Open a data request

const options = {
  method: 'POST',
  headers: {
    'x-spree-api-key': '<api-key>',
    Authorization: 'Bearer <token>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    current_password: '<string>',
    redirect_url: 'https://myshop.com/account/data-requests/confirm'
  })
};

fetch('http://{defaultHost}/api/v3/store/customers/me/data_requests', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

curl --request POST \
  --url http://{defaultHost}/api/v3/store/customers/me/data_requests \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'x-spree-api-key: <api-key>' \
  --data '
{
  "current_password": "<string>",
  "redirect_url": "https://myshop.com/account/data-requests/confirm"
}
'

{
  "id": "dsr_UkLWZg9DAJ",
  "number": "DSR1001",
  "kind": "access",
  "status": "awaiting_confirmation",
  "requested_at": "2026-01-15T12:00:00Z",
  "completed_at": null,
  "expires_at": null,
  "download_url": null
}

{
  "error": {
    "code": "current_password_invalid",
    "message": "Current password is invalid or missing"
  }
}

Open a data request

Opens a GDPR request for a copy of the customer’s personal data (access) or its erasure (erasure). Nothing happens until the request is confirmed from the link emailed to the account’s address: the response is the request awaiting confirmation, and the link opens redirect_url with the confirmation token appended. The work then happens in the background.

An erasure request requires the account password. A request of the same kind that is still in flight is returned instead of starting a second one, and a request still awaiting confirmation sends the email again.

POST

/

api

/

v3

/

store

/

customers

/

me

/

data_requests

Open a data request

const options = {
  method: 'POST',
  headers: {
    'x-spree-api-key': '<api-key>',
    Authorization: 'Bearer <token>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    current_password: '<string>',
    redirect_url: 'https://myshop.com/account/data-requests/confirm'
  })
};

fetch('http://{defaultHost}/api/v3/store/customers/me/data_requests', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

curl --request POST \
  --url http://{defaultHost}/api/v3/store/customers/me/data_requests \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'x-spree-api-key: <api-key>' \
  --data '
{
  "current_password": "<string>",
  "redirect_url": "https://myshop.com/account/data-requests/confirm"
}
'

{
  "id": "dsr_UkLWZg9DAJ",
  "number": "DSR1001",
  "kind": "access",
  "status": "awaiting_confirmation",
  "requested_at": "2026-01-15T12:00:00Z",
  "completed_at": null,
  "expires_at": null,
  "download_url": null
}

{
  "error": {
    "code": "current_password_invalid",
    "message": "Current password is invalid or missing"
  }
}

Authorizations

x-spree-api-key

string

header

required

Publishable API key for store access

Authorization

string

header

required

JWT token for authenticated customers

Headers

x-spree-api-key

string

required

Authorization

string

required

Body

application/json

kind

enum<string>

Defaults to access.

Available options:

access,

erasure

current_password

string

Required for erasure.

redirect_url

string<uri>

The storefront page the confirmation link opens, with the token appended. Ignored unless it matches one of the store's allowed origins.

Example:

"https://myshop.com/account/data-requests/confirm"

Response

request accepted

id

string

required

number

string

required

kind

enum<string>

required

Available options:

access,

erasure

status

required

The values listed are the built-in ones; extensions may add more.

Available options:

awaiting_confirmation,

pending,

processing,

completed,

failed,

lapsed

requested_at

string | null

required

completed_at

string | null

required

expires_at

string | null

required

download_url

string | null

required

⌘I