Skip to main content

Klaviyo data privacy api issues

  • April 15, 2026
  • 4 replies
  • 33 views

Forum|alt.badge.img

We’re getting 401 responses from the Data Privacy APIs (profile delete).

A few observations:

  • Non-existing profiles continue to return 404 as expected
  • Existing profiles can no longer be deleted using the API
  • Other APIs using the same private key are working fine
  • Behaviour is consistent in both staging and production
  • Deletions were working successfully up to April 14

Sample error:

{
  "errors": [
    {
      "id": "9917507d-f1c9-4fdb-90aa-a3311cc85ffc",
      "status": 401,
      "code": "authentication_failed",
      "title": "Incorrect authentication credentials.",
      "detail": "Missing or invalid authorization",
      "source": {
        "pointer": "/data/"
      }
    }
  ]}

It appears to affect only existing profiles — non-existent profiles are returning 404 as expected, not 401.

does someone know if there is any ground breaking changes today.

4 replies

  • Contributor I
  • April 15, 2026

Same thing happening for us. Was working fine until around April 14th 19:00 UTC. Maybe it has something to do with the new revision of the API they released today?


MANSIR2094
Expert Problem Solver IV
Forum|alt.badge.img+21
  • Expert Problem Solver IV
  • April 15, 2026

Hello ​@ekalvyaa 

Over the few times I 've worked with the data privacy API, this kind of 401 usually isn't about the key being wrong, especially since other endpoints still work. It often shows up when klaviyo tightens permission checked on delete actions after an API revision.
Since it stopped around April 14 for you both or as many people, I suspect a silent change in authorization handling or required scopes for profile deletion. What I would actually check From experience, is to regenerate a fresh private key with full data privacy permissions, confirm the exact header format being aent, and verify the API revision version in the request. I have seen older revisions keep working for other calls but fail specifically on delete endpoint..

Still learning deeper parts of the API myself but similar cases this turned out to be permission or revision related rather than a code bug. Happy to compare notes if you find anything new.

Mansir~


  • Contributor I
  • April 15, 2026

We’re getting 401 responses from the Data Privacy APIs (profile delete).

A few observations:

  • Non-existing profiles continue to return 404 as expected
  • Existing profiles can no longer be deleted using the API
  • Other APIs using the same private key are working fine
  • Behaviour is consistent in both staging and production
  • Deletions were working successfully up to April 14

Sample error:

{
  "errors": [
    {
      "id": "9917507d-f1c9-4fdb-90aa-a3311cc85ffc",
      "status": 401,
      "code": "authentication_failed",
      "title": "Incorrect authentication credentials.",
      "detail": "Missing or invalid authorization",
      "source": {
        "pointer": "/data/"
      }
    }
  ]}

It appears to affect only existing profiles — non-existent profiles are returning 404 as expected, not 401.

does someone know if there is any ground breaking changes today.

No known global breaking change today.

This looks like a Data Privacy delete endpoint auth/scope change or stricter permission check since Apr 14. Key likely missing required privacy/deletion scope or new auth rule for that endpoint.


Forum|alt.badge.img
  • Author
  • Contributor I
  • April 16, 2026

@MANSIR2094 ​@rohan02 
The issue is automatically resolved now. I think they rolled out fixes.