Topolo Docs Topolo Platform
Open workspace

Erase Voice organization data

Delete and verify all six local Voice table sets for the authenticated organization while retaining backups.

Outcome

Delete and verify all six local Voice table sets for the authenticated organization while retaining backups.

Before you start

  • Verify the exact authenticated identity, environment and approved organization context before preparing the request.
  • The published application permission is privacy:write. This privacy action spans all local Voice workspaces in the authenticated organization. A workspace header does not narrow it.
  • Authorize all documented effects before CLI --confirm or MCP confirm:true. Local events, canonical archival and organization erasure have distinct scope.

Discover the target

topolo whoami --json
topolo actions get app_topolo_voice.organizations.data.erase --detail --json
  • Confirm the authenticated organization id and the explicit privacy purpose across all local Voice workspaces.

Request

DELETE /api/organizations/data/erase

Save the exact action input as payload.json. Validate it and inspect the exact path, query and body before executing.

Inspect and test this action in the signed action console.

Input fields

FieldRequiredTypeMeaning and constraints
confirmationRequiredstringRequired exact literal ERASE. Confirm the authenticated organization and all local workspace data before execution. {"const":"ERASE"}

The complete input and response schemas are available in the action console and through CLI/MCP action discovery.

Effects

  • Requires exact confirmation ERASE and separate authorization for organization-wide destruction; a workspace header does not limit scope.
  • Deletes child tables then calls and mirrors sequentially and verifies zero local rows; the multi-table sequence is not one transaction.
  • Does not contact or erase remote audio/transcript hosts, telephony providers, Auth workspace records, delivered notifications, exported copies or backups. Later granted reads can recreate mirrors.

Interpret the response

No new reusable resource identifier is returned. Retain the exact input and approved organization/workspace context for verification.

Examples retain complete raw Worker responses. CLI/MCP adds a transport envelope; use CLI --detail for the full result. Delegated Auth projections can vary, and the widget uses the canonical SDK contract.

Verify success true, erased true, remaining 0, organization_id matches the approved organization and backups_retained true. Run an authorized organization export to confirm all six local table sets are empty; verify remote retention separately with its actual owner.

Worked examples

Actual worker and isolated migrated D1; synthetic Auth identity, nondefault workspace grants and archive transport. Notify and Nexus are disabled. No live telephony, remote audio or transcript hosting/deletion is tested. Refused examples explain boundaries; do not execute them as successful workflows.

minimal · Successful request · HTTP 200

Actual local worker response and migrated D1. Auth identity/grants/archive are simulated. Notify and metering are disabled; no telephony or remote audio/transcript provider is contacted. Fixture identifiers authorize no live action.

Input · payload.json:

{
  "confirmation": "ERASE"
}

CLI:

topolo actions validate app_topolo_voice.organizations.data.erase --data @payload.json --json
topolo actions plan app_topolo_voice.organizations.data.erase --data @payload.json --json
topolo actions call app_topolo_voice.organizations.data.erase --data @payload.json --confirm --detail --json

MCP tool and arguments:

{
  "tool": "topolo_call_action",
  "arguments": {
    "actionId": "app_topolo_voice.organizations.data.erase",
    "input": {
      "confirmation": "ERASE"
    },
    "confirm": true
  }
}

Captured response · HTTP 200:

{
  "success": true,
  "organization_id": "org_voice_fixture",
  "erased": true,
  "remaining": 0,
  "backups_retained": true
}

HTTP 200. Verify success true, erased true, remaining 0, organization_id matches the approved organization and backups_retained true. Run an authorized organization export to confirm all six local table sets are empty; verify remote retention separately with its actual owner.

workflow · Successful request · HTTP 200

Actual local worker response and migrated D1. Auth identity/grants/archive are simulated. Notify and metering are disabled; no telephony or remote audio/transcript provider is contacted. Fixture identifiers authorize no live action.

Input · payload.json:

{
  "confirmation": "ERASE"
}

CLI:

topolo actions validate app_topolo_voice.organizations.data.erase --data @payload.json --json
topolo actions plan app_topolo_voice.organizations.data.erase --data @payload.json --json
topolo actions call app_topolo_voice.organizations.data.erase --data @payload.json --confirm --detail --json

MCP tool and arguments:

{
  "tool": "topolo_call_action",
  "arguments": {
    "actionId": "app_topolo_voice.organizations.data.erase",
    "input": {
      "confirmation": "ERASE"
    },
    "confirm": true
  }
}

Captured response · HTTP 200:

{
  "success": true,
  "organization_id": "org_voice_fixture",
  "erased": true,
  "remaining": 0,
  "backups_retained": true
}

HTTP 200. Verify success true, erased true, remaining 0, organization_id matches the approved organization and backups_retained true. Run an authorized organization export to confirm all six local table sets are empty; verify remote retention separately with its actual owner.

privacy · Successful request · HTTP 200

Actual local worker response and migrated D1. Auth identity/grants/archive are simulated. Notify and metering are disabled; no telephony or remote audio/transcript provider is contacted. Fixture identifiers authorize no live action.

Input · payload.json:

{
  "confirmation": "ERASE"
}

CLI:

topolo actions validate app_topolo_voice.organizations.data.erase --data @payload.json --json
topolo actions plan app_topolo_voice.organizations.data.erase --data @payload.json --json
topolo actions call app_topolo_voice.organizations.data.erase --data @payload.json --confirm --detail --json

MCP tool and arguments:

{
  "tool": "topolo_call_action",
  "arguments": {
    "actionId": "app_topolo_voice.organizations.data.erase",
    "input": {
      "confirmation": "ERASE"
    },
    "confirm": true
  }
}

Captured response · HTTP 200:

{
  "success": true,
  "organization_id": "org_voice_fixture",
  "erased": true,
  "remaining": 0,
  "backups_retained": true
}

HTTP 200. Verify success true, erased true, remaining 0, organization_id matches the approved organization and backups_retained true. Run an authorized organization export to confirm all six local table sets are empty; verify remote retention separately with its actual owner.

Verify the result

  • Verify success true, erased true, remaining 0, organization_id matches the approved organization and backups_retained true.
  • Run an authorized organization export to confirm all six local table sets are empty; verify remote retention separately with its actual owner.

Errors and recovery

  • organization_required (HTTP 403): The authenticated request has no organization. Stop and establish the approved owning organization; supplied workspace ids do not create membership.
  • ConfirmationRequired (HTTP 400): The handler requires exact ERASE. The published input validator can refuse other values before this handler; inspect the actual validation error and authorize the full organization-wide effect.

Auth, resource resolution and published input validation can refuse a request before its handler. Retain the actual error, request id and approved context. A plain-text HTTP 500 is surfaced by CLI/MCP as http_error; that transport code is not a structured Voice handler error.

Recovery boundary

Local data deletion is irreversible through Voice. A partial failure requires examining the remaining local sets before deciding on a separately authorized retry. Backups and remote providers remain outside this acknowledgement.

  • Export Voice organization data: Read six local Voice table sets across every workspace of the authenticated organization, with remote artifact URLs redacted.

Evidence

Actual worker and isolated migrated D1; synthetic Auth identity, nondefault workspace grants and archive transport. Notify and Nexus are disabled. No live telephony, remote audio or transcript hosting/deletion is tested.