A valid request URL is required to generate request examples{
"exportedAt": "2026-07-28T09:00:00.000Z",
"profile": {
"id": "cust-1",
"name": "Camille Renard",
"email": "camille.renard@example.com",
"phone": "06 12 34 56 78",
"tier": "Or",
"postalCode": "75011",
"points": 1240,
"spend": 842.5,
"orders": 17,
"optIn": true
},
"consent": {
"marketingOptIn": true
},
"purchases": [
{
"ticketId": "tkt-2026-0142",
"number": "T-2026-0142",
"storeId": "store-paris-11",
"recordedAt": "2026-07-14T10:32:05.000Z",
"totalCents": 3600,
"paymentMethod": "card"
}
]
}{
"error": {
"code": "VALIDATION_FAILED",
"message": "<string>",
"statusCode": 123,
"fieldErrors": [
{
"field": "<string>",
"message": "<string>"
}
]
}
}{
"error": {
"code": "VALIDATION_FAILED",
"message": "<string>",
"statusCode": 123
}
}{
"error": {
"code": "VALIDATION_FAILED",
"message": "<string>",
"statusCode": 123
}
}{
"error": {
"code": "VALIDATION_FAILED",
"message": "<string>",
"statusCode": 123
}
}{
"error": {
"code": "VALIDATION_FAILED",
"message": "<string>",
"statusCode": 123
}
}Export a customer's personal data (GDPR)
Assembles the full dossier held for one data subject — profile, marketing-consent standing and every settled ticket reference — for a GDPR portability request. It only READS, but it requires pos.customers.privacy, NOT the ordinary customer write grant: assembling a subject’s whole dossier is a disclosure, and at scale it is the larger breach surface of the two data-subject verbs. That key is in no role bundle — it is granted per named person who handles data-subject requests. The call is audited. Prefer getCustomerPurchases when you just need the buying history. 404s for an unknown id.
A valid request URL is required to generate request examples{
"exportedAt": "2026-07-28T09:00:00.000Z",
"profile": {
"id": "cust-1",
"name": "Camille Renard",
"email": "camille.renard@example.com",
"phone": "06 12 34 56 78",
"tier": "Or",
"postalCode": "75011",
"points": 1240,
"spend": 842.5,
"orders": 17,
"optIn": true
},
"consent": {
"marketingOptIn": true
},
"purchases": [
{
"ticketId": "tkt-2026-0142",
"number": "T-2026-0142",
"storeId": "store-paris-11",
"recordedAt": "2026-07-14T10:32:05.000Z",
"totalCents": 3600,
"paymentMethod": "card"
}
]
}{
"error": {
"code": "VALIDATION_FAILED",
"message": "<string>",
"statusCode": 123,
"fieldErrors": [
{
"field": "<string>",
"message": "<string>"
}
]
}
}{
"error": {
"code": "VALIDATION_FAILED",
"message": "<string>",
"statusCode": 123
}
}{
"error": {
"code": "VALIDATION_FAILED",
"message": "<string>",
"statusCode": 123
}
}{
"error": {
"code": "VALIDATION_FAILED",
"message": "<string>",
"statusCode": 123
}
}{
"error": {
"code": "VALIDATION_FAILED",
"message": "<string>",
"statusCode": 123
}
}Authorizations
Authorization: Bearer <token>. Accepts EITHER a Keycloak access token (scopes-in-token) OR an opaque POS session token; both resolve to the same pos.* scope vocabulary the route guards enforce.
Path Parameters
The customer id to act on, e.g. cust-1 (client Customer.id).
1