GDPR right-to-be-forgotten

arazzo: 1.0.1
info:
  title: GDPR right-to-be-forgotten
  version: 1.0.0
  summary: Confirm a user's events, then permanently delete them with a secret key.
sourceDescriptions:
- name: identityApi
  url: ../openapi/millimetric-identity-api-openapi.yml
  type: openapi
- name: readApi
  url: ../openapi/millimetric-read-api-openapi.yml
  type: openapi
workflows:
- workflowId: gdpr-delete
  summary: query (confirm scope) -> forget (delete). sk_ key only.
  inputs:
    type: object
    required: [sk_key, rk_key, user_id, from, to]
    properties:
      sk_key: {type: string, description: sk_live_* secret key (required for forget)}
      rk_key: {type: string}
      user_id: {type: string}
      from: {type: string}
      to: {type: string}
  steps:
  - stepId: confirm
    operationId: queryEvents
    parameters:
    - {name: Authorization, in: header, value: "Bearer $inputs.rk_key"}
    - {name: from, in: query, value: $inputs.from}
    - {name: to, in: query, value: $inputs.to}
    - {name: user_id, in: query, value: $inputs.user_id}
    successCriteria:
    - condition: $statusCode == 200
    outputs:
      rows: $response.body#/rows
  - stepId: forget
    operationId: forget
    parameters:
    - {name: Authorization, in: header, value: "Bearer $inputs.sk_key"}
    requestBody:
      contentType: application/json
      payload:
        user_id: $inputs.user_id
    successCriteria:
    - condition: $statusCode == 200
    outputs:
      queued: $response.body#/queued
  outputs:
    queued: $steps.forget.outputs.queued