Vulnerability in EPiServer.Forms

Try our conversational search powered by Generative AI!

Philipp Gaska
Jul 8, 2021
(1 votes)

Right to be forgotten: Deleting recipient data

Data security and protecting the privacy of your customers and newsletter recipients is vital important. With the introduction of the General Data Protection Regulation (GDPR) at the latest, you must provide the possibility of deleting personal data upon request. This is embodied in Article 17 of the GDPR – the so-called "Right to be forgotten".

To irrevocably delete all recipient data from Episerver Campaign (except blocklist entries which is anonymized data), you can use the recipient history in the Episerver Campaign user interface.

A more flexible way is using the Episerver Campaign REST API. This lets you delete recipient data remotely – without logging in to Episerver Campaign. You can, for example, use the Swagger Try it out feature, enter the curl request in the Windows command prompt, or implement a deletion option right into your system, such as a CRM software.

To delete recipient data via REST API, use the DELETE /{clientId}​/recipients operation.

You need the following information:

  • Client ID. The ID of the client the REST API is set up for. You can find the client ID in Episerver Campaign under Administration > API Overview > REST API.
  • Reason. Reason for data deletion.
  • Recipient key. Recipient ID, usually the email address.

The request in curl looks as follows:

curl -X DELETE "" -H "Authorization: BASIC k783r3fjn989dhnfjjdr83dgds1383NDfv="

The following example shows the request as PHP code.

Note: The PHP code is a basic example and is not ready to use in your live system. Use it only as a template for testing and adapt the code to your company's internal requirements.
$user = ''; // API user name, usually your email address 
$password = 'password'; // password of your API user
$clientId = 123456789; // ID of the client the REST API is set up for
$recipientId = ''; // ID of the recipient whose data is to be deleted
$reason = 'customerrequest'; // reason for data deletion (without blanks)
$URL = ''.$clientId.'/recipients?recipientKey='.$recipientId.'&reason='.$reason;

$curl = curl_init();
curl_setopt($curl, CURLOPT_URL,$URL);
curl_setopt($curl, CURLOPT_CUSTOMREQUEST, "DELETE");
curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($curl, CURLOPT_TIMEOUT, 30); //timeout after 30 seconds
curl_setopt($curl, CURLOPT_RETURNTRANSFER,1);
curl_setopt($curl, CURLOPT_USERPWD, "$user:$password");

$result = curl_exec ($curl);
$result = json_decode($result, true);
echo '<pre>';
var_dump ($result);
echo '</pre><br>';

curl_close ($curl);       

Tip: To delete the recipient's blocklist entry, you can use the DELETE​/{clientId}​/blacklistentries​/{entry} operation.
Jul 08, 2021


Please login to comment.
Latest blogs
A day in the life of an Optimizely Developer - Optimizely CMS 12: The advantages and considerations when exploring an upgrade

GRAHAM CARR - LEAD .NET DEVELOPER, 28 Nov 2023 In 2022, Optimizely released CMS 12 as part of its ongoing evolution of the platform to help provide...

Graham Carr | Nov 28, 2023

A day in the life of an Optimizely Developer - OptiUKNorth Meetup January 2024

It's time for another UK North Optimizely meet up! After the success of the last one, Ibrar Hussain (26) and Paul Gruffydd (Kin + Carta) will be...

Graham Carr | Nov 28, 2023

Publish content to Optimizely CMS using a custom GPT from OpenAI 🤖

Do you find the traditional editor interface complicated and cluttered? Would you like an editorial AI assistant you can chat with? You can!

Tomas Hensrud Gulla | Nov 28, 2023 | Syndicated blog

Optimizely Graph and Next.js: Building Scalable Headless Solutions

Optimizely Graph harnesses the capabilities of GraphQL, an intuitive and efficient query language to, transform content within an Optimizely CMS in...

Szymon Uryga | Nov 27, 2023

Getting Started with Optimizely SaaS Core and Next.js Integration: Testing Content Updates

The blog post discusses the challenges of content updates on a website using Optimizely CMS, Next.js, and the Apollo Client due to Apollo's local...

Francisco Quintanilla | Nov 27, 2023 | Syndicated blog

Performance optimization – the hardcore series – part 4

Let’s take a break from the memory allocation, and do some optimization on another aspect, yet as important (if not even more important) – database...

Quan Mai | Nov 25, 2023 | Syndicated blog