---
title: "GDPR-anonymize an Applicant, clearing selected data keys"
method: POST
path: "/v2/applicants/{id}/gdpr_anonymize_with_denylist"
tags: ["Applicants"]
---

# GDPR-anonymize an Applicant, clearing selected data keys

`POST /v2/applicants/{id}/gdpr_anonymize_with_denylist`

## Request

- Base URL: `https://api.fountain.com`
- URL: `https://api.fountain.com/v2/applicants/{id}/gdpr_anonymize_with_denylist`
- Auth: API key in header `X-ACCESS-TOKEN`

Anonymizes this applicant's personal data per GDPR right-to-erasure: name, contact details, messages, notes, documents, and the `data`/`structured_data`/`secure_data` keys listed in `data_denylist`. Other applicants that share its email or phone are not touched. Soft-deleted applicants are anonymized too. When the applicant has a Worker Experience profile, that profile is deleted first. If the deletion fails, the applicant is left unchanged and the request returns 503, so a retry is safe. If Worker Experience is not enabled for the account, the applicant is left unchanged and the request returns 409. If the profile also belongs to another applicant, it is kept, the applicant is anonymized, and the request returns 200 with the reason. Idempotent — a no-op if the applicant has already been anonymized. A scoped API token needs create and delete access to applicants (`applicants: cd`). Without create access the request returns 401, and without delete access it returns 403.

## Path parameters

- `id` string, required

## Request body

- object
  - `data_denylist` string[], required: Keys of the applicant's `data`/`structured_data`/`secure_data` fields to anonymize in place. Each listed key keeps existing and reads `anonymise`, or null where the field cannot hold text. Every other key is left as it is.

## Response `200`

anonymized; Worker Experience profile kept

- object
  - `wx_worker` 'kept'
  - `reason` 'linked_to_another_applicant'

## Other responses

- `204`: OK
- `401`: Unauthorized
- `403`: the token has create but not delete access to applicants
- `404`: Not Found
- `409`: Worker Experience not enabled; applicant left unchanged
- `422`: data_denylist is missing or empty
- `503`: Worker Experience profile not deleted; applicant left unchanged

## Changes

- **2026-11-03** `3119e105004c`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/fountain/apis/hire-public-api/changes/v2/applicants/:id/gdpr_anonymize_with_denylist/post.md)

---

[API](https://skmtc.dev/fountain/apis/hire-public-api.md) - [All operations](https://skmtc.dev/fountain/apis/hire-public-api/llms.txt) - [OpenAPI document](https://skmtc.dev/fountain/apis/hire-public-api/revisions/3119e105004c?raw)