Exchange is excluded from this API/CLI release. Any historical Exchange API or CLI example in this guide is unavailable; native portal behavior is outside this exclusion. See [current release scope](/developers/guides/release-scope?lang=en).

# Workspace API: financial boundary during the public preview

Workspace uses native monthly items per company. The API does not terminate or modify old individual WeFact subscriptions through the best-effort portal helper. That helper can log a supplier error while the local change proceeds; this does not count as confirmed financial termination.

For mailbox/Drive cancellation, conversion to a company pool, package changes, company services, retention and permanent deletion, the API first checks the actual typed subjects involved. Active, pending/uncertain or future-ending legacy agreements return `409 workspace_legacy_billing_requires_reconciliation`. Resume also refuses an old termination that still applies today or for which no current resumable native monthly item exists. A correctly bound, ongoing company pool can replace the old personal Drive monthly item; a historically terminated pool without a replacement monthly item cannot. Unrelated, separately cancelled Drive agreements do not block a mailbox-only resume.

The check uses the mailbox ID plus type, or the Workspace ID plus company service; company IDs and old customer IDs are never treated as the same namespace. A monthly item incorrectly linked to another company or duplicate open items return `409 workspace_billing_binding_invalid`. Aliases, technical Workspace domains and standalone domain registrations are not treated as mailbox/Drive subscriptions with the same numeric ID.

## Cancellation and permanent deletion

First cancel a paid mailbox using the existing `actions/cancel` action and the current `If-Match`. The confirmed monthly item receives an end date. Then retrieve the new resource version before permanently deleting it with explicit resource confirmation and recent strong human verification. While a billing agreement remains open, DELETE returns `409 workspace_cancel_required`. An empty Workspace follows the same sequence for its own mailbox and company services. Independent domain registration items remain intact.

An ordinary cancellation must not remove directly provisioned free/unknown mailbox data: it returns `409 workspace_sensitive_delete_required` and points to the explicit sensitive DELETE. That DELETE can remove an unpaid, free mailbox without inventing a paid cancellation period. The free monthly item is still closed.

A mailbox or service still bound to an unpaid or financially uncertain checkout returns `409 workspace_order_cancellation_required`. Use the separate controlled cancellation of the **entire original order**; an individual cancellation/deletion must not bypass that protection.

Expected read-only refusals are assessed before operational idempotency registration, with the existing scope/company checks and current resource version. The same key can therefore be used for the first actual DELETE after cancellation and retrieval of a new version. An already executed or uncertain operation retains its original replay rules; a financial timeout does not permit a fresh key or new invoice. The same checks run again under the existing effect locks. Dry-run checks the same financial boundary without changing monthly items, resources or suppliers.

## Quotes and recovery

Quotes for the relevant package/service changes check the boundary before a new quote and again before execution. Batch checkout also checks this after local preparation and before the shared financial step. A late discrepancy retains the already prepared local resources and held tasks for inspection; no new invoice, payment or automatic delivery follows. Existing quotes and operations remain inspectable through the read routes.

This temporary API boundary does not migrate old records or terminate anything at a supplier. An administrator must first verify/reconcile the original agreement and existing native item under controlled conditions. The full durable termination/resume journal for other legacy workflows remains work after the first preview; the separately controlled personal Drive cancellation/purge and whole-order cancellation retain their own protocols.