Create a GDPR request

Submit a GDPR data access or erasure request for one email address, and process it synchronously against the organization’s data.

For requestType: erasure the call returns once the erasure has run. Read status to find out what happened — it is recorded by the erasure itself and is never assumed:

• complete — the email matched at least one record and erasure ran against it.
• no_records_found — nothing in this organization matched the email. Nothing was erased. Treat this as an outcome to escalate, not a fulfilled request.

response carries the identifiers that were matched, and on requests processed recently also counts, users_scrubbed and users_retained — the compliance evidence of what the erasure actually did. A user account shared with another organization is retained rather than scrubbed, and appears in users_retained.

A 502 means the erasure did not run and nothing was recorded or erased; retry the request.

POST /v1/gdpr/requests

Create a GDPR request

cURL

curl --request POST \
  --url https://public-api.sessionboard.com/v1/gdpr/requests \
  --header 'Content-Type: application/json' \
  --header 'x-access-token: <api-key>' \
  --data '
{
  "identityType": "email",
  "identityValue": "[e-mail]"
}
'

200

{
  "id": "<string>",
  "org_id": "<string>",
  "request_type": "erasure",
  "identity_type": "email",
  "identity_value": "<string>",
  "status": "complete",
  "matching_user_exists": true,
  "response": {
    "users": [
      123
    ],
    "org_users": [
      "<string>"
    ],
    "event_users": [
      123
    ],
    "contact_records": [
      "<string>"
    ],
    "people": [
      "<string>"
    ],
    "users_scrubbed": [
      123
    ],
    "users_retained": [
      {}
    ],
    "counts": {
      "org_users": 123,
      "event_users": 123,
      "contact_records": 123,
      "people": 123,
      "users_identified": 123,
      "users_scrubbed": 123,
      "users_retained": 123
    }
  },
  "created_at": "<string>",
  "updated_at": "<string>"
}

Authorizations

ApiKeyBearerToken

x-access-token · string · header · required

Organization API token. Generate from Organization Settings → API Tokens.

Body

application/json

requestType · enum<string> · required

The type of GDPR request.

Available options: erasure, access

identityType · enum<string> · required

The type of identity to look up.

Available options: email

identityValue · string · required

The identity value (e.g., an email address).

Example:

"[e-mail]"

Response

200

application/json

The request was recorded and, for an erasure, processed. Check status for the outcome.

A GDPR data access or erasure request, and the record of what it did.

id · string

Identifier of the stored request. Quote this when evidencing a DSAR.

org_id · string

request_type · enum<string>

Available options: erasure, access

identity_type · enum<string>

Available options: email

identity_value · string

status · enum<string>

Outcome of the request.

• complete — at least one record matched and was processed.
• no_records_found — nothing in this organization matched the email, so nothing was erased.
• pending — the request is stored but has not finished processing.

Available options: complete, no_records_found, pending

matching_user_exists · boolean

True when the email matched at least one record of any kind.

response · object

What the request matched and what happened to it. people, users_scrubbed, users_retained and counts are present on requests processed recently and absent on older records; an absent field means "not recorded", not "zero".

Show child attributes

created_at · string

updated_at · string