---
title: "Create a Subject Access Request"
method: POST
path: "/subject-access-requests"
tags: ["Subject Access Requests"]
---

# Create a Subject Access Request

`POST /subject-access-requests`

Create a Subject Access Request

## Request body

- SubjectAccessRequest
  - `account_id` integer — The Account ID for the account the Subject Access Request will be executed.
  - `completed_at_time` string, date-time, nullable — The time when the request was completed.
  - `data_type` 'user' | 'visitor', required — <p>The type of data to be accessed or deleted. The two options are:</p> <ul> <li><code>user</code> - End users (also known as <em>Collaborators</em>) that are added to the accounts of our customers. A user can be a <a href="https://help.optimizely.com/Set_Up_Optimizely/Manage_collaborators_in_Optimizely_X" rel="internal"><u>collaborator</u></a> on multiple accounts.</li> <li><code>visitor</code> - Visitors who visit or use our customers’ websites, apps and other digital products. Optimizely stores visitor data to calculate experiment results and to tailor content.</li> </ul>
  - `expired_at_time` string, date-time — Time when the url expires (7 days from the completed_at_time)
  - `export_location` string — The location to which the data will be exported. The data will be made accessible in a AWS S3 bucket.
  - `id` integer — The Subject Access Request ID.
  - `identifier` string, required — The identifier value that you would like us to use when searching. If <code>user</code> was selected in the previous step, the identifier will be the email address for the User.
  - `identifier_type` 'email' | 'optimizely_end_user_id' | 'dcp_id' | 'fullstack_id' | 'other', required — <p>User data is identified by the email address used to create the end user account. The endpoint only accepts the <code>email</code> datatype if you selected <code>user</code> for <strong>Datatype</strong>.<br> <br> If you selected <code>visitor</code> for <strong>data_type</strong>, you can select 5 options for personal identifier types:</p> <ul> <li> <p><code>dcp_id</code> - Any ID used to identify targeting records in Optimizely.</p> </li> <li> <p><code>email</code> - The email address of a visitor.</p> </li> <li> <p><code>fullstack_id</code> - The unique identifier used for Full Stack experiments.</p> </li> <li> <p><code>optimizely_end_user_id</code> - An Optimizely generated user cookie.</p> </li> <li> <p><code>other</code> -&nbsp;Any other identifier that was uploaded to Optimizely.</p> </li> </ul>
  - `processing_started_time` string, date-time, nullable — The time when the processing of the Subject Access Request started.
  - `request_type` 'access' | 'delete', required — <code>delete</code> - Removes all data within an account that is associated to the identifier defined in the identifier field. <br> <code>access</code> - Finds all data stored in Optimizely systems associated to the identifier defined in the identifier field and exports it to an AWS S3 bucket for you to access.
  - `requested_at_time` string, date-time — The time when the Subject Access Request was submitted.
  - `sla_deadline_time` string, date-time, nullable — The time by which the Subject Access Request must be completed.
  - `status` 'pending' | 'processing' | 'completed' | 'failure' — The status of the Subject Access Request.

## Response `201`

Return the created SubjectAccessRequest

- SubjectAccessRequest
  - `account_id` integer — The Account ID for the account the Subject Access Request will be executed.
  - `completed_at_time` string, date-time, nullable — The time when the request was completed.
  - `data_type` 'user' | 'visitor', required — <p>The type of data to be accessed or deleted. The two options are:</p> <ul> <li><code>user</code> - End users (also known as <em>Collaborators</em>) that are added to the accounts of our customers. A user can be a <a href="https://help.optimizely.com/Set_Up_Optimizely/Manage_collaborators_in_Optimizely_X" rel="internal"><u>collaborator</u></a> on multiple accounts.</li> <li><code>visitor</code> - Visitors who visit or use our customers’ websites, apps and other digital products. Optimizely stores visitor data to calculate experiment results and to tailor content.</li> </ul>
  - `expired_at_time` string, date-time — Time when the url expires (7 days from the completed_at_time)
  - `export_location` string — The location to which the data will be exported. The data will be made accessible in a AWS S3 bucket.
  - `id` integer — The Subject Access Request ID.
  - `identifier` string, required — The identifier value that you would like us to use when searching. If <code>user</code> was selected in the previous step, the identifier will be the email address for the User.
  - `identifier_type` 'email' | 'optimizely_end_user_id' | 'dcp_id' | 'fullstack_id' | 'other', required — <p>User data is identified by the email address used to create the end user account. The endpoint only accepts the <code>email</code> datatype if you selected <code>user</code> for <strong>Datatype</strong>.<br> <br> If you selected <code>visitor</code> for <strong>data_type</strong>, you can select 5 options for personal identifier types:</p> <ul> <li> <p><code>dcp_id</code> - Any ID used to identify targeting records in Optimizely.</p> </li> <li> <p><code>email</code> - The email address of a visitor.</p> </li> <li> <p><code>fullstack_id</code> - The unique identifier used for Full Stack experiments.</p> </li> <li> <p><code>optimizely_end_user_id</code> - An Optimizely generated user cookie.</p> </li> <li> <p><code>other</code> -&nbsp;Any other identifier that was uploaded to Optimizely.</p> </li> </ul>
  - `processing_started_time` string, date-time, nullable — The time when the processing of the Subject Access Request started.
  - `request_type` 'access' | 'delete', required — <code>delete</code> - Removes all data within an account that is associated to the identifier defined in the identifier field. <br> <code>access</code> - Finds all data stored in Optimizely systems associated to the identifier defined in the identifier field and exports it to an AWS S3 bucket for you to access.
  - `requested_at_time` string, date-time — The time when the Subject Access Request was submitted.
  - `sla_deadline_time` string, date-time, nullable — The time by which the Subject Access Request must be completed.
  - `status` 'pending' | 'processing' | 'completed' | 'failure' — The status of the Subject Access Request.

## Other responses

- `400` — Invalid request body content
- `401` — Invalid credentials
- `403` — You do not have permission to create a Subject Access Request for the specified account
- `default` — Unexpected error

---

[API](https://skmtc.dev/optimizely/apis/optimizely-api.md) · [All operations](https://skmtc.dev/optimizely/apis/optimizely-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/optimizely/optimizely-api/revisions/5151fe6a2297/schema)