Hookdeck Decommission a Source

arazzo: 1.0.1
info:
  title: Hookdeck Decommission a Source
  summary: Read a source, disable it to stop ingestion, then delete it.
  description: >-
    Retiring a webhook endpoint should be done in two safe steps: stop accepting
    new requests, then remove the resource. This workflow reads the source to
    confirm it exists, disables it so it stops ingesting requests, verifies the
    disabled timestamp is set, then deletes it. Every step spells out its request
    inline so the flow can be read and executed without opening the underlying
    OpenAPI description.
  version: 1.0.0
  x-realizes-capability-ids:
  - BC-4270.80
  x-capability-derivation:
    method: 'deterministic join: sourceDescriptions -> per-tag OpenAPI -> tag/capability edge. No classification at this step.'
    min_confidence: 0.7
    sources:
    - capability_id: BC-4270.80
      capability_name: Webhook & Event Subscription Management
      spec: hookdeck-sources-api-openapi.yml
      confidence: 0.7
    model: Turbo EA Capabilities by Vincent Verdet — Turbo EA, https://github.com/vincentmakes/turbo-ea-capabilities, CC BY 4.0
sourceDescriptions:
- name: sourcesApi
  url: ../openapi/hookdeck-sources-api-openapi.yml
  type: openapi
workflows:
- workflowId: decommission-source
  summary: Safely disable then delete a source.
  description: >-
    Reads a source, disables it to halt ingestion, confirms the disabled state,
    and deletes it.
  inputs:
    type: object
    required:
    - sourceId
    properties:
      sourceId:
        type: string
        description: The id of the source to disable and delete.
  steps:
  - stepId: readSource
    description: >-
      Read the source to confirm it exists before decommissioning it.
    operationId: getSource
    parameters:
    - name: id
      in: path
      value: $inputs.sourceId
    successCriteria:
    - condition: $statusCode == 200
    outputs:
      sourceId: $response.body#/id
      name: $response.body#/name
  - stepId: disableSource
    description: >-
      Disable the source so it stops accepting inbound requests, confirming the
      disabled timestamp is set.
    operationId: disableSource
    parameters:
    - name: id
      in: path
      value: $steps.readSource.outputs.sourceId
    successCriteria:
    - condition: $statusCode == 200
    - context: $response.body
      condition: $.disabled_at != null
      type: jsonpath
    outputs:
      disabledAt: $response.body#/disabled_at
  - stepId: deleteSource
    description: >-
      Delete the disabled source, removing it permanently.
    operationId: deleteSource
    parameters:
    - name: id
      in: path
      value: $steps.readSource.outputs.sourceId
    successCriteria:
    - condition: $statusCode == 200
    outputs:
      deletedSourceId: $response.body#/id
  outputs:
    deletedSourceId: $steps.deleteSource.outputs.deletedSourceId
    disabledAt: $steps.disableSource.outputs.disabledAt