Understand resource deletion behavior
When you delete a resource in automation orchestrator, the platform permanently removes it from the database. You cannot undo deletions. Automation orchestrator does not use soft deletion or a recycle bin.
Audit trail for deleted resources
Every delete operation produces an audit event that captures the resource identity, the actor who performed the deletion, and a timestamp. You can query these events in your observability backend to review what was deleted and when.
When a delete operation cascades to child resources, an audit event is generated for each affected row. For example, deleting a project generates individual audit events for each workflow, credential, and role assignment that the operation removes. These cascade audit events have audit.event_source set to crud_event to distinguish them from application-level events.
Cascade behavior by resource type
The following table describes what happens to dependent resources when you delete each resource type.
| Resource you delete | What happens to dependent resources |
|---|---|
| Project | Permanently deletes all workflows, workflow versions, credentials, custom roles, executions, invocations, service accounts, approval requests, policies, secrets, file metadata, integration assignments, and role assignments scoped to the project. Workflow runs are permanently deleted, although this action is blocked if a workflow run is actively in progress. |
| Workflow | Permanently deletes all versions of the workflow. Existing workflow runs lose their workflow and version associations but remain accessible for historical review. |
| Credential | Permanently deletes the credential and its encrypted secret material. Workflows that referenced the credential continue to exist but fail at runtime if they attempt to use it. |
| User | Removes the user record, all identity provider links, and all role assignments for the user. If the same external identity authenticates again, just-in-time (JIT) provisioning creates a new user record. The new record has no prior role assignments. |
| Group | Removes the group and all role assignments associated with it. Users who were members lose permissions granted through that group. |
| Identity provider | Removes the provider configuration and all linked user identities, and revokes active sessions through that provider. Users can no longer sign in through the deleted provider. |
| Service account | Permanently removes the service account, its credentials, and its role assignments. Immediately rejects all tokens previously issued to the service account. |
| Integration | Permanently removes the integration configuration and all discovered tools. Workflows that referenced tools from the deleted integration fail at runtime. |
| Role | Removes the role definition and cascade-deletes all role assignments that reference the role. An audit event records the count of affected assignments. |
Name reuse after deletion
After you delete a resource, the name is immediately available for reuse. You can create a new resource with the same name without waiting or performing any cleanup steps.