`get_orgs_by_id_deletion_preview`

Read-only

Calls GET /api/orgs/{id}/deletion-preview as the signed-in person · REST reference

What deleting this organization would remove, deactivate and keep — without deleting it

Answers the report the delete would produce: the groups it would soft-delete, how many memberships it would stamp REMOVED, which members it would deactivate (no other live organization) and which it would keep (and which organization keeps them). READS ONLY. A deletion the guard would refuse is still a 200 — blocked: true with the reason — so the portal can disable the action and say why before anyone asks for it. Requires execute:DeleteOrgCommand, the delete's own permission: the report names members by email. The caller's own token is forwarded; the DAL re-checks it.

Arguments

Argument	Type		Description
`id`path	string (uuid)	required

Example call

A client sends this over the MCP session; Claude and other agents build it for you. The values are placeholders — the shape is real.

json

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "get_orgs_by_id_deletion_preview",
    "arguments": {
      "id": "11111111-1111-4111-8111-111111111111"
    }
  }
}

Result

On success (HTTP 200) the tool returns one text item holding the API's JSON, pretty-printed.

The report. Bare object, no envelope.

json

{
  "blocked": true,
  "blockedReason": "string",
  "blockers": [
    {
      "code": "LAST_SUPERADMIN",
      "count": 1,
      "message": "string",
      "amountCents": 1,
      "until": 1
    }
  ],
  "groupsRemoved": [
    {
      "id": "string",
      "name": "string"
    }
  ],
  "membershipsRemoved": 1,
  "orgId": "string",
  "orgName": "string",
  "permissionsRetired": 1,
  "rolesRemoved": [
    {
      "id": "string",
      "name": "string"
    }
  ],
  "usersDeactivated": [
    {
      "email": "string",
      "id": "string"
    }
  ],
  "usersKept": [
    {
      "email": "string",
      "id": "string",
      "keptBy": []
    }
  ]
}

Fields

Field	Type	Description
`blocked`	boolean
`blockedReason`	string \| null
`blockers`	array of object	Every reason this organization may not be deleted yet; empty when it may.
`blockers[].amountCents`	integer \| null	The money involved, in cents, where there is one.
`blockers[].code`	"LAST_SUPERADMIN" \| "OPEN_CLAWBACK" \| "PAYOUTS_PAUSED_BY_CLAWBACK" \| "CLAWBACK_WINDOW_OPEN" \| "BALANCE_OWED" \| "PAYOUT_TRANSFER_UNSETTLED" \| … (13 values)
`blockers[].count`	integer	How many of the thing the code names.
`blockers[].message`	string	The sentence a person reads — what holds the deletion and what clears it.
`blockers[].until`	integer \| null	Epoch milliseconds the blocker lifts by itself, where it does (the clawback window).
`groupsRemoved`	array of object	The organization's live groups — its OWNER and MEMBER groups among them; each is soft-deleted.
`groupsRemoved[].id`	string
`groupsRemoved[].name`	string \| null
`membershipsRemoved`	integer	Current (non-REMOVED) memberships into those groups; each is stamped REMOVED.
`orgId`	string
`orgName`	string
`permissionsRetired`	integer	The organization's per-org permissions. Not written: every grant path requires a live organization, so they confer nothing once it is deleted.
`rolesRemoved`	array of object	The organization's own live roles (its OWNER and ORG_USER roles); each is soft-deleted.
`rolesRemoved[].id`	string
`rolesRemoved[].name`	string \| null
`usersDeactivated`	array of object	Members who belong to no other live organization. Each is soft-deleted and their DynamoDB auth row suspended, so they cannot sign in by either path.
`usersDeactivated[].email`	string \| null
`usersDeactivated[].id`	string
`usersKept`	array of object	Members of another live organization. Kept, and lose only this organization's memberships; `keptBy` names the organization(s) that keep them.
`usersKept[].email`	string \| null
`usersKept[].id`	string
`usersKept[].keptBy`	array of object
`usersKept[].keptBy[].id`	string
`usersKept[].keptBy[].name`	string \| null

When it fails

A failed call returns isError: true with the API's message as text.

400: The id is not a UUID.
403: Authenticated, but the caller holds none of the required permissions.
404: No such organization, or it is already deleted.

What the model is shown

This is the tool exactly as the server lists it in tools/list. The description starts with the REST call it makes.

json

{
  "name": "get_orgs_by_id_deletion_preview",
  "description": "GET /api/orgs/{id}/deletion-preview — Answers the report the delete would produce: the groups it would soft-delete, how many memberships it would stamp REMOVED, which members it would deactivate (no other live organization) and which it would keep (and which organization keeps them). READS ONLY. A deletion the guard would refuse is still a 200 — `blocked: true` with the reason — so the portal can disable the action and say why before anyone asks for it. Requires `execute:DeleteOrgCommand`, the delete's own permission: the report names members by email. The caller's own token is forwarded; the DAL re-checks it.",
  "inputSchema": {
    "type": "object",
    "properties": {
      "id": {
        "type": "string"
      }
    },
    "required": [
      "id"
    ]
  },
  "annotations": {
    "readOnlyHint": true,
    "openWorldHint": false
  }
}