---
schema_version: "1"
id: 9ce553a3281cf54eff00e0dc15b21f4626ab98dc0ac9a555c5332d4e2129487a
title: Mask Customer Data
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/commerce-cloud/retail-cloud/reference/generated-api-specs/mask-customer-data.md
canonical_url: https://developer.salesforce.com/docs/commerce/retail-cloud/references/mask-customer-data
source_site: developer.salesforce.com
content_type: documentation
content_hash: e6f7e90e75ec2ba73f5b698fb311307d57c840806ea51600648b7fd8872094e5
products:
  - Point of Sale for Developers
  - Salesforce APIs
---
Mask Customer Data

# Mask Customer Data

[Download specification](https://developer.salesforce.com/static/commercecloud/retail-cloud/mask-customer-data/mask-customer-data-oas-public.yaml)

Request to mask customer data by email or customer ID identifiers.

**Version:** 2.3.4

## Tags

### Mask Customer Data

[Download specification](https://developer.salesforce.com/static/commercecloud/retail-cloud/mask-customer-data/mask-customer-data-oas-public.yaml)

Request to mask customer data by email or customer ID identifiers.

## Operations

### POST Mask customer data.

`POST /merchant/{version}/customer/mask`

Operation ID: `maskCustomerData`. Tags: Mask Customer Data, Customer API.

Administrative API to mask specific customer data to satisfy CCPA/GDPR requirements. Customer records are identified by customer ID or email address, and PII fields are replaced with mask characters across all relevant data stores.

The following categories of customer data are masked:

*   **Names** — first name, last name, middle name, initials
*   **Contact information** — email addresses, phone numbers
*   **Addresses** — billing and shipping addresses, including street, city, state/province, ZIP/postal code, and country
*   **Demographic information** — gender, age, date of birth
*   **Payment information** — credit card numbers, card type, expiration dates, billing address
*   **Loyalty and consent** — loyalty enrollment data and related consents
*   **Identification numbers** — driver's license, national ID, and similar identifiers

Masking is applied across relational databases (MySQL), NoSQL databases (DynamoDB), caches (Redis), and data warehouses (Redshift). Object storage (S3) is covered by TTL policies.

Masking is asynchronous. The response returns a `requestId` and an `IN_PROGRESS` status. Use the request ID to poll for completion.

#### Parameters

*   `version` (path, string, required) Supported: v1.  
    Pattern: v1|v2.

#### Responses

*   **default** Default response.
    
    Media type: `application/json`. Schema: `CustomerMaskResponse`.
    

## Schemas

### CustomerMaskResponse

*   `requestId` (_string_) Unique identifier for this masking request.  
    Example: `e7966181-88a6-4247-9261-0ef0f35eb336`.
*   `customerCount` (_integer (int32)_) Number of customer records included in the masking request.  
    Example: `2`.
*   `status` (_string_)
    
    Current status of the masking request.
    
    *   `IN_PROGRESS` — Masking is running asynchronously.
    *   `SUCCESSFUL` — All specified customer records have been masked.
    *   `FAILED` — Masking failed. See `errorCode` and `errorMessage` for details.
    
      
    Allowed values: `IN_PROGRESS`, `SUCCESSFUL`, `FAILED`.
*   `requestedOn` (_integer (int64)_) Unix timestamp (milliseconds) indicating when the masking request was submitted.  
    Example: `1746136132000`.
*   `errorCode` (_string_) Machine-readable error code. Present only when `status` is `FAILED`.  
    Example: `MISSING_ID`.
*   `errorMessage` (_string_) Human-readable error message. Present only when `status` is `FAILED`.  
    Example: `No customer identifier(s) provided`.