Update GDPR Request

Overview

See the GDPR Requests overview for the full feature flow.

All admin endpoints require an admin Bearer token — see Authentication.

Endpoint	Method
/api/admin/customers/gdpr-requests/{id}	PUT

Pure metadata write — no side effects

For pending → processing / pending → declined use this endpoint. For the destructive cascade (delete customer when type=delete), use Process GDPR Request.

Allowed status values: pending, processing, declined, approved, revoked. Invalid → 422. Updating the status still triggers the status-change notification email.

Permission: customers.gdpr_requests.edit.