List GDPR requests

GET/v1/gdpr/requests

US Region: https://public-api.sessionboard.com · EU Region: https://public-api-eu.sessionboard.com

Returns the organization's GDPR data access and erasure requests, newest first.

The response is a bare JSON array, not a results envelope. This page previously showed an envelope; the endpoint has always returned the array.

Paginated with page and pageSize (default 25, maximum 100). Keep requesting pages until one comes back with fewer than pageSize entries.

Both parameters are validated. A page or pageSize outside its documented range, and any query parameter this operation does not declare, are rejected with a 400. Out-of-range values used to be accepted and silently clamped.

Request example

curl --request GET \
  --url 'https://public-api.sessionboard.com/v1/gdpr/requests' \
  --header 'x-access-token: <api-token>'

const response = await fetch('https://public-api.sessionboard.com/v1/gdpr/requests', {
  method: 'GET',
  headers: {
    "x-access-token": "<api-token>"
  },
});

const data = await response.json();
console.log(data);

import requests

response = requests.request(
    "GET",
    "https://public-api.sessionboard.com/v1/gdpr/requests",
    headers={
        "x-access-token": "<api-token>"
    },
)

print(response.json())

<?php

$curl = curl_init();

curl_setopt_array($curl, [
    CURLOPT_URL => "https://public-api.sessionboard.com/v1/gdpr/requests",
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => "GET",
    CURLOPT_HTTPHEADER => [
        "x-access-token: <api-token>",
    ],
]);

$response = curl_exec($curl);
curl_close($curl);

echo $response;

package main

import (
  "fmt"
  "io"
  "net/http"
)

func main() {
  req, _ := http.NewRequest("GET", "https://public-api.sessionboard.com/v1/gdpr/requests", nil)
  req.Header.Add("x-access-token", "<api-token>")

  res, _ := http.DefaultClient.Do(req)
  defer res.Body.Close()
  body, _ := io.ReadAll(res.Body)

  fmt.Println(string(body))
}

HttpRequest request = HttpRequest.newBuilder()
    .uri(URI.create("https://public-api.sessionboard.com/v1/gdpr/requests"))
    .header("x-access-token", "<api-token>")
    .method("GET", HttpRequest.BodyPublishers.noBody())
    .build();

HttpResponse<String> response = HttpClient.newHttpClient()
    .send(request, HttpResponse.BodyHandlers.ofString());

System.out.println(response.body());

Try it

Response headers

Authorizations

x-access-tokenstringheader
Organization API token. Generate from Organization Settings → API Tokens.
AuthorizationBearer <token>headeror
OAuth 2.1 access token. Obtained via the OAuth PKCE flow at /oauth/token.

Send one of these. See Authentication.

Query parameters

pageintegerquery
1-based page number, 1 to 999. Outside that range is a 400.
Default
1
Minimum
1
Maximum
999
pageSizeintegerquery
Requests per page, 1 to 100. Outside that range is a 400; values above 100 are no longer clamped.
Default
25
Minimum
1
Maximum
100

Responses

200`application/json`

responseGDPRRequest[]
Show child attributes
- idstring
  Identifier of the stored request. Quote this when evidencing a DSAR.
- org_idstring
- request_typestring
  Allowed values
  "erasure", "access"
- identity_typestring
  Allowed values
  "email"
- identity_valuestring
- statusstring
  Outcome of the request.
  
  complete — at least one record matched and was processed.
  
  no_records_found — nothing in this organization matched the email, so nothing was erased.
  
  pending — the request is stored but has not finished processing.
  Allowed values
  "complete", "no_records_found", "pending"
- matching_user_existsboolean
  True when the email matched at least one record of any kind.
- responseobject
  What the request matched and what happened to it. people, users_scrubbed, users_retained and counts are present on requests processed recently and absent on older records; an absent field means "not recorded", not "zero".
  Show child attributes
  - usersinteger[]
    User accounts identified for this email.
  - org_usersstring[]
    Organization membership records removed.
  - event_usersinteger[]
    Event participation records removed.
  - contact_recordsstring[]
    Contact records marked deleted.
  - peoplestring[]
    Person records whose personal data was scrubbed in place.
  - users_scrubbedinteger[]
    User accounts whose personal data was de-identified.
  - users_retainedobject[]
    User accounts left intact because they still belong to another organization, with the reason recorded.
  - countsobject
    Per-category totals for the arrays above.
    Show child attributes
    org_usersinteger
    event_usersinteger
    contact_recordsinteger
    peopleinteger
    users_identifiedinteger
    users_scrubbedinteger
    users_retainedinteger
- created_atstring
- updated_atstring

400

page or pageSize is outside its documented range, or an undeclared query parameter was sent.

401

Unauthorized

Response examples

[
  {
    "id": "<string>",
    "org_id": "<string>",
    "request_type": "erasure",
    "identity_type": "email",
    "identity_value": "<string>",
    "status": "complete",
    "matching_user_exists": true,
    "response": {
      "users": [
        123
      ],
      "org_users": [
        "<string>"
      ],
      "event_users": [
        123
      ],
      "contact_records": [
        "<string>"
      ],
      "people": [
        "<string>"
      ],
      "users_scrubbed": [
        123
      ],
      "users_retained": [
        {}
      ],
      "counts": {
        "org_users": 123,
        "event_users": 123,
        "contact_records": 123,
        "people": 123,
        "users_identified": 123,
        "users_scrubbed": 123,
        "users_retained": 123
      }
    },
    "created_at": "<string>",
    "updated_at": "<string>"
  }
]