---
schema_version: "1"
id: f52a1093b64c22271f4fef40b078373990e2c84911aeb28194105c188cc10e90
title: Customer API
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/commerce-cloud/retail-cloud/reference/generated-api-specs/customer-api.md
canonical_url: https://developer.salesforce.com/docs/commerce/retail-cloud/references/customer-api
source_site: developer.salesforce.com
content_type: documentation
content_hash: 81cfcb3ff3e870bd75df307d7a01a30e16b3011c7f34fb4a5287a053a01ae1c7
products:
  - Point of Sale for Developers
  - Salesforce APIs
---
Customer API

# Customer API

[Download specification](https://developer.salesforce.com/static/commercecloud/retail-cloud/customer-api/customer-api-oas-public.yaml)

Merchant API to manage customer data in the POS system.

**Version:** 2.3.4

## Tags

### Customer API

[Download specification](https://developer.salesforce.com/static/commercecloud/retail-cloud/customer-api/customer-api-oas-public.yaml)

Merchant API to manage customer data in the POS system.

## Operations

### POST Mask customer data.

`POST /merchant/{version}/customer/mask`

Operation ID: `maskCustomerData`. Tags: Mask Customer Data, Customer API.

Administrative API to mask specific customer data to satisfy CCPA/GDPR requirements. Customer records are identified by customer ID or email address, and PII fields are replaced with mask characters across all relevant data stores.

The following categories of customer data are masked:

*   **Names** — first name, last name, middle name, initials
*   **Contact information** — email addresses, phone numbers
*   **Addresses** — billing and shipping addresses, including street, city, state/province, ZIP/postal code, and country
*   **Demographic information** — gender, age, date of birth
*   **Payment information** — credit card numbers, card type, expiration dates, billing address
*   **Loyalty and consent** — loyalty enrollment data and related consents
*   **Identification numbers** — driver's license, national ID, and similar identifiers

Masking is applied across relational databases (MySQL), NoSQL databases (DynamoDB), caches (Redis), and data warehouses (Redshift). Object storage (S3) is covered by TTL policies.

Masking is asynchronous. The response returns a `requestId` and an `IN_PROGRESS` status. Use the request ID to poll for completion.

#### Parameters

*   `version` (path, string, required) Supported: v1.  
    Pattern: v1|v2.

#### Responses

*   **default** Default response.
    
    Media type: `application/json`. Schema: `CustomerMaskResponse`.
    

## Schemas

### CustomerMaskResponse

*   `requestId` (_string_) Unique identifier for this masking request.  
    Example: `e7966181-88a6-4247-9261-0ef0f35eb336`.
*   `customerCount` (_integer (int32)_) Number of customer records included in the masking request.  
    Example: `2`.
*   `status` (_string_)
    
    Current status of the masking request.
    
    *   `IN_PROGRESS` — Masking is running asynchronously.
    *   `SUCCESSFUL` — All specified customer records have been masked.
    *   `FAILED` — Masking failed. See `errorCode` and `errorMessage` for details.
    
      
    Allowed values: `IN_PROGRESS`, `SUCCESSFUL`, `FAILED`.
*   `requestedOn` (_integer (int64)_) Unix timestamp (milliseconds) indicating when the masking request was submitted.  
    Example: `1746136132000`.
*   `errorCode` (_string_) Machine-readable error code. Present only when `status` is `FAILED`.  
    Example: `MISSING_ID`.
*   `errorMessage` (_string_) Human-readable error message. Present only when `status` is `FAILED`.  
    Example: `No customer identifier(s) provided`.