File a GDPR erasure request (gdpr:admin, live mode only)

POST 
/api/v1/gdpr/erase

Required scope: gdpr:admin (privileged, isolated — never grantable alongside data scopes; minted only via the Company Portal admin-key dialog). GDPR Art. 17: files a structured deletion request for the company's account with the platform's 30-day processing SLA — the same record the in-app privacy flow creates. This endpoint REQUESTS erasure (202 Accepted); processing is completed by a human administrator within the SLA. Idempotent: while a request is Pending, filing again returns the same request (alreadyPending: true).

Live mode only. A sandbox (pk_test_) key receives a fail-loud 403 CROSS_MODE_DENIED.

Request

Responses

202

The deletion request (created or already pending).

400

400 — INVALID_JSON, VALIDATION_ERROR, or IDEMPOTENCY_KEY_REQUIRED.

401

401 — INVALID_SIGNATURE or SIGNING_NOT_CONFIGURED (or bearer auth failure).

403

FORBIDDEN_SCOPE (no gdpr:admin) or CROSS_MODE_DENIED (sandbox key).

404

404 — not found OR owned by another tenant (NOT_FOUND; IDOR-safe).

429

429 — RATE_LIMITED (per-key limit, reads and writes alike; fails closed, so a limiter outage also returns 429). A limiter-down 429 is deliberately indistinguishable from a quota 429. Carries Retry-After (seconds).

Response Headers

Retry-After

Seconds to wait before retrying (429 only).

RateLimit-Limit

Per-minute request ceiling for this key's tier.

RateLimit-Remaining

Requests left in the current window (floored at 0).

RateLimit-Reset

Seconds until the window resets.

503

503 — the API is not enabled on this environment (FEATURE_DISABLED).