---
title: "Create a right-to-be-forgotten request"
method: POST
path: "/right-to-be-forgotten-requests"
tags: ["Privacy"]
---

# Create a right-to-be-forgotten request

`POST /right-to-be-forgotten-requests`

## Request

- Base URL: `https://api.commonroom.io/api/v2`
- URL: `https://api.commonroom.io/api/v2/right-to-be-forgotten-requests`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/commonroom/apis/common-room-api-v2/docs/right-to-be-forgotten-requests/post.ts> (a function with typed inputs; its response is checked against the schema)

Request erasure of a person's data under a privacy law such as the GDPR or CCPA.
Use this endpoint only for privacy / right-to-be-forgotten requests. To remove
contacts as routine data cleanup, use `DELETE /contacts` instead.

A right-to-be-forgotten request is **irreversible**:
- every contact in the workspace with this email is anonymized;
- customer data synced with this email as the contact identifier (for example from
  a data warehouse, Census, Hightouch or a batch import) is permanently blocked from
  being imported again.

Requests are processed daily. Poll
`GET /right-to-be-forgotten-requests/{id}` (the `Location` header) to see when
a request has been processed. The email is never returned by the API.

Requires the `contacts:write` scope and a role that can create
right-to-be-forgotten requests.

## Request body

- object
  - `email` string, required: The email address to erase, at most 254 characters. Matching is case-insensitive.

## Response `202`

The request was accepted and will be processed

- RightToBeForgottenRequestResponse
  - `success` true, required
  - `data` RightToBeForgottenRequest, required
    - `id` string, required: Right-to-be-forgotten request ID (format `rtbf_<number>`)
    - `status` 'pending' | 'processed', required
    - `createdAt` string, date-time, required
    - `processedAt` string, date-time, nullable, required: When the request was processed, or null while it is pending.

## Other responses

- `400`: Missing or invalid email, or an email longer than 254 characters
- `403`: Forbidden, or the role cannot create right-to-be-forgotten requests
- `409`: The email belongs to a contact who can log in to the workspace
- `429`: Rate Limited

---

[API](https://skmtc.dev/commonroom/apis/common-room-api-v2.md) - [All operations](https://skmtc.dev/commonroom/apis/common-room-api-v2/llms.txt) - [OpenAPI document](https://skmtc.dev/commonroom/apis/common-room-api-v2/revisions/865d4d43dadf?raw)