API Design · Senior · Question 48 of 75

How should an API handle personal data to support privacy requirements like GDPR?

1Return all fields to be safe
2Store personal data in query strings
✓Correct answer: Return only needed fields, support data export and deletion endpoints, avoid personal data in URLs and logs, and document retention

Explanation

URLs end up in logs, analytics and referrers, so keep personal data in bodies or headers.

Further reading

Test yourself

Take the API Design · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.