> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cometly.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Delete Contact PII

> Permanently scrub a contact's personally identifiable information, by contact ID or by email

## Overview

This endpoint permanently scrubs the personally identifiable information (PII) stored for a contact, while preserving the contact record itself and its event history for reporting continuity.

You can target the contact either of two ways:

* **By path ID**: `DELETE /contacts/{id}/pii`
* **By email**: `DELETE /contacts/pii?email={email}`

Exactly one of `id` or `email` must be provided — supplying both, or neither, returns a `422`.

This is an **asynchronous** operation. The request validates and resolves the target contact synchronously, then queues the actual scrub and returns immediately with `202 Accepted`. The PII removal itself typically completes within a few minutes; call [Get Contact](/api-reference/endpoint/get-contact) afterward to confirm the fields have been cleared.

### What gets deleted

* All emails, phones, names, locations, devices, IPs, tracking IDs, and comet tokens ever associated with the contact — including data inherited from profiles that were merged into this contact.
* All raw browsing-session hits for the contact (IPs, fingerprints, tokens, and URL query strings). After this completes, `include_browsing_session_data` on [Get Contact](/api-reference/endpoint/get-contact) returns empty, and the contact's page-view hits no longer contribute to analytics counts.
* On the contact record itself: `name`, `email`, `phone`, `location`, `city`, `state`, `country`, `device_type`, `os`, `browser`, `language`, and all 30 custom fields (`profile_field_1`–`profile_field_30`) are set to `null`.

### What is kept

* The contact record itself — its `id` and `created_at` are preserved.
* Its events and journey — touchpoints and conversions, including their metadata, remain intact.
* Its merge history.

<Warning>
  Event metadata can still contain PII that arrived inside a webhook payload or a touchpoint's URL query string — deleting a contact's PII does not scrub individual events. To remove PII from a specific event, delete it directly via [Delete Event](/api-reference/endpoint/delete-event).
</Warning>

## Path Parameters

<ParamField path="id" type="integer">
  The unique identifier of the contact whose PII should be deleted. Required when not using `email`. Merged profile aliases are automatically resolved to the current canonical contact. Minimum: 1.
</ParamField>

## Query Parameters

<ParamField query="email" type="string">
  The email address of the contact whose PII should be deleted. Required when not using `id`. Matches against both the contact's full email history (including emails inherited from merged profiles) and its current primary email. If more than one distinct contact matches the email, the request is rejected with a `409` — delete by `id` instead to disambiguate.
</ParamField>

## Response

### Success Response

Returns `202 Accepted`. The scrub is queued, not yet complete.

<ResponseField name="contact_id" type="integer">
  The canonical contact id (after resolving merged-profile aliases) whose PII was queued for deletion.
</ResponseField>

<ResponseField name="status" type="string">
  Always `queued`.
</ResponseField>

<ResponseField name="message" type="string">
  Human-readable confirmation that the deletion has been queued.
</ResponseField>

### Error Response

<ResponseField name="message" type="string">
  Error description explaining what went wrong.
</ResponseField>

<ResponseField name="contact_ids" type="integer[]">
  Only present on a `409` response. The sorted list of canonical contact ids that matched the given `email`. Nothing is deleted when this error is returned — retry the request once per `id` to disambiguate.
</ResponseField>

## Example Requests

### Delete by Contact ID

<CodeGroup>
  ```bash cURL theme={null}
  curl -X DELETE "https://app.cometly.com/public-api/v1/contacts/12345/pii" \
    -H "Authorization: Bearer YOUR_API_KEY" \
    -H "Accept: application/json"
  ```

  ```javascript JavaScript theme={null}
  const contactId = 12345;
  const response = await fetch(`https://app.cometly.com/public-api/v1/contacts/${contactId}/pii`, {
    method: 'DELETE',
    headers: {
      'Authorization': 'Bearer YOUR_API_KEY',
      'Accept': 'application/json'
    }
  });

  const data = await response.json();
  console.log('Deletion queued:', data);
  ```

  ```php PHP theme={null}
  <?php
  $contactId = 12345;
  $url = 'https://app.cometly.com/public-api/v1/contacts/' . $contactId . '/pii';
  $headers = [
      'Authorization: Bearer YOUR_API_KEY',
      'Accept: application/json'
  ];

  $ch = curl_init();
  curl_setopt($ch, CURLOPT_URL, $url);
  curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'DELETE');
  curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
  curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

  $response = curl_exec($ch);
  $result = json_decode($response, true);
  curl_close($ch);
  ?>
  ```

  ```python Python theme={null}
  import requests

  contact_id = 12345
  url = f'https://app.cometly.com/public-api/v1/contacts/{contact_id}/pii'
  headers = {
      'Authorization': 'Bearer YOUR_API_KEY',
      'Accept': 'application/json'
  }

  response = requests.delete(url, headers=headers)
  result = response.json()
  ```
</CodeGroup>

### Delete by Email

<CodeGroup>
  ```bash cURL theme={null}
  curl -X DELETE "https://app.cometly.com/public-api/v1/contacts/pii?email=john%40example.com" \
    -H "Authorization: Bearer YOUR_API_KEY" \
    -H "Accept: application/json"
  ```

  ```javascript JavaScript theme={null}
  const email = 'john@example.com';
  const response = await fetch(`https://app.cometly.com/public-api/v1/contacts/pii?email=${encodeURIComponent(email)}`, {
    method: 'DELETE',
    headers: {
      'Authorization': 'Bearer YOUR_API_KEY',
      'Accept': 'application/json'
    }
  });

  const data = await response.json();
  console.log('Deletion queued:', data);
  ```

  ```php PHP theme={null}
  <?php
  $email = 'john@example.com';
  $url = 'https://app.cometly.com/public-api/v1/contacts/pii?' . http_build_query(['email' => $email]);
  $headers = [
      'Authorization: Bearer YOUR_API_KEY',
      'Accept: application/json'
  ];

  $ch = curl_init();
  curl_setopt($ch, CURLOPT_URL, $url);
  curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'DELETE');
  curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
  curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

  $response = curl_exec($ch);
  $result = json_decode($response, true);
  curl_close($ch);
  ?>
  ```

  ```python Python theme={null}
  import requests

  email = 'john@example.com'
  url = 'https://app.cometly.com/public-api/v1/contacts/pii'
  headers = {
      'Authorization': 'Bearer YOUR_API_KEY',
      'Accept': 'application/json'
  }

  response = requests.delete(url, headers=headers, params={'email': email})
  result = response.json()
  ```
</CodeGroup>

## Status Codes

| Status Code | Description                                                                                     |
| ----------- | ----------------------------------------------------------------------------------------------- |
| 202         | PII deletion successfully queued                                                                |
| 401         | Missing or invalid API key                                                                      |
| 403         | API key doesn't have permission or subscription is inactive                                     |
| 404         | Contact not found (unknown `id` or no contact matches `email`)                                  |
| 409         | Multiple contacts match the given `email` — see `contact_ids` in the response and retry by `id` |
| 422         | Invalid parameters (both `id` and `email` provided, neither provided, or invalid format)        |
| 429         | Too many requests - rate limit exceeded. See [Rate Limiting](/introduction/rate-limiting)       |

## Notes

* **Rate Limit**: This endpoint has a limit of **60 requests per minute** per Space. See [Rate Limiting](/introduction/rate-limiting) for details.
* **Not idempotent on missing targets**: unlike [Delete Event](/api-reference/endpoint/delete-event), which returns `200` for an ID that no longer exists, this endpoint returns `404` when the `id` or `email` doesn't resolve to a contact in your space.
* **Asynchronous**: a `202` response means the deletion has been queued, not completed. Poll [Get Contact](/api-reference/endpoint/get-contact) to confirm the PII fields have been cleared.
* **Ambiguous email matches nothing**: if `email` matches more than one distinct contact, the request is rejected with `409` and no data is deleted. Look up the individual contact ids (via `contact_ids` in the response, or [List Contacts](/api-reference/endpoint/list-contacts)) and call this endpoint once per `id`.
* **Merged profiles**: if you pass an `id` that was merged into another profile, the deletion applies to the canonical (current) profile.

<Note>
  This operation is permanent and cannot be undone. The contact record, its events, and its merge history are preserved — only identifying data is scrubbed.
</Note>