---
title: "Raise a GDPR data request"
method: POST
path: "/gdpr-requests"
tags: ["GDPR Requests"]
---

# Raise a GDPR data request

`POST /gdpr-requests`

## Request

- Base URL: `http://localhost:8000/api/shop`
- URL: `http://localhost:8000/api/shop/gdpr-requests`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/bagisto/apis/bagisto-shop-api/docs/gdpr-requests/post.ts> (a function with typed inputs; its response is checked against the schema)

Raise a GDPR data request for the authenticated customer. Type must be `delete` or `update`.

## Headers

- `X-STOREFRONT-KEY` string, required
- `X-Locale` string
- `X-Channel` string
- `X-Currency` string

## Request body

- object
  - `type` 'delete' | 'update', required
  - `message` string, required

## Response `201`

Request raised. Starts in `pending` status.

## Other responses

- `400`: GDPR disabled in admin config, or invalid type/message.
- `422`: Validation Error

## Changes

- **2026-10-28** `b84d43839844`: 1 warning
  - the `message` request property's maxLength was set to `500`

[Operation history](https://skmtc.dev/bagisto/apis/bagisto-shop-api/changes/gdpr-requests/post.md)

---

[API](https://skmtc.dev/bagisto/apis/bagisto-shop-api.md) - [All operations](https://skmtc.dev/bagisto/apis/bagisto-shop-api/llms.txt) - [OpenAPI document](https://skmtc.dev/bagisto/apis/bagisto-shop-api/revisions/f619df36bf29?raw)