User Rights: Automating data erasure requests
Learn how to automate personal data erasure requests using the User Rights API.
The User Rights API allows you to automate the deletion of a user's personal data stored across VTEX applications, in compliance with "Right to be Forgotten" regulations.
Instead of manually processing each erasure request, you submit the user's email, receive a job ID, and poll for status updates until the deletion is complete.
This data erasure flow applies only to non-corporate shoppers. It doesn't apply to B2B buyers or Admin users.
This API handles personal data that is standard to the VTEX platform. For custom data stored in Master Data entities, follow the process described in Erasing customer data.
Integration flow
The diagram below illustrates the complete integration flow:
Step 1 - Create a data erasure job
Send a POST request to the Create data erasure job endpoint with the user's email address:
_10curl -X POST "https://{accountName}.vtexcommercestable.com.br/api/user-rights/forget/jobs" \_10 -H "Content-Type: application/json" \_10 -H "Accept: application/json" \_10 -H "X-VTEX-API-AppKey: {appKey}" \_10 -H "X-VTEX-API-AppToken: {appToken}" \_10 -d '{"email": "user@example.com"}'
The response returns a jobId that you will use to track the deletion progress:
_10{_10 "jobId": "550e8400-e29b-41d4-a716-446655440000"_10}
Step 2 - Poll the job status
Do not poll more frequently than once every 30 seconds. Requests that exceed this rate may be throttled.
Send periodic GET requests to the Get data erasure job status endpoint using the jobId from the previous step:
_10curl "https://{accountName}.vtexcommercestable.com.br/api/user-rights/forget/jobs/{jobId}" \_10 -H "Accept: application/json" \_10 -H "X-VTEX-API-AppKey: {appKey}" \_10 -H "X-VTEX-API-AppToken: {appToken}"
The response contains the current status of the job:
_10{_10 "status": "InProgress",_10 "message": "Processing deletion request."_10}
Continue polling until the status field returns either Success or Failed.
Status values
| Status | Description | Action |
|---|---|---|
InProgress | The deletion is still being processed. | Continue polling. |
Success | The user's data has been deleted. | Stop polling. The job is complete. |
Failed | The deletion could not be completed after all retry attempts. | Stop polling. Check the message field for details. |
Behavior details
Keep the following details in mind when integrating with this API:
- Polling interval: We recommend waiting at least 30 seconds between status checks to avoid unnecessary load.
- Automatic retries: The system retries failed internal operations up to 10 times before marking the job as
Failed. You do not need to implement retry logic on your end. - Non-existent emails: If no data is found for the given email, the job completes with
Success. No error is returned. - Job not found: If you query a
jobIdthat does not exist, the API returns a404 Not Foundresponse.