---
title: "Erase user under GDPR"
method: POST
path: "/v1/gdpr/erase"
tags: ["gdpr"]
---

# Erase user under GDPR

`POST /v1/gdpr/erase`

## Request

- Base URL: `https://api.brixsignage.com`
- URL: `https://api.brixsignage.com/v1/gdpr/erase`
- Auth: HTTP bearer

Permanently anonymizes a user's profile and deletes their associated personal data, including linked identities, passkeys, sessions, and pending email verifications, to satisfy a right-to-be-forgotten request. You cannot erase your own account or the last remaining account owner. Only an account owner can do this to an owner, and you cannot do it to a person who holds a permission you do not hold. An API key is never an owner.

**Notes.**
- Irreversible. Unlike `POST /v1/users/:id/erase`, the person does not have to be deactivated first.

## Request body

- object
  - `userId` string, required

## Response `200`

Success.

- object
  - `data` object, required
    - `userId` string, required
    - `erased` true, required

## Other responses

- `401`: Missing, expired or revoked bearer token.
- `403`: You do not hold the permission for the whole workspace (a grant at one location, or in a franchise workspace, is not enough). Also `owner_required` or `outranked`: the person is an owner, or holds a permission you do not hold.
- `404`: No such person in this workspace.
- `409`: `cant_erase_self` or `last_owner`.
- `422`: `userId` is missing.
- `5XX`: Server error. The body carries a `requestId` to quote to support.

---

[API](https://skmtc.dev/brixsignage/apis/brix-api.md) · [All operations](https://skmtc.dev/brixsignage/apis/brix-api/llms.txt) · [OpenAPI document](https://skmtc.dev/brixsignage/apis/brix-api/revisions/02fd3665dc7d?raw)