---
title: "Redact a study (GDPR)"
method: POST
path: "/api/v1/studies/{id}/redact"
tags: ["Studies"]
---

# Redact a study (GDPR)

`POST /api/v1/studies/{id}/redact`

## Request

- Base URL: `https://api.partner.cubee.cz`
- URL: `https://api.partner.cubee.cz/api/v1/studies/{id}/redact`
- Auth: none required

Erases the personal data of one study (scrubs the personal values — cover label/address, recipient
e-mail, replication payload — out of the stored input/result JSON, nulls the study label and
recipient e-mail, deletes the stored PDF, keeps the de-identified calculation for analytics).
Ownership is the calling API
key's partner — any study the partner created can be redacted, tagged or not. Passing
`externalUserId` adds an extra guard: the study must also carry that end-user tag, so an
integration acting on behalf of one end-user cannot erase another's study by id.

## Path parameters

- `id` string, uuid, required

## Query parameters

- `externalUserId` string

## Response `204`

No Content

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not Found

## Changes

- **2026-11-03** `50555858fb42`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/cubee/apis/partner-api/changes/api/v1/studies/:id/redact/post.md)

---

[API](https://skmtc.dev/cubee/apis/partner-api.md) - [All operations](https://skmtc.dev/cubee/apis/partner-api/llms.txt) - [OpenAPI document](https://skmtc.dev/cubee/apis/partner-api/revisions/50555858fb42?raw)