---
title: "Advance a GDPR data-subject request through its lifecycle."
method: POST
path: "/v1/compliance/gdpr/requests/{id}/status"
tags: ["Compliance"]
---

# Advance a GDPR data-subject request through its lifecycle.

`POST /v1/compliance/gdpr/requests/{id}/status`

## Request

- Base URL: `https://api.scalix.world`
- URL: `https://api.scalix.world/v1/compliance/gdpr/requests/{id}/status`
- Auth: HTTP bearer

SEC-1: the DSR flow was intake-only — requests sat `pending` forever with no
way to fulfill them, while the compliance status implied a working workflow.
A data-protection officer (compliance:write) now moves each request through
pending → in_progress → completed/rejected; terminal states stamp
`completed_at`, giving an auditable fulfillment record within the GDPR Art.
12(3) one-month window. Tenant-scoped.

## Path parameters

- `id` string, required

## Request body

- UpdateGdprStatusBody
  - `status` 'pending' | 'in_progress' | 'completed' | 'rejected', required

## Response `200`

Updated data-subject request

- DataSubjectRequest
  - `id` string, uuid, required
  - `tenant_id` string, required
  - `subject_email` string, required
  - `request_type` 'export' | 'erasure' | 'rectification' | 'access', required
  - `status` 'pending' | 'in_progress' | 'completed' | 'rejected', required
  - `notes` string, nullable
  - `created_at` string, date-time, required
  - `completed_at` string, date-time, nullable

## Other responses

- `401`: Missing or invalid credentials
- `403`: Token lacks the compliance:write scope
- `404`: GDPR request not found
- `500`: Internal error

---

[API](https://skmtc.dev/scalix/apis/scalix-cloud-api.md) · [All operations](https://skmtc.dev/scalix/apis/scalix-cloud-api/llms.txt) · [OpenAPI document](https://skmtc.dev/scalix/apis/scalix-cloud-api/revisions/2c04ca0a90bb?raw)