> For the complete documentation index, see [llms.txt](https://help.branch.io/llms.txt).

# Data Subject Request API

The Branch Data Subject Request API supports you with two key components of data protection laws like the General Data Protection Regulation 2016/679 (GDPR) and the California Consumer Privacy Act (CCPA)—the right to access personal data and the right to request deletion of personal data (also known as the right to be forgotten).

[Read the Data Subject Request API overview](https://help.branch.io/apidocs/data-subject-request/overview.md)

## Request access or erasure

`POST https://api2.branch.io/v1/gdpr`

This endpoint accesses any personal data associated with known given identities from Branch Metrics.

### Parameters

- `subject_request_type` (enum, required) — The type of POST request being sent. In this case, "access". One of `access`, `erasure`.
- `subject_identities` (array of object)
- `subject_identities.identity_type` (enum, required) — The type of identity being sent. It can be "BROWSER_ID", "DEVICE_ID", "USER_ID", or "DEVELOPER_ID". One of `BROWSER_ID`, `DEVICE_ID`, `USER_ID`, `DEVELOPER_ID`.
- `subject_identities.identity_value` (string) — The value as per the identity_type, IDFA, Google_advertising_id, etc.
- `subject_identities.identity_format` (string, required) — To be sent as "raw". Branch currently only supports "raw".

### Responses

- `200` — Success.
- `400` — Bad request—typically an invalid or missing credential or parameter.
- `404` — Not found or incorrect API URL.
- `429` — Rate limit exceeded—reduce request frequency and retry.

### Returns

Success. Returns `400`, `404`, and `429` on failure — see the response panel for the error shape.

### Example request

```bash
curl 'https://api2.branch.io/v1/gdpr?app_id=%3Capp_id%3E' \
  --request POST \
  --header 'Access-Token: <Access-Token>' \
  --header 'Content-Type: application/json' \
  --data '{
    "subject_request_type": "access",
    "subject_identities": [
      {
        "identity_type": "DEVICE_ID",
        "identity_value": "XXXX-0000-xxxx",
        "identity_format": "raw"
      }
    ]
  }'
```

### Example responses

`200`

```json
{
  "request_id": "XXXX-0000-xxxx",
  "request_status": "SUCCESS"
}
```

`400`

```json
{
  "error": {
    "message": "Authentication failed.",
    "code": 400
  }
}
```

`429`

```json
{
  "error": {
    "code": 429,
    "message": "Rate limit reached."
  }
}
```

## Request download or status

`POST https://api2.branch.io/v1/gdpr/status`

Gets the current status of the request for the given request_id generated from the access or erasure POST request.

### Parameters

- `request_id` (string) — The UUID generated for the request made. This can be used to check the status of the request at a later time.

### Responses

- `200` — Success.
- `400` — Bad request—typically an invalid or missing credential or parameter.
- `429` — Rate limit exceeded—reduce request frequency and retry.

### Returns

Success. Returns `400` and `429` on failure — see the response panel for the error shape.

### Example request

```bash
curl 'https://api2.branch.io/v1/gdpr/status?app_id=%3Capp_id%3E' \
  --request POST \
  --header 'Access-Token: <Access-Token>' \
  --header 'Content-Type: application/json' \
  --data '{
    "request_id": "XXXX-0000-xxxx"
  }'
```

### Example responses

`200`

```json
{
  "request_id": "XXXX-0000-xxxx",
  "request_status": "SUCCESS",
  "request_type": "ACCESS",
  "export_url": "https://branch-exports-usw2.s3.amazonaws.com/unique-csv-file-name-here.csv?Signature=SIGNATURE%3D&AWSAccessKeyId=AWS_ACCESS_KEY&Expires=EXPIRATION"
}
```

`400`

```json
{
  "error": {
    "message": "Authentication failed.",
    "code": 400
  }
}
```

`429`

```json
{
  "error": {
    "code": 429,
    "message": "Rate limit reached."
  }
}
```