Erase a customer's personal data
curl -X POST "https://api.summerbase.com/v1/customers/:id/erase" \ -H "Authorization: Bearer sb_..." \ -H "Content-Type: application/json" \ -d '{ "dry_run": true, "erase_identities": [ "backend:alice@example.com" ], "erase_properties": [ "customer.properties.*.*", "subscription.properties.crm.*" ], "keep_properties": [ "customer.properties.backend.industry" ] }'const response = await fetch("https://api.summerbase.com/v1/customers/:id/erase", { method: "POST", headers: { Authorization: "Bearer sb_...", "Content-Type": "application/json", }, body: JSON.stringify({ "dry_run": true, "erase_identities": [ "backend:alice@example.com" ], "erase_properties": [ "customer.properties.*.*", "subscription.properties.crm.*" ], "keep_properties": [ "customer.properties.backend.industry" ] }),})const data = await response.json()Erase a customer’s personal data: the properties and identities you name, in every source’s history, on the customer and on their subscriptions and items. The customer, their subscriptions and their revenue stay.
Name properties as GET /v1/fields does — customer.properties.backend.phone
— with * for any record type, any source or any key:
customer.properties.*.* is everything every source says about the
customer. keep_properties takes back what erase_properties matched.
A * in place of the key never matches signed_up_at or
country_code, which figures are computed from; name one to erase it,
and the customer’s figures change with it.
An identity is erased only from a source your own code or your team writes to, never one a provider such as Stripe syncs — the provider would send it again. Once one is erased, a write naming it creates a new customer rather than reaching this one.
Erased values are deleted for good: gone from every answer within
moments, and from every copy Summerbase keeps within a day, when
completed_at is set. A source
that sends a value again is writing a new one, which is kept. With
dry_run, nothing is erased or stored: the answer is the erasure the
request would make, its id names nothing, and
response_metadata.dry_run is true. A request that matches
nothing is stored all the same, as an erasure of nothing that is
already complete: the record that the request was carried out.
Parameters
Section titled “Parameters”Path Parameters
Section titled “Path Parameters”The customer — a Summerbase id, or a source identity like stripe:cus_123.
Example
backend:acct_4821Query Parameters
Section titled “Query Parameters”Relationships to include in the response instead of fetching separately. A dotted path expands what an expanded record can expand in turn — at most 4 deep, 10 paths a request, and never back to a record already on the path.
Request Body
Section titled “Request Body”object
Answer with what would be erased, and erase nothing.
The customer’s identities to erase, as source:id — backend:alice@example.com.
Each must be this customer’s, from a source your own code or your team
writes to.
The properties to erase, as record.properties.source.key, where the
record is customer, subscription or subscription_item and any of
the three parts may be *. A subscription’s properties are erased on
every subscription the customer has.
Properties to leave alone although erase_properties matched them, in
the same form.
Example
{ "dry_run": true, "erase_identities": [ "backend:alice@example.com" ], "erase_properties": [ "customer.properties.*.*", "subscription.properties.crm.*" ], "keep_properties": [ "customer.properties.backend.industry" ]}Response
Section titled “Response”Returns the customer erasure object.
A customer erasure records one erasure of a customer’s personal data: the properties and identities removed, who asked, and when Summerbase finished removing every copy. It names what was erased and never holds the erased values.
object
When every copy Summerbase keeps had been removed too, or empty while that
is still to happen — within a day of requested_at.
The customer whose data was erased. Expandable.
object
What this customer is worth a year, in the project’s reporting currency,
at today’s rate: mrr, rounded to the cent, times twelve.
When the current churn began — the instant status became churned.
Null while the customer is trialing or active, and cleared when they
come back.
The country the customer is billed in. Expandable.
object
Its ISO 3166-1 alpha-2 code: US, DK.
What it is called, in English: United States, Denmark.
The object’s type, always country.
The country the customer is billed in, by its ISO 3166-1 alpha-2 code —
the country_code property, resolved the same way as name, from the
highest-priority source whose value is a country’s code. Expand country
for its name.
When Summerbase first recorded the customer.
The customer’s address, resolved the same way as name.
The first instant this customer had revenue — when status first became
paying, and what cohort analysis groups by. Set once and kept through
churn and reactivation. Which month it falls in depends on the timezone
being reported in.
The earliest instant anything was asserted about this customer, their subscriptions or their items — the first thing we were told. Set once.
The first instant one of this customer’s subscriptions was live, free or
paying — when status first became one of the two. Set once and kept
through churn.
The customer’s Summerbase id. Anywhere a customer is addressed, one of its identities works too.
What each source calls this customer, as source:id. Any entry addresses it — stripe:cus_123.
What this customer is worth a month, in the project’s reporting currency, at today’s rate, rounded to the cent.
Every kind of revenue counts, each change converted from the currency it was
billed in, so this amount moves when a rate does and when the project’s
reporting currency changes. The same amount a filter on customer.mrr
compares and a list sorted by mrr orders by.
What the customer is called — the name property, resolved to the
highest-priority source that has one. Write properties.name to change it.
The object’s type, always customer.
Your source’s properties on this customer, as they stand now. What you write here is what you read back — another source’s values never appear in it and can never be overwritten through it. properties_by_source has everyone’s.
Every source’s properties on this customer, keyed by source slug — including your own. Read-only: a write only ever reaches the source it is attributed to.
When the customer signed up for the product — the signed_up_at
property, resolved the same way as name. Write
properties.signed_up_at to set it; a billing provider’s source writes
the moment it first saw the customer, and a project’s own source
outranks it. A customer who has signed up and never subscribed is
trialing.
Where the customer stands with us, derived from what is live now: paying,
free, churned, trialing or lead. A subscription is live while its
status is active; paying and free are told apart by mrr, so paying
means on a paid plan, whether or not an invoice has been settled. A customer
with nothing live who has subscribed before is churned; one on a trial, or
who has signed up and never subscribed, is trialing; anyone else is a
lead. A change undone inside the project’s collapse window never happened
to the status either.
Everything they are subscribed to, from every source. Expandable.
A subscription is what a customer is subscribed to, in the one source it
lives in. It is made of items that carry the prices, and its
monthly_amount is what they are worth a month; a customer’s mrr is the
sum over their subscriptions.
object
What this subscription is worth a year, in currency_code:
monthly_amount times twelve.
What this subscription comes to each time it bills: the items still on
it, their net_amount summed per billing interval, longest interval
first. One entry for nearly every subscription; one per interval for a
subscription whose items bill on different ones, such as a yearly fee
beside a monthly one. Its price whatever its status — a trial still has
one. monthly_amount is what it is worth on one footing.
object
The unit these items bill in: day, week, month or year.
How many of interval between charges: 3 and month is quarterly.
The items on this interval summed, each its net_amount, in the
subscription’s currency_code.
A cancellation already booked. It is still in service until then, and
the source says so with status: canceled when it stops.
The currency it bills in. Expandable.
object
Its ISO 4217 code — USD, EUR, DKK.
What it is called, in English: US dollar, Danish krone.
The object’s type, always currency.
The currency it bills in, by its ISO 4217 code.
When the current billing period ends. The next charge is due then, unless a cancellation is booked for it.
The customer who is subscribed. Expandable.
object
What this customer is worth a year, in the project’s reporting currency,
at today’s rate: mrr, rounded to the cent, times twelve.
When the current churn began — the instant status became churned.
Null while the customer is trialing or active, and cleared when they
come back.
The country the customer is billed in. Expandable.
object
Its ISO 3166-1 alpha-2 code: US, DK.
What it is called, in English: United States, Denmark.
The object’s type, always country.
The country the customer is billed in, by its ISO 3166-1 alpha-2 code —
the country_code property, resolved the same way as name, from the
highest-priority source whose value is a country’s code. Expand country
for its name.
When Summerbase first recorded the customer.
The customer’s address, resolved the same way as name.
The first instant this customer had revenue — when status first became
paying, and what cohort analysis groups by. Set once and kept through
churn and reactivation. Which month it falls in depends on the timezone
being reported in.
The earliest instant anything was asserted about this customer, their subscriptions or their items — the first thing we were told. Set once.
The first instant one of this customer’s subscriptions was live, free or
paying — when status first became one of the two. Set once and kept
through churn.
The customer’s Summerbase id. Anywhere a customer is addressed, one of its identities works too.
What each source calls this customer, as source:id. Any entry addresses it — stripe:cus_123.
What this customer is worth a month, in the project’s reporting currency, at today’s rate, rounded to the cent.
Every kind of revenue counts, each change converted from the currency it was
billed in, so this amount moves when a rate does and when the project’s
reporting currency changes. The same amount a filter on customer.mrr
compares and a list sorted by mrr orders by.
What the customer is called — the name property, resolved to the
highest-priority source that has one. Write properties.name to change it.
The object’s type, always customer.
Your source’s properties on this customer, as they stand now. What you write here is what you read back — another source’s values never appear in it and can never be overwritten through it. properties_by_source has everyone’s.
Every source’s properties on this customer, keyed by source slug — including your own. Read-only: a write only ever reaches the source it is attributed to.
When the customer signed up for the product — the signed_up_at
property, resolved the same way as name. Write
properties.signed_up_at to set it; a billing provider’s source writes
the moment it first saw the customer, and a project’s own source
outranks it. A customer who has signed up and never subscribed is
trialing.
Where the customer stands with us, derived from what is live now: paying,
free, churned, trialing or lead. A subscription is live while its
status is active; paying and free are told apart by mrr, so paying
means on a paid plan, whether or not an invoice has been settled. A customer
with nothing live who has subscribed before is churned; one on a trial, or
who has signed up and never subscribed, is trialing; anyone else is a
lead. A change undone inside the project’s collapse window never happened
to the status either.
The customer who is subscribed.
When service stopped, beside status: canceled. Clear it, with status
back to active, to resume a subscription; the same id may be brought
back as often as the source does so.
The subscription’s Summerbase id. Anywhere a subscription is addressed, one of its identities works too.
What each source calls this subscription, as source:id. Any entry addresses it — stripe:cus_123.
The items it is made of, and where the money is. Expandable.
A subscription item is one price on a subscription: a price, a quantity and a
unit amount, billed every interval. Its plan is its price’s. A subscription’s amounts are summed from
its items. Items are usually written with their subscription, as its
items, and can also be changed one at a time.
object
When this item was first recorded.
Whether the item has come off the subscription. When it did is the
effective_at of the write that set this.
What comes off this item’s invoice, in the subscription’s currency,
after every discount the source applies to it has been worked out:
coupons at any level, stacked in the source’s order, restricted to
the products they cover. The item is worth unit_amount × quantity
less this, each interval. Zero is no discount.
When the discount, or the earliest part of it, stops applying, if the
source knows. Information for a reader: the discount comes off when the
source writes a smaller discount_amount, not when this passes.
The item’s Summerbase id. Anywhere an item is addressed, one of its identities works too.
What each source calls this subscription item, as source:id. Any entry addresses it — stripe:cus_123.
The unit this item bills in.
How many intervals between charges.
What this item comes to each time it is billed, in its subscription’s
currency: unit_amount times quantity, less discount_amount.
The object’s type, always subscription_item.
The plan this item is on: its price’s.
What the plan this item is on is called: its price’s.
The price this item is on, when a source named one. Expandable.
object
Whether the price has stopped being offered. Existing subscriptions keep it — what somebody paid for last year does not stop being true when you withdraw the price.
When the price was first seen.
The currency it is listed in, by its ISO 4217 code.
The price’s Summerbase id. Anywhere a price is addressed, one of its identities works too.
What each source calls this price, as source:id. Any entry addresses it — stripe:cus_123.
The unit it bills in. None for a price charged once.
How many intervals between charges.
What the price is called in the source it lives in, when it has a name of its own there — a Stripe price’s nickname. Most have none, and are told apart by their terms.
The object’s type, always price.
The source the price came from. Expandable.
object
When a provider source was given its credential, or empty: a provider source that has not been connected yet or has been disconnected, and every source that is not a provider’s.
When the source was added.
The source’s unique identifier. Records are identified by its slug.
When the last import gave up, or empty when none has since the last one succeeded. The source’s log says why.
How far the running import has got, from 0 to 1, or empty while it does not know yet.
When the import now running began, or empty when none is. Every metric that reads this source’s records is incomplete until it ends.
What the running import is doing, in a sentence: Importing customers, 1,240 of 8,100.
When the last import finished, or empty when none has.
What the source is called, for people reading a screen.
The object’s type, always source.
Where this source sits when resolving name and email. Lower wins, and
the project’s own source starts at the top so a manual correction outranks
a provider sync. It orders nothing else — every other property is
namespaced by source and never arbitrated.
The project the source belongs to.
The provider’s own id for the account the source is connected to:
acct_… for Stripe. Kept through a disconnect, so that connecting
again is checked against it.
The code of the system the source pulls from. custom is a source you
write to yourself, and the only one that accepts writes; stripe is
connected with connect_stripe and fetches for itself.
Whether the connection is to the provider’s test mode rather than a live account; empty while nothing is connected.
How this source’s records are identified — the stripe in
stripe:cus_123. Lowercase letters, digits, hyphens and underscores;
unique within the project and fixed once the source exists, because
integrations hard-code it. A reference shaped like an id is read as one, so
a slug may not look like a UUID.
When the provider’s webhook was installed for this source — by the
connection, or by hand and registered with register_stripe_webhook —
or empty: nothing is connected, or the source is connected without a
webhook and its changes arrive with the hourly reconcile.
Where the provider posts this source’s events: the address of the endpoint a connection installs, and of one to install by hand. Empty for a source whose provider posts no webhooks.
The source the price came from.
The plan the price is on. Expandable.
object
Whether the plan has stopped being offered — the archived property,
resolved to the highest-priority source that says one; Stripe says it
of a product it has archived. Write properties.archived to change it.
Existing subscriptions keep the plan: what somebody paid for last year
does not stop being true when you withdraw it.
When the plan was first seen.
The plan’s Summerbase id. Anywhere a plan is addressed, one of its identities works too.
What each source calls this plan, as source:id. Any entry addresses it — stripe:cus_123.
What the plan is called in a filter, a legend or a breakdown — the
name property, resolved to the highest-priority source that has one.
Write properties.name to change it. Null when no source names it.
The object’s type, always plan.
How many prices are on this plan.
The prices on this plan, in every source. Expandable.
A price is what a subscription item is on, in the source it lives in: a Stripe price, or a plan in a billing system that has no prices. Every price is on one plan, which groups the prices of one thing you sell — monthly and annual, one per currency, or the same plan in two billing systems. A price is created before any subscription item names it.
object
Whether the price has stopped being offered. Existing subscriptions keep it — what somebody paid for last year does not stop being true when you withdraw the price.
When the price was first seen.
The currency it is listed in, by its ISO 4217 code.
The price’s Summerbase id. Anywhere a price is addressed, one of its identities works too.
What each source calls this price, as source:id. Any entry addresses it — stripe:cus_123.
The unit it bills in. None for a price charged once.
How many intervals between charges.
What the price is called in the source it lives in, when it has a name of its own there — a Stripe price’s nickname. Most have none, and are told apart by their terms.
The object’s type, always price.
The source the price came from. Expandable.
object
When a provider source was given its credential, or empty: a provider source that has not been connected yet or has been disconnected, and every source that is not a provider’s.
When the source was added.
The source’s unique identifier. Records are identified by its slug.
When the last import gave up, or empty when none has since the last one succeeded. The source’s log says why.
How far the running import has got, from 0 to 1, or empty while it does not know yet.
When the import now running began, or empty when none is. Every metric that reads this source’s records is incomplete until it ends.
What the running import is doing, in a sentence: Importing customers, 1,240 of 8,100.
When the last import finished, or empty when none has.
What the source is called, for people reading a screen.
The object’s type, always source.
Where this source sits when resolving name and email. Lower wins, and
the project’s own source starts at the top so a manual correction outranks
a provider sync. It orders nothing else — every other property is
namespaced by source and never arbitrated.
The project the source belongs to.
The provider’s own id for the account the source is connected to:
acct_… for Stripe. Kept through a disconnect, so that connecting
again is checked against it.
The code of the system the source pulls from. custom is a source you
write to yourself, and the only one that accepts writes; stripe is
connected with connect_stripe and fetches for itself.
Whether the connection is to the provider’s test mode rather than a live account; empty while nothing is connected.
How this source’s records are identified — the stripe in
stripe:cus_123. Lowercase letters, digits, hyphens and underscores;
unique within the project and fixed once the source exists, because
integrations hard-code it. A reference shaped like an id is read as one, so
a slug may not look like a UUID.
When the provider’s webhook was installed for this source — by the
connection, or by hand and registered with register_stripe_webhook —
or empty: nothing is connected, or the source is connected without a
webhook and its changes arrive with the hourly reconcile.
Where the provider posts this source’s events: the address of the endpoint a connection installs, and of one to install by hand. Empty for a source whose provider posts no webhooks.
The source the price came from.
The plan the price is on.
How an item’s unit amount is arrived at on this price.
What one unit is listed at per interval: for a metered price, one unit
of usage. None for a tiered one, whose units cost what their tier says.
Excludes tax.
The plan the price is on.
How an item’s unit amount is arrived at on this price.
What one unit is listed at per interval: for a metered price, one unit
of usage. None for a tiered one, whose units cost what their tier says.
Excludes tax.
The price this item is on, when a source named one.
What the price this item is on is called, when a source named one.
How the unit amount is arrived at.
Your source’s properties on this subscription item, as they stand now. What you write here is what you read back — another source’s values never appear in it and can never be overwritten through it. properties_by_source has everyone’s.
Every source’s properties on this subscription item, keyed by source slug — including your own. Read-only: a write only ever reaches the source it is attributed to.
How many units at this unit amount. A decimal, because a unit is not always a whole seat: a billing system that meters usage sends 1.5 of something, and rounding it would misstate what the item is worth.
The subscription this is an item of. Expandable.
object
The subscription this is an item of.
What one unit costs per interval. Excludes tax and any discount.
What this subscription is worth a month, in currency_code, after the
items’ discounts — derived, not reported. The sum of what its items
are worth; zero while it is on trial, paused or ended, and zero on a
free plan. A customer’s mrr is these summed across their subscriptions, in
the reporting currency.
The object’s type, always subscription.
The source this subscription lives in — the only one that may write its own fields. Any source may attach properties and identities to it. Expandable.
object
When a provider source was given its credential, or empty: a provider source that has not been connected yet or has been disconnected, and every source that is not a provider’s.
When the source was added.
The source’s unique identifier. Records are identified by its slug.
When the last import gave up, or empty when none has since the last one succeeded. The source’s log says why.
How far the running import has got, from 0 to 1, or empty while it does not know yet.
When the import now running began, or empty when none is. Every metric that reads this source’s records is incomplete until it ends.
What the running import is doing, in a sentence: Importing customers, 1,240 of 8,100.
When the last import finished, or empty when none has.
What the source is called, for people reading a screen.
The object’s type, always source.
Where this source sits when resolving name and email. Lower wins, and
the project’s own source starts at the top so a manual correction outranks
a provider sync. It orders nothing else — every other property is
namespaced by source and never arbitrated.
The project the source belongs to.
The provider’s own id for the account the source is connected to:
acct_… for Stripe. Kept through a disconnect, so that connecting
again is checked against it.
The code of the system the source pulls from. custom is a source you
write to yourself, and the only one that accepts writes; stripe is
connected with connect_stripe and fetches for itself.
Whether the connection is to the provider’s test mode rather than a live account; empty while nothing is connected.
How this source’s records are identified — the stripe in
stripe:cus_123. Lowercase letters, digits, hyphens and underscores;
unique within the project and fixed once the source exists, because
integrations hard-code it. A reference shaped like an id is read as one, so
a slug may not look like a UUID.
When the provider’s webhook was installed for this source — by the
connection, or by hand and registered with register_stripe_webhook —
or empty: nothing is connected, or the source is connected without a
webhook and its changes arrive with the hourly reconcile.
Where the provider posts this source’s events: the address of the endpoint a connection installs, and of one to install by hand. Empty for a source whose provider posts no webhooks.
The source this subscription lives in — the only one that may write its own fields. Any source may attach properties and identities to it.
Your source’s properties on this subscription, as they stand now. What you write here is what you read back — another source’s values never appear in it and can never be overwritten through it. properties_by_source has everyone’s.
Every source’s properties on this subscription, keyed by source slug — including your own. Read-only: a write only ever reaches the source it is attributed to.
When Summerbase first recorded it. Never set by a caller.
When the subscription began — derived, not reported.
It is the earliest instant anything was asserted about the subscription or
its items. A source cannot say it began earlier than it described it: send
the earliest write with effective_at at the real start instead, which is
what an import of history does anyway.
It moves earlier when a later write describes an earlier moment.
Where it is in its life. Not whether it has been paid for.
When the trial ends, or ended. A subscription that trials starts
trialing, so when it began is started_at and its status history.
The customer whose data was erased.
The slug of the source each erased identity came from, one entry per identity. The identities themselves are not kept.
Each property erased, as record.properties.source.key. A property is
listed once however many values it held.
The erasure’s unique identifier.
The object’s type, always customer_erasure.
When the erasure was asked for. Erased values were gone from every answer moments after.
Who asked for the erasure, when a person did. Empty when an API key did. Expandable.
object
When the account was created.
The email address the account signs in with.
The user’s unique identifier.
The name on the account.
The provider the account signs in with, or null for email and password.
The object’s type, always user.
Who asked for the erasure, when a person did. Empty when an API key did.
Example
{ "completed_at": null, "customer_id": "0199a7c2-4e1b-7f38-b9d2-5a6c8e0f1d73", "erased_identity_sources": [ "backend" ], "erased_properties": [ "customer.properties.backend.phone", "customer.properties.stripe.name" ], "id": "019a1f04-7c2d-7b3e-8a5f-1e2d3c4b5a69", "object": "customer_erasure", "requested_at": "2026-10-25T09:12:40Z", "requested_by_id": null}