Revoke a GDPR Request
About
The revokeGdprRequest mutation withdraws a GDPR data request the customer raised earlier. Revoking sets the request's status to revoked and stamps revokedAt. A request can only be revoked while it is still pending or processing — once it has been declined or approved it can no longer be revoked. The result carries a one-time successMessage.
Authentication
This mutation requires an authenticated customer — send the storefront key and a customer Bearer token. See the Authentication page.
GDPR must be enabled
If GDPR data requests are disabled in the store's admin configuration, the mutation fails with the message "GDPR data requests are disabled. Please enable GDPR from the admin configuration." in errors[]. The feature has been turned off on the admin side.
Input Fields
| Field | Type | Required | Description |
|---|---|---|---|
id | ID! | ✅ Yes | The request IRI, e.g. /api/shop/gdpr-requests/12. |
Possible Returns
| Field | Type | Description |
|---|---|---|
gdprRequest._id | Int! | Numeric request ID. |
gdprRequest.type | String! | Request type: delete or update. |
gdprRequest.status | String! | Request status — revoked after a successful revoke. |
gdprRequest.message | String | The message supplied in the request. |
gdprRequest.email | String! | Email address tied to the request. |
gdprRequest.revokedAt | DateTime | Timestamp when the request was revoked. |
gdprRequest.createdAt | DateTime! | Request creation timestamp. |
gdprRequest.updatedAt | DateTime! | Request last update timestamp. |
gdprRequest.successMessage | String | Confirmation message — present on create / revoke / delete results. |
gdprRequest.customer | Customer! | The customer who owns the request. |
gdprRequest.customer._id | Int! | Numeric customer ID of the owner. |