---
title: "Erase user under GDPR"
method: POST
path: "/v1/users/{id}/erase"
tags: ["users"]
---

# Erase user under GDPR

`POST /v1/users/{id}/erase`

## Request

- Base URL: `https://api.brixsignage.com`
- URL: `https://api.brixsignage.com/v1/users/{id}/erase`
- Auth: HTTP bearer

Permanently erases a deactivated person's personal data to satisfy a right-to-be-forgotten request: it anonymizes their profile and hard-deletes their passkeys, linked identities, sessions, and location role assignments. The account must already be deactivated. You cannot erase your own account or the last remaining account owner. Only an account owner can do this to an owner, and you cannot do it to a person who holds a permission you do not hold. An API key is never an owner.

**Notes.**
- Irreversible. The same rule as deactivation applies: only an owner can erase an owner, and the caller must hold every permission the person holds.

## Path parameters

- `id` string, required

## Response `200`

Success.

- object
  - `data` object, required
    - `id` string, required
    - `erased` true, required

## Other responses

- `401`: Missing, expired or revoked bearer token.
- `403`: The person belongs to a location where you do not hold `user.edit`; `owner_required`: the person is an owner and you are not an owner there (an API key is never an owner); or `outranked`: the person holds a permission you do not hold where they hold it.
- `404`: No such person in this workspace (an erased person is not found again).
- `409`: `cant_erase_self`, `last_owner`, or `must_deactivate_first`.
- `5XX`: Server error. The body carries a `requestId` to quote to support.

---

[API](https://skmtc.dev/brixsignage/apis/brix-api.md) · [All operations](https://skmtc.dev/brixsignage/apis/brix-api/llms.txt) · [OpenAPI document](https://skmtc.dev/brixsignage/apis/brix-api/revisions/02fd3665dc7d?raw)