---
title: "Delete company PII data in regulated entity"
method: POST
path: "/api-regulated/v1/introducing-brokers/{introducingBrokerId}/companies/{companyId}/delete-pii"
tags: ["CompanyOffboarding"]
---

# Delete company PII data in regulated entity

`POST /api-regulated/v1/introducing-brokers/{introducingBrokerId}/companies/{companyId}/delete-pii`

## Request

- Base URL: `https://api.currencyguard.com`
- URL: `https://api.currencyguard.com/api-regulated/v1/introducing-brokers/{introducingBrokerId}/companies/{companyId}/delete-pii`
- Auth: OAuth 2 (implicit, authorization URL `https://auth.currencyguard.com/oauth2/authorize`, scopes: `regulated.companies.canDeleteCompanyPii`)

Permanently deletes a company's PII data in compliance with GDPR requirements. Company must be DISABLED first. This operation is irreversible and sets status to DELETED. The authenticated user must have permission to access the specified regulated entity.

**Required entitlement:** `regulated.companies.canDeleteCompanyPii`  
_Entitles the regulated user to permanently delete a company's PII data within their regulated entity_

## Path parameters

- `introducingBrokerId` string, uuid, required
- `companyId` string, uuid, required

## Response `200`

Company PII data deleted successfully

- CompanyDTO: Schema for representing a Company
  - `id` string, uuid: The ID for this company.
  - `regulatedEntityId` string, uuid: The ID of the regulated entity this company belongs to.
  - `introducingBrokerId` string, uuid: The ID of the introducing broker this company belongs to.
  - `status` 'PENDING' | 'ENABLED' | 'DISABLED' | 'DELETED': The status of this company.
  - `piiData` CompanyDTOPiiData: **Extensible JSONB field** - The PII data for this company as encrypted JSON. This field accepts any valid JSON structure and can be extended with additional properties as needed. Note: While the structure is extensible, known fields shown in the example are subject to application validation.
  - `oauthPoolId` string, uuid: The OAuth pool this company's users authenticate against, shared with its broker.
  - `perimeterId` string, uuid: The tenant perimeter whose KMS key encrypts this record's PII.
  - `baseCurrency` string: The company's functional/home currency (ISO 4217). Defaults the guard currency for this company's guards.
  - `eventSequence` integer: Event sequence number for event sourcing.
  - `versionNumber` integer: The strictly monotonically increasing version number for this record.
  - `updatedBy` string: The username of the person or entity that updated this record.
  - `updatedAt` string: The timestamp of the last update in UTC.
  - `createdAt` string: The timestamp of creation in UTC.

## Other responses

- `400`: Invalid company ID or regulatedEntityId format — [`http/malformed-request`](/problems/http/malformed-request/)
- `401`: Not authenticated — [`security/authentication-failed`](/problems/security/authentication-failed/)
- `403`: Not authorized - requires REGULATED role or no access to specified regulated entity — [`security/insufficient-permissions`](/problems/security/insufficient-permissions/)
- `404`: Company not found — [`http/resource-not-found`](/problems/http/resource-not-found/)
- `422`: The company is not in a state that permits this operation. Compare `currentStatus` with `requiredStatus` on the problem detail. **Problem types returned by this endpoint** | Type | Meaning | |---|---| | [`onboarding/entity-lifecycle-state-invalid`](/problems/onboarding/entity-lifecycle-state-invalid/) | The user or company is not in a state that permits the requested operation |
- `500`: Internal server error — [`server/internal-error`](/problems/server/internal-error/)

---

[API](https://skmtc.dev/currencyguard/apis/currencyguard-trading-system-api-external.md) · [All operations](https://skmtc.dev/currencyguard/apis/currencyguard-trading-system-api-external/llms.txt) · [OpenAPI document](https://skmtc.dev/currencyguard/apis/currencyguard-trading-system-api-external/revisions/a1f3f854190d?raw)