Delete a visitor's data
Erase one shopper's data on request, for your privacy obligations. Secret key only, and no visitor token: this is your server acting on the shopper's behalf, and a shopper exercising deletion has usually lost the token already.
Removes the visitor's uploaded photos, area sets and renders — the documents and the stored files both. Afterwards their history is empty and their result URLs stop resolving. Candidate keys derived from the deleted records are removed as well; if stored files cannot be removed after the records are deleted, the response is a 500 and the affected keys are written to the server log.
Usage counts are RETAINED with the visitor detached: the metered rows are what your invoice is reconciled against, and after this call they no longer reference the shopper.
Idempotent. Calling it again — or for a visitor that never existed on your instance — is a 200 with every count zero, never a 404. Retry freely.
Two residuals to know about. First, derived preprocessing files on the rendering host (depth, normal, segmentation and mask data) are outside this endpoint and age out on that host's own schedule, within 90 days. Second, the visitor token is not revoked: it is stateless and keeps verifying until its own expiry, so discard it in your storefront — an upload that still presents it would create new data under the same vis_ id.
Authorization
secretKey Secret key (server-side only), sent as Authorization: Bearer sk_…. This is the higher API-key tier: it satisfies routes requiring either the pk or sk tier. On pk-level routes no Origin header is required, and any forwarded Origin is ignored. The secret key satisfies the API-key tier only; it does not bypass visitor-token requirements, instance scoping, quotas or metering, or any other route-specific authorization. Routes requiring the sk tier remain secret-key-only, including administrative surfaces such as SKU alias registration, the origin allowlist, usage, and visitor deletion.
In: header
Path Parameters
The vis_… public id of the shopper to delete, from the visitor block an upload returned. It is the id, not the token — the token is the shopper's credential and is never sent here.
Response Body
application/json
application/problem+json
application/problem+json
application/problem+json
application/problem+json
curl -X DELETE "https://example.com/visitors/vis_5nQ8xR2wKt7bZm3LpVdC"{ "visitor": "vis_5nQ8xR2wKt7bZm3LpVdC", "deleted": { "images": 0, "areaSets": 0, "renders": 0, "objects": 0 }, "usageRecordsDetached": 0}