# Create Privacy Request

> privacy.requests.create(source = "merchant_api", external_ref = Idempotency-Key) → 201; a repeated

Source: https://shopassist.coec.dk/docs/api/reference/privacy/create-privacy-request · Updated 2026-11-03

`POST /v1/stores/{store_id}/privacy-requests`

- Scope: `privacy:write`
- Rate limit: 600 requests/min per API key (test keys: 60/min); 100 privacy requests/day per store

`privacy.requests.create(source = "merchant_api", external_ref = Idempotency-Key)` → `201`; a repeated
key → `200` with the existing request.

The `Idempotency-Key` is required (03 §2.9 / §6.16, 15 §13: it is the request's `external_ref`); a missing
or malformed key → `422 validation_error`.

## Parameters [#parameters]

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `store_id` | path | `string` | yes |  |
| `Idempotency-Key` | header | `string` | yes | Replays return the original |

## Request body (PrivacyRequestCreate) [#request-body]

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `subject` | `PrivacySubject` | yes | Who the request is about — at least one key. |
| `subject.conversation_id` | `string` | no | pattern `^conv_[0-9a-hjkmnp-tv-z]{26}$` |
| `subject.email` | `string` | no | format email · ≤ 254 characters |
| `subject.platform_customer_id` | `string` | no | 1–128 characters |
| `subject.visitor_id` | `string` | no | 1–64 characters |
| `type` | `"export" \| "delete"` | yes |  |

## Example request [#example-request]

```bash
curl -X POST "https://api.shopassist.coec.dk/v1/stores/sto_01j8000000e008000000000000/privacy-requests" \
  -H "Authorization: Bearer $SHOPASSIST_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"subject":{"conversation_id":"conv_01j8000000e008000000000000","email":"shopper@example.com","platform_customer_id":"string","visitor_id":"string"},"type":"export"}'
```

## Response 200 (MerchantPrivacyRequest) [#response]

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `completed_at` | `string \| null` | yes | format date-time |
| `created_at` | `string` | yes | format date-time |
| `download_url` | `string \| null` | yes | Signed /v1/public/files/… URL (15 min) of a completed export; else null · format uri · ≤ 2048 characters |
| `due_at` | `string` | yes | format date-time |
| `id` | `string` | yes | pattern `^prq_[0-9a-hjkmnp-tv-z]{26}$` |
| `source` | `string (enum)` | yes | one of dashboard, merchant_api, shopify_customers_data_request, shopify_customers_redact, shopify_shop_redact, woocommerce, prestashop, magento2, operator |
| `stats` | `object` | yes |  |
| `status` | `"received" \| "processing" \| "completed" \| "failed" \| "cancelled"` | yes |  |
| `subject_summary` | `string` | yes | Masked, e.g. "email j***@example.com", "customer 4711" |
| `type` | `"export" \| "delete"` | yes |  |

```json
{
  "completed_at": "2026-09-28T10:15:30.123Z",
  "created_at": "2026-09-28T10:15:30.123Z",
  "download_url": "https://shop.example/products/linen-shirt",
  "due_at": "2026-09-28T10:15:30.123Z",
  "id": "prq_01j8000000e008000000000000",
  "source": "dashboard",
  "stats": {},
  "status": "received",
  "subject_summary": "string",
  "type": "export"
}
```

## Errors [#errors]

| Status | Meaning |
| --- | --- |
| 400 | Bad Request ([error codes](/docs/api/errors)) |
| 401 | Unauthorized ([error codes](/docs/api/errors)) |
| 403 | Forbidden ([error codes](/docs/api/errors)) |
| 404 | Not Found ([error codes](/docs/api/errors)) |
| 422 | Unprocessable Content ([error codes](/docs/api/errors)) |
| 429 | Too Many Requests ([error codes](/docs/api/errors)) |