> ## Documentation Index > Fetch the complete documentation index at: https://apidocs.sessionboard.com/llms.txt > Use this file to discover all available pages before exploring further. # Create a GDPR request > Submit a GDPR data access or erasure request for one email address, and process it synchronously against the organization's data. For `requestType: erasure` the call returns once the erasure has run. Read `status` to find out what happened — it is recorded by the erasure itself and is never assumed: - `complete` — the email matched at least one record and erasure ran against it. - `no_records_found` — nothing in this organization matched the email. Nothing was erased. Treat this as an outcome to escalate, not a fulfilled request. `response` carries the identifiers that were matched, and on requests processed recently also `counts`, `users_scrubbed` and `users_retained` — the compliance evidence of what the erasure actually did. A user account shared with another organization is retained rather than scrubbed, and appears in `users_retained`. A `502` means the erasure did not run and **nothing was recorded or erased**; retry the request. ## OpenAPI ````yaml /api-reference/openapi.yaml post /v1/gdpr/requests openapi: 3.1.0 info: title: Sessionboard Public API version: '1.0' description: >- REST API for managing sessions, speakers, contacts, sponsors, exhibitors, and event data on the Sessionboard platform. contact: name: Sessionboard Support email: support@sessionboard.com termsOfService: https://www.sessionboard.com/legal/terms-of-service servers: - url: https://public-api.sessionboard.com description: US Region - url: https://public-api-eu.sessionboard.com description: EU Region security: - ApiKey: [] - BearerToken: [] tags: - name: Events description: Manage events on the platform. - name: Sessions description: Search and retrieve sessions within an event. - name: Session Writes description: >- Create, update, delete, and restore sessions. Requires the `write:sessions` scope. - name: Contact Writes description: >- Create, update, delete, and restore contacts. Requires the `write:contacts` scope. - name: Exhibitor Writes description: >- Create, update, delete, and restore exhibitors. Requires the `write:exhibitors` scope. - name: Sponsor Writes description: >- Create, update, delete, and restore sponsors. Requires the `write:sponsors` scope. - name: Field Writes description: >- Create, update, and delete custom fields. Requires the `write:fields` scope. - name: Speakers description: Search and retrieve speakers within an event. - name: Participants description: | Search and retrieve every contact holding a session role on an event — speakers, chairpersons, moderators and custom roles — with the roles each one holds, and list the event's participant roles. - name: Contacts description: Search and retrieve contacts at the organization or event level. - name: Sponsors description: Search and retrieve sponsors within an event. - name: Exhibitors description: Search and retrieve exhibitors within an event. - name: Event Settings description: >- Retrieve event configuration such as fields, tags, tracks, rooms, formats, levels, languages, and session statuses. - name: GDPR description: Manage GDPR data access and erasure requests. - name: Insights description: >- Query event data using SbQL, generate queries with AI, and manage dashboards. - name: Ask description: >- Ask a natural-language question about one event and get a cited answer. Requires the `read:ask` scope, granted explicitly. - name: Metadata Writes description: >- Create, update, and delete session metadata (rooms, tracks, tags, formats, levels, languages, statuses). Requires the `write:metadata` scope. - name: Agenda Planning description: >- Manage agenda drafts, draft sessions, scheduling rules, and evaluation personas. Requires the `write:events` scope. - name: Dashboards & Widgets description: >- Create, read, update, and delete dashboards and widgets at the event or organization level. Requires `write:events` scope for writes. - name: Reports & Queries description: >- Create, read, update, delete, and run saved SbQL queries/reports at the event or organization level. Requires `write:events` scope for writes. - name: Transcriptions description: >- Transcript text on sessions — fragments, summaries, insights, and translations. Requires `read:transcriptions` / `write:transcriptions` scopes. - name: Session Recordings description: >- Session audio files for recording archives (live capture or imported audio). Requires `read:transcriptions` / `write:transcriptions` scopes. - name: Media description: >- Upload video or audio files for automatic transcription. Requires `read:media` / `write:media` scopes. - name: Session Files description: > Documents attached to sessions (PDFs, PowerPoint, Word, images, and similar). Simple upload: `POST .../files/upload` (multipart, max 50 MB). Direct-to-storage: create → PUT → complete (max 500 MB). Requires `read:sessions` / `write:sessions` scopes. See the [Uploading session files](/guides/uploading-session-files) guide. - name: OAuth description: >- OAuth 2.1 endpoints for AI client authorization (Claude, ChatGPT). Mounted at `/oauth/` (not `/v1/`). - name: Log Export description: > Pull your organization's API request, security and audit logs into a SIEM such as Splunk, Microsoft Sentinel or Elastic. Requires a dedicated API token with the `read:audit_logs` scope, which can call nothing else. See the [Exporting logs to a SIEM](/guides/exporting-logs-to-a-siem) guide. - name: Awards description: >- Read and manage Awards programs and their categories, rounds, promo codes, submissions and reviews. Organization-level: paths start at `/v1/organization/{orgId}/awards`. Requires `read:awards` / `write:awards` scopes. - name: Registration description: > Registration inside Sessionboard: registration forms, ticket types, registrations, orders, attendees and check-ins for one event. Requires the preview scopes `read:registrations` / `write:registrations`, which a token or OAuth client gets only when they are named explicitly (not by default, and not listed in `scopes_supported`). The event must have Registration turned on (Early Access); otherwise every endpoint answers `403 FORBIDDEN`. See the [Registration and Expo](/guides/registration-and-expo) guide. - name: Expo description: > Expo floor-map booths and sponsorship inventory for one event. Requires the preview scopes `read:expo` / `write:expo`, which a token or OAuth client gets only when they are named explicitly (not by default, and not listed in `scopes_supported`). The event must have Expo turned on (Early Access); otherwise every endpoint answers `403 FORBIDDEN`. See the [Registration and Expo](/guides/registration-and-expo) guide. paths: /v1/gdpr/requests: post: tags: - GDPR summary: Create a GDPR request description: | Submit a GDPR data access or erasure request for one email address, and process it synchronously against the organization's data. For `requestType: erasure` the call returns once the erasure has run. Read `status` to find out what happened — it is recorded by the erasure itself and is never assumed: - `complete` — the email matched at least one record and erasure ran against it. - `no_records_found` — nothing in this organization matched the email. Nothing was erased. Treat this as an outcome to escalate, not a fulfilled request. `response` carries the identifiers that were matched, and on requests processed recently also `counts`, `users_scrubbed` and `users_retained` — the compliance evidence of what the erasure actually did. A user account shared with another organization is retained rather than scrubbed, and appears in `users_retained`. A `502` means the erasure did not run and **nothing was recorded or erased**; retry the request. operationId: create-gdpr-request requestBody: required: true content: application/json: schema: type: object required: - requestType - identityType - identityValue properties: requestType: type: string enum: - erasure - access description: The type of GDPR request. identityType: type: string enum: - email description: The type of identity to look up. identityValue: type: string description: The identity value (e.g., an email address). examples: - jane.doe@example.com responses: '200': description: >- The request was recorded and, for an erasure, processed. Check `status` for the outcome. content: application/json: schema: $ref: '#/components/schemas/GDPRRequest' '400': description: Bad request '401': description: Unauthorized '502': description: >- The erasure service could not be reached. Nothing was recorded and nothing was erased — retry. components: schemas: GDPRRequest: type: object description: A GDPR data access or erasure request, and the record of what it did. properties: id: type: string description: Identifier of the stored request. Quote this when evidencing a DSAR. org_id: type: string request_type: type: string enum: - erasure - access identity_type: type: string enum: - email identity_value: type: string status: type: string enum: - complete - no_records_found - pending description: | Outcome of the request. - `complete` — at least one record matched and was processed. - `no_records_found` — nothing in this organization matched the email, so nothing was erased. - `pending` — the request is stored but has not finished processing. matching_user_exists: type: boolean description: True when the email matched at least one record of any kind. response: type: object description: >- What the request matched and what happened to it. `people`, `users_scrubbed`, `users_retained` and `counts` are present on requests processed recently and absent on older records; an absent field means "not recorded", not "zero". properties: users: type: array description: User accounts identified for this email. items: type: integer org_users: type: array description: Organization membership records removed. items: type: string event_users: type: array description: Event participation records removed. items: type: integer contact_records: type: array description: Contact records marked deleted. items: type: string people: type: array description: Person records whose personal data was scrubbed in place. items: type: string users_scrubbed: type: array description: User accounts whose personal data was de-identified. items: type: integer users_retained: type: array description: >- User accounts left intact because they still belong to another organization, with the reason recorded. items: type: object counts: type: object description: Per-category totals for the arrays above. properties: org_users: type: integer event_users: type: integer contact_records: type: integer people: type: integer users_identified: type: integer users_scrubbed: type: integer users_retained: type: integer created_at: type: string updated_at: type: string securitySchemes: ApiKey: type: apiKey in: header name: x-access-token description: >- Organization API token. Generate from Organization Settings → API Tokens. BearerToken: type: http scheme: bearer description: >- OAuth 2.1 access token. Obtained via the OAuth PKCE flow at `/oauth/token`. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.