Operations marked destructive in the reference – deleting an agent, knowledge source, skill, mailbox or conversation, removing a member, disconnecting WhatsApp, rotating a forwarding address – never run on the first call. They return 409 confirmation_required:

{
  "type": "https://resolido.com/docs/api/errors#confirmation_required",
  "status": 409,
  "code": "confirmation_required",
  "message": "This action is destructive and needs explicit confirmation.",
  "hint": "Show `summary` to the user. Only after they approve, repeat the same call with `confirmationToken` set to `confirmation_token` (valid 5 minutes, only for exactly these arguments).",
  "summary": "Permanently delete the knowledge source \"Shipping FAQ\" (text) used by 2 agent(s), including its indexed content.",
  "confirmation_token": "cfm_1792698136059.a9pypq…",
  "expires_at": 1792698136059
}

Show summary to a person.
Only after they agree, repeat exactly the same call with confirmationToken – as a query parameter or body field.

The token is valid for 5 minutes, only for the same token holder, operation and arguments. A changed argument or an expired token returns a fresh confirmation_required.

Agents must not confirm on their own. The summary exists so that a person sees what will be lost.

In MCP, destructive tools carry destructiveHint and the same two-step flow. The CLI asks Continue? [y/N] or requires --yes.

Confirmations