---
title: "Pseudonymize user"
method: PUT
path: "/api/v2/users/{userId}/pseudonymize"
tags: ["Users"]
---

# Pseudonymize user

`PUT /api/v2/users/{userId}/pseudonymize`

> 🔑
>
> Required OAuth scope: `users:write`.

Removes all personal information from a previously deleted user. The first name, last name, email, and username are replaced with random, irreversible alphanumeric strings. Custom field values are deleted permanently. The user ID remains unchanged, so this is not full GDPR anonymization. If 'deleteExternalIds' is set to true, the user's external identifiers are deleted.

## Path parameters

- `userId` string, ObjectId, required

## Query parameters

- `deleteExternalIds` 'true' | 'false'

## Headers

- `360-api-version` 'v2.0', required

## Response `200`

Returns the pseudonymized user.

- UserDTO
  - `_id` string, ObjectId, required — The unique ID of the user.
  - `mail` string — The email address of the user.
  - `username` string — The username that can be used to log in if the company allows it.
  - `status` 'active' | 'invited' | 'deleted', required — The status of the user.
  - `lang` 'bg' | 'cs' | 'da' | 'de' | 'el' | 'en' | 'es' | 'fi' | 'fr' | 'hr' | 'ht_HT' | 'hu' | 'id' | 'it' | 'ja' | 'kar_MM' | 'ko' | 'lt' | 'mh_MH' | 'nl' | 'nl_BE' | 'no' | 'pl' | 'pt' | 'ro' | 'ru' | 'rw_RW' | 'sk' | 'sl' | 'so_SO' | 'sv' | 'sw_KE' | 'th' | 'ti_ET' | 'tr' | 'uk' | 'zh' | 'vi', required — The default language of the user, in a bigram format (en, fr, de, etc.).
  - `firstName` string — The first name of the user.
  - `lastName` string — The last name of the user.
  - `job` string — The role title of the user.
  - `organization` string — The organization that the user belongs to.
  - `phone` string — The phone number of the user.
  - `custom` string — The value of the **Additional information** field in the user’s profile. This is not the value of the custom fields associated with the user.
  - `deletedAt` string[] — The list of dates and times when the user’s profile was soft deleted, in the `YYYY-MM-DDThh:mm:ss.sssZ` format (ISO 8601 in Coordinated Universal Time (UTC)).
  - `primaryGroupId` string, ObjectId — The unique ID of the primary group of the user.
  - `reactivatedAt` string[] — The list of dates and times when the user’s profile was reactivated, in the `YYYY-MM-DDThh:mm:ss.sssZ` format (ISO 8601 in Coordinated Universal Time (UTC)).
  - `lastLoginDate` string, date-time — The date and time when the user last logged in, in the `YYYY-MM-DDThh:mm:ss.sssZ` format (ISO 8601 in Coordinated Universal Time (UTC)).
  - `toBeDeactivatedAt` string, date-time — The date and time when the user will be deactivated, in the `YYYY-MM-DDThh:mm:ss.sssZ` format (ISO 8601 in Coordinated Universal Time (UTC)).
  - `profileImageId` string, ObjectId — The unique ID of the profile image of the user.

## Other responses

- `400` — The given `userId` does not correspond to a deleted user.
- `401` — The given access token is either missing, invalid, has expired, or has been revoked.
- `403` — The given access token does not have the required OAuth scope to execute the request.
- `404` — The given `userId` does not correspond to any existing user.
- `429` — The client has sent too many requests in a short amount of time.

---

[API](https://skmtc.dev/360learning/apis/core-api.md) · [All operations](https://skmtc.dev/360learning/apis/core-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/360learning/core-api/revisions/94b691b0b72c/schema)