Run a delete request
const url = 'https://qinto-api.blotout.io/teams/7b8d1a52-6c1e-4b6f-9a30-2f8a54d1c3e9/domains/3f2a9c81-5d47-4e0b-8c66-91b2a7f04d15/visitor-data/delete';const options = { method: 'POST', headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'}, body: '{"value":"ada@example.com","reference":"TICKET-42"}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://qinto-api.blotout.io/teams/7b8d1a52-6c1e-4b6f-9a30-2f8a54d1c3e9/domains/3f2a9c81-5d47-4e0b-8c66-91b2a7f04d15/visitor-data/delete \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: application/json' \ --data '{ "value": "ada@example.com", "reference": "TICKET-42" }'Erases the whole person one value from an end user’s GDPR request belongs to, on this site and on every site that shares its visitor data, and asks the installed apps to erase the person too. It cannot be undone; preview the value first.
How it works
The value is looked up again when the request runs, so the result does not depend on an earlier preview. Each run is recorded in the activity log with the counts and your reference, never the value. partly_deleted means the erase stopped partway: send the same value again to finish it. A second run erases only what is left.
Required permissions
domain:visitor_data:writeon all domains, or on the addressed domain when its id is in the route
Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Path Parameters
Section titled “Path Parameters”Unique id (UUID) of the team that owns the addressed resources, as shown in the team settings on the Blotout platform.
Example
7b8d1a52-6c1e-4b6f-9a30-2f8a54d1c3e9Unique id (UUID) of the team that owns the addressed resources, as shown in the team settings on the Blotout platform.
Unique id (UUID) of the site, as returned by the site operations.
Example
3f2a9c81-5d47-4e0b-8c66-91b2a7f04d15Unique id (UUID) of the site, as returned by the site operations.
Request Bodyrequired
Section titled “Request Bodyrequired”The value to erase, and an optional reference.
The value to erase, and an optional reference.
object
One value from the end user’s request: an anon id, a person id (gid_), an email address, a phone number in international format (leading +), or a custom id. The kind is detected from the value.
Example
ada@example.comYour own reference for the request, such as a ticket number. It is stored in the activity log entry; omit it or send it blank for none.
Example
TICKET-42Responses
Section titled “Responses”What was erased, and how many app installs were asked to erase the person.
object
The kind of value the Blotout platform detected: an anon id, a person id, or an email, phone or custom id alias.
The identity-graph objects erased, or that a delete request would erase, by type. A second run of the same value counts only what the first one left.
object
How many anons (browser profiles).
How many aliases (email, phone and custom id mappings).
How many person records, 0 or 1.
True when the site stores no data about the value; every count is then 0.
The sites that share this site’s identity graph through a storage link, the link parent first. The erase affects all of them. Empty when no other site shares the graph.
A site that shares the identity graph.
object
The site’s id.
The site’s hostname.
How many app installs were asked to erase the person.
The reference as stored, trimmed; null when none was sent.
Example
{ "inputType": "anon", "counts": { "anons": 2, "aliases": 2, "persons": 1 }, "nothingStored": false, "sharedSites": [ { "domainId": "3f2a9c81-5d47-4e0b-8c66-91b2a7f04d15", "domain": "shop.example.com" } ], "installsNotified": 2, "reference": "TICKET-42"}invalid_params — A path parameter failed validation (for example a malformed UUID); details pinpoints the offending parameter. invalid_body — The JSON body is unparseable or failed schema validation; details pinpoints the offending fields when the body could be parsed.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Field-level validation errors: a tree keyed by input property, each node carrying an errors array of human-readable messages. Render it to help the caller correct the request.
object
Example
{ "error": "invalid_params", "details": { "errors": [], "properties": { "teamId": { "errors": [ "Invalid UUID" ] } } }}unauthenticated — The Authorization: Bearer token is missing, malformed, or no longer valid. Generate a team API token or obtain a new OAuth access token.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Example
{ "error": "unauthenticated"}forbidden — The bearer credential lacks the required permission or belongs to another team, or its user lacks the organization role a developer operation needs. Update its policies, use a credential bound to the addressed team, or ask an organization owner for the role; message states the reason when one is known.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Human-readable reason for this specific failure, intended for display — do not parse it programmatically.
Example
{ "error": "forbidden", "message": "The Cloudflare API token is invalid or expired."}not_found — The addressed resource does not exist within this team; check the id and retry.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Example
{ "error": "not_found"}not_deployed — The site has never been deployed, so it has no host to describe yet. Deploy it, then retry. worker_outdated — The site runs a worker from before delete requests, so nothing was read or erased. Deploy the site, then retry.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Example
{ "error": "not_deployed"}host_not_ready — The site’s host is not ready to serve it — no Cloudflare zone chosen, no stored API token, a token scoped to the wrong zone, a conflicting DNS record, or a dispatcher that refused the request. message names the fix.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Human-readable reason for this specific failure, intended for display — do not parse it programmatically.
Example
{ "error": "host_not_ready", "message": "The Cloudflare API token is invalid or expired."}internal — Unexpected server error. Nothing is guaranteed to have been persisted; idempotent operations are safe to retry.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Example
{ "error": "internal"}worker_unreachable — The site’s own worker could not be reached or refused the request, so nothing could be read from it; message says what failed. Retry once the site is serving again. partly_deleted — The site’s worker stopped the erase before it finished, so part of the data may already be erased. The app installs were still asked to erase the person. Send the same value again to finish it; a second run erases only what is left.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Example
{ "error": "worker_unreachable"}