Data Deletion Requests

Use this endpoint to queue anonymization of a visitor (aka a subscriber or user) by email for a specific site.

Available Endpoints

Important Behavior

• This endpoint queues anonymization for the matched visitor record. Treat the 202 Accepted response as "accepted for processing," not as proof that all internal and external systems have completed updates.
• Bento clears the visitor/subscriber email on the primary record and runs follow-up cleanup jobs for related records. Some records may be retained where required or permitted by law, for security and abuse prevention, dispute handling, unpaid amounts, and ordinary backup processes.
• Integrations can recreate visitors/subscribers later if they send the same email again. This includes Stripe, Shopify, webhook replays, imports, and other inbound workflows. This is important as if you delete an unsubscriber you may recreate their profile again.
• Before deletion, back up any business-critical state you may need to preserve, such as unsubscribe status, abuse notes, and custom fields.
• Bento may retain operational metadata required for reliability and security, such as logs, job telemetry, and abuse or rate-limit signals, subject to applicable law and retention controls.

Rate Limit

1,000 requests per day.

Create Request

Submit an email to queue anonymization. The email must exist on the specified site.

Required Attributes

• site_uuid (string): Site identifier used for auth scope.
• data_deletion_request[email] (string): Visitor email to anonymize.

Example Request

curl -X POST "https://app.bentonow.com/api/v1/data_deletion_requests" \
  -u "publishable_key:secret_key" \
  -d "site_uuid=YOUR_SITE_UUID" \
  -d "data_deletion_request[email]=user@example.com"

Responses

• 202 Accepted

{ "status": "queued_for_anonymization" }

• 404 Not Found

{ "error": "visitor_not_found" }

• 422 Unprocessable Entity

Validation or model update errors may be returned if the record cannot be queued.

Operational Recommendations

• Pause or mute upstream sources before deletion where possible (for example Stripe/Shopify syncs, webhook replays, or import jobs).
• If you require irreversible deletion, validate your full data map first, including Bento, your downstream processors, your own systems, and any sync paths that could re-introduce identifiers.
• Store your own audit snapshot before calling deletion if compliance requires exact before/after reconstruction.
• If your workflow depends on long-term suppression, combine deletion with external suppression controls in your own systems.