Privacy operations act on a user ID and require a normal authenticated user session. They are application controls that can support a privacy program; they are not by themselves a legal-compliance certification.
GET /api/privacy/export/{user_id}
Exports the user’s email and creation time plus organization memberships, login events, OAuth identities, MFA events, and passkeys.
A user may export their own data. A different user may export it only when they are a platform owner or an owner of every organization to which the target user belongs. This prevents one tenant owner from exporting data associated with a second tenant.
const data = await sso.privacy.exportData(userId);
DELETE /api/privacy/forget/{user_id}
Anonymizes the target account while retaining the audit evidence the runtime is designed to preserve. This action is irreversible.
Self-service deletion must include either current_password or mfa_code in
the JSON body. Cross-user deletion requires the same platform-owner or
all-organizations ownership rule as export. Platform-owner accounts cannot be
anonymized through this endpoint.
await sso.privacy.forgetUser(currentUserId, {
current_password: passwordConfirmation,
});
The response contains success, message, and user_id. Record application
consent and confirmation separately, avoid logging the confirmation secret, and
require reauthentication before exposing this action in a UI.
Export shape
Nullable event metadata remains null; it is not converted to an empty string.
MFA event exports include nullable details, and passkey exports include
nullable name, aaguid, and last_used_at.
Treat exports as sensitive personal data: authorize download immediately before delivery, use TLS, avoid durable public URLs, and apply an explicit retention policy outside AuthOS.