Data Subject Request API

The Branch Data Subject Request API supports you with two key components of data protection laws like the General Data Protection Regulation 2016/679 (GDPR) and the California Consumer Privacy Act (CCPA)—the right to access personal data and the right to request deletion of personal data (also known as the right to be forgotten).

Read the Data Subject Request API overview

Request access or erasure

POST/gdpr

This endpoint accesses any personal data associated with known given identities from Branch Metrics.

Parameters

subject_request_typeenumRequired
The type of POST request being sent. In this case, "access".
accesserasure
subject_identitiesarray of objectExpandable

Returns

Success. Returns 400, 404, and 429 on failure — see the response panel for the error shape.

app_id*Access-Token*

curl 'https://api2.branch.io/v1/gdpr?app_id=%3Capp_id%3E' \
  --request POST \
  --header 'Access-Token: <Access-Token>' \
  --header 'Content-Type: application/json' \
  --data '{
    "subject_request_type": "access",
    "subject_identities": [
      {
        "identity_type": "DEVICE_ID",
        "identity_value": "XXXX-0000-xxxx",
        "identity_format": "raw"
      }
    ]
  }'

Response

Success.

{
  "request_id": "XXXX-0000-xxxx",
  "request_status": "SUCCESS"
}

Request download or status

POST/gdpr/status

Gets the current status of the request for the given request_id generated from the access or erasure POST request.