---
title: "GDPR-anonymize an Applicant, preserving selected data keys"
method: POST
path: "/v2/applicants/{id}/gdpr_anonymize_with_whitelist"
tags: ["Applicants"]
---

# GDPR-anonymize an Applicant, preserving selected data keys

`POST /v2/applicants/{id}/gdpr_anonymize_with_whitelist`

## Request

- Base URL: `https://api.fountain.com`
- URL: `https://api.fountain.com/v2/applicants/{id}/gdpr_anonymize_with_whitelist`
- Auth: API key in header `X-ACCESS-TOKEN`

Anonymizes an applicant's personal data per GDPR right-to-erasure, except for the `data`/`structured_data`/`secure_data` keys listed in `data_whitelist`, which are preserved as-is. Idempotent — a no-op if the applicant has already been anonymized. A scoped API token needs create and delete access to applicants (`applicants: cd`). Without create access the request returns 401, and without delete access it returns 403.

## Path parameters

- `id` string, required

## Request body

- object
  - `data_whitelist` string[], nullable: Keys of the applicant's `data`/`structured_data`/`secure_data` fields to preserve instead of clearing

## Response `204`

already anonymized (no-op)

- string, nullable

## Other responses

- `401`: Unauthorized
- `403`: the token has create but not delete access to applicants
- `404`: Not Found
- `422`: Unprocessable Entity

## Changes

- **2026-11-03** `3119e105004c`: 1 info
  - added the non-success response with the status `403`

[Operation history](https://skmtc.dev/fountain/apis/hire-public-api/changes/v2/applicants/:id/gdpr_anonymize_with_whitelist/post.md)

---

[API](https://skmtc.dev/fountain/apis/hire-public-api.md) - [All operations](https://skmtc.dev/fountain/apis/hire-public-api/llms.txt) - [OpenAPI document](https://skmtc.dev/fountain/apis/hire-public-api/revisions/3119e105004c?raw)