Erase a customer's personal data

const options = {
  method: 'POST',
  headers: {'x-spree-api-key': '<api-key>', Authorization: 'Bearer <token>'}
};

fetch('http://{defaultHost}/api/v3/admin/customers/{id}/anonymize', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

{
  "id": "cust_UkLWZg9DAJ",
  "email": "anonymized-87c6bfa6-4803-420c-a5e2-b1c962f0f40a@invalid",
  "first_name": "Redacted",
  "last_name": "Redacted",
  "phone": null,
  "accepts_email_marketing": false,
  "email_marketing_consent_updated_at": "2026-01-15T12:00:00Z",
  "full_name": "Redacted Redacted",
  "available_store_credit_total": "0",
  "display_available_store_credit_total": "$0.00",
  "failed_attempts": 0,
  "metadata": {},
  "email_marketing_consent_source": "anonymization",
  "created_at": "2026-01-15T12:00:00.000Z",
  "updated_at": "2026-01-15T12:00:00.000Z",
  "anonymized_at": "2026-01-15T12:00:00Z",
  "anonymized": true,
  "tags": [],
  "internal_note": null,
  "internal_note_html": null,
  "default_billing_address_id": null,
  "default_shipping_address_id": null,
  "orders_count": 0,
  "total_spent": "0.0",
  "display_total_spent": "$0.00",
  "last_order_completed_at": null,
  "customer_group_ids": []
}

Erase a customer's personal data

Carries out a GDPR right-to-erasure request (Art. 17). Personal data is replaced across the account, its addresses, the address snapshots on past orders, saved cards, connected identities and live sessions.

Orders, payments and tax records are kept — they carry their own retention obligation — with the personal details removed. The country, state and a truncated postal code survive on order addresses so the tax jurisdiction of a past sale stays provable.

Irreversible.

Required scope: write_customers (for API-key authentication).

POST

api

admin

customers

{id}

anonymize

Erase a customer's personal data

const options = {
  method: 'POST',
  headers: {'x-spree-api-key': '<api-key>', Authorization: 'Bearer <token>'}
};

fetch('http://{defaultHost}/api/v3/admin/customers/{id}/anonymize', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

{
  "id": "cust_UkLWZg9DAJ",
  "email": "anonymized-87c6bfa6-4803-420c-a5e2-b1c962f0f40a@invalid",
  "first_name": "Redacted",
  "last_name": "Redacted",
  "phone": null,
  "accepts_email_marketing": false,
  "email_marketing_consent_updated_at": "2026-01-15T12:00:00Z",
  "full_name": "Redacted Redacted",
  "available_store_credit_total": "0",
  "display_available_store_credit_total": "$0.00",
  "failed_attempts": 0,
  "metadata": {},
  "email_marketing_consent_source": "anonymization",
  "created_at": "2026-01-15T12:00:00.000Z",
  "updated_at": "2026-01-15T12:00:00.000Z",
  "anonymized_at": "2026-01-15T12:00:00Z",
  "anonymized": true,
  "tags": [],
  "internal_note": null,
  "internal_note_html": null,
  "default_billing_address_id": null,
  "default_shipping_address_id": null,
  "orders_count": 0,
  "total_spent": "0.0",
  "display_total_spent": "$0.00",
  "last_order_completed_at": null,
  "customer_group_ids": []
}

Authorizations

x-spree-api-key

string

header

required

Secret API key for admin access

Authorization

string

header

required

JWT token for admin user authentication

Headers

x-spree-api-key

string

required

Path Parameters

string

required

Response

200 - application/json

customer anonymized

string

anonymized

boolean

anonymized_at

string | null

⌘I

API basics

Endpoints

Erase a customer's personal data

Authorizations

Headers

Path Parameters

Response