GDPR: Right to Access, Correct, and Erase Data
As per articles 15, 16, 17, and 19 of GDPR, users have the right to get a copy of their personal data you are processing, ask for rectifications if they are inaccurate, and ask you to delete their personal data.
With Auth0, you can access, edit, and delete user information manually, using the Dashboard, or programmatically, using the Management API.
Manual process
You can view, edit, and delete user information at Auth0 Dashboard > User Management > Users. Drill down to a user to view their information. The information you can change is:
Field | How to edit |
---|---|
Click Edit. Set the new email. | |
Email verified | Click Edit at the Εmail field. Click the Set email as verified link. |
Metadata | Both the app_metadata and the user_metadata objects are editable from this screen. Edit the JSON at the Metadata section and save your changes. |
Blocked | Not directly editable. Click Actions > Block User at the top right of this screen. To unblock click Actions > Unblock User. |
Not directly editable. Click Actions > Change Email at the top right of this screen. | |
Password | Not directly editable. Click Actions > Change Password at the top right of this screen. |
To delete a user, click Actions > Delete User.
Programmatic process
You can retrieve, edit, and delete user information using our API. Choose an endpoint that matches your needs:
Retrieve a user using the ID as search criteria
Retrieve a user using the Email as search criteria
Export all users to a file using a long running job
Update a user. Note that not all fields are editable (see the next section). Keep in mind that:
The properties of the new object will replace the old ones. The
user_metadata
andapp_metadata
fields are an exception to this rule. These properties are merged instead of being replaced, though the merge happens only on the first level.If you are updating
email_verified
,phone_verified
,username
, orpassword
, you must set theconnection
parameter.If your are updating
email
orphone_number
, you must set theconnection
and theclient_id
parameters.
Delete a user based on the ID
In order to call any of the API endpoints, you will need an valid access token. This token must have the required permissions per endpoint. Each endpoint at the Management API explorer has a scopes section that lists the scope(s) that the access token must contain in order to access it. Once you know which endpoint you want to access, and you have a valid access token, you are ready to send your request.
Editable data
The following user information can be updated using the API:
blocked
email_verified
email
verify_email
password
phone_number
phone_verified
verify_password
user_metadata
app_metadata
username
The following user information are not editable:
given_name
family_name
name
nickname
picture
Searchable fields
You can search for users using the following:
All the normalized user profile fields
The profile information under the
user_metadata
object:name
nickname
given_name
family_name
You are responsible for ensuring customer is erased or data is updated in any other databases that Auth0 is not connected to.