A valid request URL is required to generate request examples{
"contact_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"environment": "live",
"generated_at": "2023-11-07T05:31:56Z",
"sections": [
{
"table": "<string>",
"action": "delete",
"reason": "<string>",
"total": 123,
"truncated": true,
"rows": [
{}
]
}
],
"withheld": [
{
"table": "<string>",
"action": "delete",
"reason": "<string>"
}
],
"gateway_references": [
{
"kind": "subscription",
"provider": "stripe",
"provider_account_id": "acct_123",
"provider_id": "sub_123",
"customer_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}
],
"notice": "<string>"
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}Export everything held about one contact
Requires customers:read. Answers a data subject access request: everything this system holds about one person, as one document.
It is on customers:read rather than on a permission of its own, because the export is a read of one contact — the same contact the same seat already reads at GET /v1/organization/contacts/{id}. What earns a permission of its own is the destruction, not the reading.
The document
sections is one entry per table, each carrying the rows, the total, and the reason that table is treated the way it is — the prose is part of the answer, not commentary on it. withheld names the tables that are deliberately absent and says why: an outstanding verification token or magic link is a live credential, and an export travels through a helpdesk and a mailbox, so handing one over would be a worse leak than the request was about. Credential columns that do appear are reported present and redacted rather than omitted, because “we hold this and will not hand it to you” is a different statement from “we hold no such thing”.
A section over 5000 rows is truncated, and says so on the section (truncated, with the true total).
What is not ours
gateway_references lists the payment provider’s own identifiers — customer, subscription, invoice — for the teams this contact belongs to. UserKit does not act on them: the merchant account belongs to the organization, deleting or anonymising a record there is performed in the provider’s own console under whatever retention their accounting is subject to. Take this before requesting an erasure: afterwards the membership is gone and nothing here can find them again.
The act is recorded in the audit log as contact.exported, with who did it and from where — reading one person’s whole history changes nothing, which is exactly why it would otherwise leave no trace.
A valid request URL is required to generate request examples{
"contact_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"environment": "live",
"generated_at": "2023-11-07T05:31:56Z",
"sections": [
{
"table": "<string>",
"action": "delete",
"reason": "<string>",
"total": 123,
"truncated": true,
"rows": [
{}
]
}
],
"withheld": [
{
"table": "<string>",
"action": "delete",
"reason": "<string>"
}
],
"gateway_references": [
{
"kind": "subscription",
"provider": "stripe",
"provider_account_id": "acct_123",
"provider_id": "sub_123",
"customer_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}
],
"notice": "<string>"
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}Autorizações
A staff session token, uk_st_…. Minted by sign-up, sign-in or the two-factor exchange. Only a 401 means it is spent; not_a_member (403) is about the organization named in X-Organization-Id and leaves the token good for the others.
Cabeçalhos
The organization the caller is acting on — the org_… code that appears in the panel URL. It identifies; the membership JOIN is what authorizes, so a forged code reads nothing: the answer is not_a_member (403), which does not mean the session is over. Absent, the session's default organization answers, or — if that membership was revoked while the session was open — any other one the caller still holds.
Parâmetros de caminho
Parâmetros de consulta
Which environment to act in. A view parameter, valid only on the staff surface — a machine credential never chooses its environment, it is resolved from the key.
live, test Resposta
The export.
live, test One per table, in the order the erasure would act on them.
Show child attributes
Show child attributes
Tables deliberately absent, each with the reason.
Show child attributes
Show child attributes
Identifiers at the organization's payment gateway. Listed, never acted on.
Show child attributes
Show child attributes
Why the gateway identifiers are listed rather than acted on.