The Segment Regulations API handles data privacy regulations and suppression requests. It is one of 23 APIs that Twilio Segment publishes on the network, described by both a machine-readable OpenAPI specification and an AsyncAPI event-driven specification, served from api.segmentapis.com.
Most customer data platforms treat deletion as a support ticket. Segment made it an endpoint.
Why that is the right call
A customer data platform is, by construction, the worst possible place for a privacy request to land. Segment’s whole job is to take an event once and fan it out to dozens of downstream destinations — a warehouse, an email tool, an ad platform, an analytics product, a support desk.
So “delete this user” is not one delete. It is a delete in the CDP plus a coordinated instruction to every destination that ever received that user’s data, plus a durable suppression so the next event carrying that identifier does not quietly re-create the record you just removed.
That last part is the one teams get wrong. Deletion without suppression is temporary. The user comes back through a source that has not been updated, and the profile reappears.
Segment splits both into the API: regulations for the deletion and suppression rules, and a separate Deletion and Suppression surface in the wider Config API family.
The AsyncAPI is doing necessary work
This entry publishes an AsyncAPI alongside the OpenAPI, and for this particular API that is not decoration.
A regulation request is not synchronous. You submit it, and then it propagates across destinations over minutes or hours, succeeding against some and failing against others — a destination that is down, a destination whose API rejected the identifier, a destination that no longer has a credential.
The compliance question is not did you accept my deletion request. It is did every downstream system actually delete it, and that answer only exists in the events emitted after the fact. An OpenAPI contract describes the submission. The AsyncAPI describes the part you need for an audit.
Publishing both is what “we take deletion seriously” looks like when expressed as artifacts rather than as a trust-centre page.
The artifact set
- OpenAPI specification
- AsyncAPI specification (Segment webhooks)
- API documentation, plus the HTTP source, Profile API and Config API docs
- A GraphQL schema at the provider level
Four artifact types on a compliance API is above the catalog norm. The provider entry sits under segment while the display name reads Twilio Segment — a naming artefact of the acquisition that is worth knowing if you are searching for it.
The broader point
Privacy obligations under GDPR, CCPA and their successors are increasingly operational rather than legal — a deletion has a deadline, and the deadline does not care that your CDP fans out to thirty destinations.
An API that treats deletion as a first-class operation, with an event stream describing what happened downstream, is the difference between a compliance posture you can demonstrate and one you can only assert.
Takeaway
Deletion and suppression as endpoints rather than tickets, with an AsyncAPI describing the asynchronous half where the actual compliance evidence lives. This is a small API doing an unglamorous job properly.
Read the docs at docs.segmentapis.com, and the provider entry at apis.io/providers/segment/.