---
title: "POST /v1/customers/{id}/gdpr-withdraw — partial-parity #23"
method: POST
path: "/customers/{id}/gdpr-withdraw"
tags: ["Customer"]
---

# POST /v1/customers/{id}/gdpr-withdraw — partial-parity #23

`POST /customers/{id}/gdpr-withdraw`

Mirrors {@see \App\Http\Controllers\Public\ClientPortalController::withdrawConsent}
— sets `gdpr_consent_given=false`, stamps `gdpr_withdrawal_date`,
captures an optional reason. Activity log distinct from the portal
path (`api.gdpr_consent_withdrawn`) so audit consumers can separate
partner-driven withdrawals from customer self-service.

Idempotent: re-withdrawing an already-withdrawn consent updates the
date (so partners can refresh evidence on a re-request) but does not
re-emit the activity log entry.

## Path parameters

- `id` string, required

## Request body

- object
  - `reason` string, nullable

## Response `200`

- string

## Other responses

- `422` — Validation error

---

[API](https://skmtc.dev/boothzen/apis/boothzen-api-v1.md) · [All operations](https://skmtc.dev/boothzen/apis/boothzen-api-v1/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/boothzen/boothzen-api-v1/revisions/a5ae040e3ba3/schema)