# Visitors

> Erase everything Fingerly holds about one visitor, for a data subject's deletion request, and follow each erasure until it is done. Admin keys only.

Last updated: 2026-09-29

Erase a visitor when somebody asks you to delete their data. This is **Erase this visitor** on an event in the dashboard, from code, so a deletion request your own systems handle can reach Fingerly too. Only **admin** management keys can erase; a developer key answers `403`.

**Path parameter**

- `organization_id` (string, required): Your organization, from [Describe the key](https://docs.fingerly.io/reference/management/overview#describe-the-key). A path naming any other organization answers `404`.

## Erase a visitor

```http
DELETE /api/v1/management/organizations/{organization_id}/visitors/{visitor_id}
```

Authentication: Management key (`x-api-key: fly_mk_…`)

**Path parameter**

- `visitor_id` (string, required): The `visitor_id` from an identification.

Answers `202` with the erasure. What happens, and when:

- At once: the visitor's identity, so a device that comes back is a new visitor, and the webhook events that name it, including ones not yet delivered.
- Within the hour: its stored identifications, their deferred reports and its [archived submissions](https://docs.fingerly.io/docs/data-retention#archived-submissions).
- Kept: totals already folded into your dashboards, which hold no visitor ID.

Asking again while an erasure is `pending` returns that one. A visitor ID your organization never saw is accepted and erases nothing, so an erasure is safe to send for any ID a person gives you.

> **Note:** In an app, also call `deleteStoredIdentity()` on the device. That removes the install ID the device is recognised by, which lives on the device and not with Fingerly. See [account deletion and erasure](https://docs.fingerly.io/docs/app-store-privacy#account-deletion-and-erasure).

## List visitor erasures

```http
GET /api/v1/management/organizations/{organization_id}/visitor-erasures
```

Authentication: Management key (`x-api-key: fly_mk_…`)

The last hundred erasures, newest first.

**Response**

- `erasures` (VisitorErasure[]): Each erasure.
  - `id` (string): The erasure's ID.
  - `visitor_id` (string): The visitor it erases.
  - `status` (string): `pending` while stored events and archived submissions are being removed, then `done`.
  - `requested_at` (string): When it was asked for. The visitor's identity was removed at this moment.
  - `completed_at` (string): When everything else was removed. Omitted while `pending`.

## Errors

| Status | Code | When |
| --- | --- | --- |
| `403` | `insufficient_role` | The key is a developer key. |
| `422` | `invalid_visitor_id` | The ID is not a visitor ID: visitor IDs are 20 letters and digits. |

## Example request

```bash Erase
curl -X DELETE "https://api.fingerly.io/api/v1/management/organizations/01a0a7f2-3c18-7b40-8d2e-5f6a9b1c0d37/visitors/X9pL2mRc7KvT4bQw8NdF" \
  -H "x-api-key: $FINGERLY_MANAGEMENT_KEY"
```

```bash List
curl "https://api.fingerly.io/api/v1/management/organizations/01a0a7f2-3c18-7b40-8d2e-5f6a9b1c0d37/visitor-erasures" \
  -H "x-api-key: $FINGERLY_MANAGEMENT_KEY"
```

## Example response

```json 202
{
  "id": "01a0a864-9a51-7d23-b4f6-9c0d1e2f3a4b",
  "visitor_id": "X9pL2mRc7KvT4bQw8NdF",
  "status": "pending",
  "requested_at": "2026-09-29T14:03:11Z"
}
```

```json 200
{
  "erasures": [
    {
      "id": "01a0a864-9a51-7d23-b4f6-9c0d1e2f3a4b",
      "visitor_id": "X9pL2mRc7KvT4bQw8NdF",
      "status": "done",
      "requested_at": "2026-09-29T14:03:11Z",
      "completed_at": "2026-09-29T14:21:47Z"
    }
  ]
}
```

```json 422
{
  "error": {
    "code": "invalid_visitor_id",
    "message": "that is not a visitor identifier",
    "status": 422
  },
  "request_id": "01a0a84c-0f11-7a3e-9c2d-4b5e6f708192"
}
```