Create Privacy Request

privacy.requests.create(source = "merchant_api", external_ref = Idempotency-Key) → 201; a repeated

POST/v1/stores/{store_id}/privacy-requestsScope privacy:write

Scope: privacy:write (scopes and plan access)
Rate limit: 600 requests/min per API key (test keys: 60/min); 100 privacy requests/day per store (rate limits)

`privacy.requests.create(source = "merchant_api", external_ref = Idempotency-Key)` → `201`; a repeated key → `200` with the existing request. The `Idempotency-Key` is required (03 §2.9 / §6.16, 15 §13: it is the request's `external_ref`); a missing or malformed key → `422 validation_error`.

Parameters

Parameters of Create Privacy Request
Name	In	Type	Description
store_idrequired	path	string
Idempotency-Keyrequired	header	string	Replays return the original

Request body (PrivacyRequestCreate)

Request body of Create Privacy Request
Field	Type	Description
subjectrequired	PrivacySubject	Who the request is about — at least one key.
subject.conversation_id	string	pattern `^conv_[0-9a-hjkmnp-tv-z]{26}$`
subject.email	string	format email · ≤ 254 characters
subject.platform_customer_id	string	1–128 characters
subject.visitor_id	string	1–64 characters
typerequired	"export" \| "delete"

Example request

curl -X POST "https://api.shopassist.coec.dk/v1/stores/sto_01j8000000e008000000000000/privacy-requests" \
  -H "Authorization: Bearer $SHOPASSIST_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"subject":{"conversation_id":"conv_01j8000000e008000000000000","email":"shopper@example.com","platform_customer_id":"string","visitor_id":"string"},"type":"export"}'

Response 200 (MerchantPrivacyRequest)

Response of Create Privacy Request
Field	Type	Description
completed_atrequired	string \| null	format date-time
created_atrequired	string	format date-time
download_urlrequired	string \| null	Signed /v1/public/files/… URL (15 min) of a completed export; else nullformat uri · ≤ 2048 characters
due_atrequired	string	format date-time
idrequired	string	pattern `^prq_[0-9a-hjkmnp-tv-z]{26}$`
sourcerequired	string (enum)	one of dashboard, merchant_api, shopify_customers_data_request, shopify_customers_redact, shopify_shop_redact, woocommerce, prestashop, magento2, operator
statsrequired	object
statusrequired	"received" \| "processing" \| "completed" \| "failed" \| "cancelled"
subject_summaryrequired	string	Masked, e.g. "email j***@example.com", "customer 4711"
typerequired	"export" \| "delete"

{
  "completed_at": "2026-09-28T10:15:30.123Z",
  "created_at": "2026-09-28T10:15:30.123Z",
  "download_url": "https://shop.example/products/linen-shirt",
  "due_at": "2026-09-28T10:15:30.123Z",
  "id": "prq_01j8000000e008000000000000",
  "source": "dashboard",
  "stats": {},
  "status": "received",
  "subject_summary": "string",
  "type": "export"
}

Errors

Every error uses the error envelope; the code field is stable.

400 Bad Request
401 Unauthorized
403 Forbidden
404 Not Found
422 Unprocessable Content
429 Too Many Requests