---
title: "GDPR right-to-erasure for one end-user (T395)"
method: DELETE
path: "/api/subjects/{subjectId}/memories"
tags: ["Subjects"]
---

# GDPR right-to-erasure for one end-user (T395)

`DELETE /api/subjects/{subjectId}/memories`

## Request

- Base URL: `http://localhost:38200`
- URL: `http://localhost:38200/api/subjects/{subjectId}/memories`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `token`

Hard-deletes every `contexts` row tagged with this subjectId (all lifecycle states) plus the subjects registry row itself. First-order only — derivation-cascade erasure is tracked separately. A context under an active litigation hold is skipped, not deleted; see `contexts_blocked_by_hold` in the response.

## Path parameters

- `subjectId` string, required

## Response `200`

Erasure complete (possibly partial — see contexts_blocked_by_hold).

- object
  - `message` string
  - `subject_id` string
  - `contexts_deleted` integer
  - `contexts_blocked_by_hold` integer
  - `subject_registry_removed` boolean

## Other responses

- `400`: subjectId is required.
- `401`: Missing or invalid credentials.
- `404`: Resource not found (or not visible to the caller).

---

[API](https://skmtc.dev/contextq/apis/contextq-api.md) · [All operations](https://skmtc.dev/contextq/apis/contextq-api/llms.txt) · [OpenAPI document](https://skmtc.dev/contextq/apis/contextq-api/revisions/7afc44056a22?raw)