provider_credentials": "Topolo Success stores no provider credentials; Nexus owns provider execution.",
"backups": "Encrypted backups follow the platform backup retention and erasure schedule."
}
}
}
HTTP 200. Confirm data.organization_id, credentials_included false and all eight store arrays. Empty stores still return the metadata/exclusion envelope. Handle the exported customer data under its authorized privacy purpose; excluded stores require their owner workflows.
Refused request · HTTP 403
Actual exported Worker response with real local SQLite D1, synthetic Auth/grants and simulated Notify/Nexus/archive transport; no live delivery or deployment proof. Captured scenario: foreign organization forbidden.
Input · payload.json:
{
"organizationId": "org_foreign"
}
CLI:
topolo actions validate app_topolo_success.organizations.data.export --data @payload.json --json
topolo actions plan app_topolo_success.organizations.data.export --data @payload.json --json
Captured local response · HTTP 403:
{
"error": "organization_forbidden"
}
HTTP 403. The handler refused this request. Resolve its exact cause before retrying; input validation can reject an invalid fixture before it reaches the handler.
Another supported request
Actual exported Worker response with real local SQLite D1, synthetic Auth/grants and simulated Notify/Nexus/archive transport; no live delivery or deployment proof. Captured scenario: populated local stores.
Input · payload.json:
{
"organizationId": "org_success_fixture"
}
CLI:
topolo actions validate app_topolo_success.organizations.data.export --data @payload.json --json
topolo actions plan app_topolo_success.organizations.data.export --data @payload.json --json
topolo actions call app_topolo_success.organizations.data.export --data @payload.json --confirm --json
MCP tool and arguments:
{
"tool": "topolo_call_action",
"arguments": {
"actionId": "app_topolo_success.organizations.data.export",
"input": {
"organizationId": "org_success_fixture"
},
"confirm": true
}
}
Captured local response · HTTP 200:
{
"success": true,
"data": {
"organization_id": "org_success_fixture",
"exported_at": "2026-10-04T05:10:05.473Z",
"credentials_included": false,
"stores": {
"success_notification_outbox": [
{
"id": "successout_1e43bcb8-34f9-4aa5-90f6-3b4e684a627e",
"event_type": "success.health_score.changed",
"organization_id": "org_success_fixture",
"workspace_id": "ws_success_fixture",
"user_id": "usr_success_fixture",
"idempotency_key": "success:health:successhealth_a5125989-6788-46a8-9575-abc8d5b6f5ee",
"data_json": {
"title": "Health score changed: Example Customer",
"body": "Example Customer's health score changed from 100 to 35.",
"object_id": "successhealth_a5125989-6788-46a8-9575-abc8d5b6f5ee",
"account_id": "successacct_cc555431-d2fb-41d4-b7b7-bd0045eecc14",
"account_name": "Example Customer",
"previous_score": 100,
"current_score": 35,
"occurred_at": "2026-10-04T05:10:05.394Z",
"cta_url": "https://success.success-fixture.test/accounts/successacct_cc555431-d2fb-41d4-b7b7-bd0045eecc14"
},
"status": "sent",
"attempts": 1,
"last_error": null,
"sent_at": "2026-10-04T05:10:05.413Z",
"created_at": "2026-10-04T05:10:05.394Z",
"updated_at": "2026-10-04T05:10:05.413Z"
},
{
"id": "successout_94603f9a-a766-4d10-b0b2-8f72d79abd05",
"event_type": "success.account.risk_detected",
"organization_id": "org_success_fixture",
"workspace_id": "ws_success_fixture",
"user_id": "usr_success_fixture",
"idempotency_key": "success:risk:successrisk_086300de-dd7a-4d5b-92db-143e4ce107d2",
"data_json": {
"title": "Account at risk: Example Customer",
"body": "Example Customer's health score fell to 35, at or below the 40 risk threshold.",
"object_id": "successrisk_086300de-dd7a-4d5b-92db-143e4ce107d2",
"account_id": "successacct_cc555431-d2fb-41d4-b7b7-bd0045eecc14",
"account_name": "Example Customer",
"health_score": 35,
"risk_threshold": 40,
"occurred_at": "2026-10-04T05:10:05.394Z",
"cta_url": "https://success.success-fixture.test/accounts/successacct_cc555431-d2fb-41d4-b7b7-bd0045eecc14"
},
"status": "sent",
"attempts": 1,
"last_error": null,
"sent_at": "2026-10-04T05:10:05.413Z",
"created_at": "2026-10-04T05:10:05.394Z",
"updated_at": "2026-10-04T05:10:05.413Z"
}
],
"success_playbook_tasks": [],
"success_milestones": [],
"success_account_risks": [
{
"id": "successrisk_086300de-dd7a-4d5b-92db-143e4ce107d2",
"account_id": "successacct_cc555431-d2fb-41d4-b7b7-bd0045eecc14",
"organization_id": "org_success_fixture",
"workspace_id": "ws_success_fixture",
"recipient_user_id": "usr_success_fixture",
"health_score": 35,
"risk_threshold": 40,
"status": "open",
"created_at": "2026-10-04T05:10:05.394Z",
"resolved_at": null
}
],
"success_health_score_changes": [
{
"id": "successhealth_a5125989-6788-46a8-9575-abc8d5b6f5ee",
"account_id": "successacct_cc555431-d2fb-41d4-b7b7-bd0045eecc14",
"organization_id": "org_success_fixture",
"workspace_id": "ws_success_fixture",
"previous_score": 100,
"current_score": 35,
"changed_at": "2026-10-04T05:10:05.394Z"
}
],
"success_renewal_deliveries": [],
"success_accounts": [
{
"id": "successacct_cc555431-d2fb-41d4-b7b7-bd0045eecc14",
"organization_id": "org_success_fixture",
"workspace_id": "ws_success_fixture",
"name": "Example Customer",
"owner_user_id": "usr_success_fixture",
"health_score": 35,
"risk_threshold": 40,
"risk_status": "at_risk",
"renewal_at": "2027-03-31T00:00:00Z",
"created_at": "2026-10-04T05:10:05.376Z",
"updated_at": "2026-10-04T05:10:05.394Z"
}
],
"success_workspaces": [
{
"id": "ws_success_fixture",
"organization_id": "org_success_fixture",
"status": "active",
"created_at": "2026-10-04T05:10:05.371Z",
"updated_at": "2026-10-04T05:10:05.371Z"
}
]
},
"excluded": {
"platform_identity": "Topolo Auth owns canonical organization, user, grant, and workspace identity.",
"delivered_notifications": "Topolo Notify owns delivered notification payloads and recipient preferences.",
"provider_credentials": "Topolo Success stores no provider credentials; Nexus owns provider execution.",
"backups": "Encrypted backups follow the platform backup retention and erasure schedule."
}
}
}
HTTP 200. Confirm data.organization_id, credentials_included false and all eight store arrays. Empty stores still return the metadata/exclusion envelope. Handle the exported customer data under its authorized privacy purpose; excluded stores require their owner workflows.
Another supported request
Actual exported Worker response with real local SQLite D1, synthetic Auth/grants and simulated Notify/Nexus/archive transport; no live delivery or deployment proof. Captured scenario: post-erasure empty stores retain metadata envelope.
Input · payload.json:
{
"organizationId": "org_success_fixture"
}
CLI:
topolo actions validate app_topolo_success.organizations.data.export --data @payload.json --json
topolo actions plan app_topolo_success.organizations.data.export --data @payload.json --json
topolo actions call app_topolo_success.organizations.data.export --data @payload.json --confirm --json
MCP tool and arguments:
{
"tool": "topolo_call_action",
"arguments": {
"actionId": "app_topolo_success.organizations.data.export",
"input": {
"organizationId": "org_success_fixture"
},
"confirm": true
}
}
Captured local response · HTTP 200:
{
"success": true,
"data": {
"organization_id": "org_success_fixture",
"exported_at": "2026-10-04T05:10:05.649Z",
"credentials_included": false,
"stores": {
"success_notification_outbox": [],
"success_playbook_tasks": [],
"success_milestones": [],
"success_account_risks": [],
"success_health_score_changes": [],
"success_renewal_deliveries": [],
"success_accounts": [],
"success_workspaces": []
},
"excluded": {
"platform_identity": "Topolo Auth owns canonical organization, user, grant, and workspace identity.",
"delivered_notifications": "Topolo Notify owns delivered notification payloads and recipient preferences.",
"provider_credentials": "Topolo Success stores no provider credentials; Nexus owns provider execution.",
"backups": "Encrypted backups follow the platform backup retention and erasure schedule."
}
}
}
HTTP 200. Confirm data.organization_id, credentials_included false and all eight store arrays. Empty stores still return the metadata/exclusion envelope. Handle the exported customer data under its authorized privacy purpose; excluded stores require their owner workflows.
Verify the result
- Confirm data.organization_id, credentials_included false and all eight store arrays. Empty stores still return the metadata/exclusion envelope.
- Handle the exported customer data under its authorized privacy purpose; excluded stores require their owner workflows.
Errors and recovery
invalid_action_input(HTTP 400): Correct only the input paths reported by the runtime or CLI validator; retain action id and exact context.action_permission_required(HTTP 403): The verified credential lacks the action permission. Stop this action and request the appropriate authorized grant; an identifier or organization ownership does not grant it.organization_forbidden(HTTP 403): Input organizationId must exactly match the authenticated organization. A workspace binding does not change it.organization_required(HTTP 403): Use only the already authorized organization context for the requested export.
Auth, action-input validation and platform resource resolution can refuse a request before its handler. Retain the exact error, request id and context; requesting another context is not a legitimate way to bypass a refusal.
Recovery boundary
Export has no Success mutation to reverse; secure the exported response according to its privacy purpose.
Evidence
Actual exported Worker responses captured with real local SQLite D1 and all committed migrations, synthetic Auth identity/grants, simulated Notify/Nexus and canonical archive transport. Fixture ids are examples only. No live notification delivery, metering acceptance, privacy erasure, workspace archive or deployment is established by these tests. Capture digests and test scenarios are retained in the source fixture records.