API reference
The hosted platform is a language-agnostic HTTP API. Base URL:
https://api.getdpdp.net/api/v1
Authenticate machine requests with a secret key (dpdp_sk_…) in the X-API-Key header;
a publishable key (dpdp_pk_…) is limited to reading purposes and recording consent.
A few endpoints are public (no key) so anyone can verify a certificate.
Always-current reference. The tables below are a guide; the exhaustive,
auto-generated schema (it can't drift from the code) lives at
Swagger UI and
ReDoc. The JavaScript SDK
wraps these in typed methods.
Consent & purposes
| Method | Endpoint | Purpose |
|---|
GET POST | /purposes | List or create consent purposes (with multilingual notices). |
POST | /consent | Record consent for a purpose; returns an immutable receipt. |
POST | /consent/withdraw | Withdraw consent (triggers erasure per the policy). |
GET | /consent/status | Current consent state for a principal. |
GET | /consent/records | List consent records. |
POST | /activity | Record activity (resets the inactivity clock for retention). |
Erasure & fan-out
| Method | Endpoint | Purpose |
|---|
POST | /erasure | Record an erasure (or legal-hold deferral) for a subject. |
POST | /erasure/confirm | A downstream target confirms it erased its copy. |
GET | /erasure/tasks | List per-target fan-out tasks. |
POST | /erasure/tasks/{id}/retry | Re-send an erasure instruction to a target. |
GET POST | /targets | List or register downstream erasure targets. |
GET POST DELETE | /targets/{id} | Get, update, or remove a target. |
Audit & evidence
| Method | Endpoint | Purpose |
|---|
GET | /audit | The hash-chained audit log (optionally by principal). |
GET | /audit/verify | Where the chain breaks (and which checkpoint it anchored to). |
POST | /audit/checkpoint | Snapshot the chain so it can be pruned and still verify. |
POST GET | /evidence | Ingest (or list) an SDK-pushed audit chain (idempotent). |
POST | /evidence/certificate | Issue a certificate from pushed evidence. |
Certificates
| Method | Endpoint | Purpose |
|---|
POST | /certificate | Counter-signed Certificate of Erasure. |
POST | /consent/certificate | Counter-signed Certificate of Consent (with notice fingerprint). |
POST | /certificate/verify | Verify a certificate JWT. Public. |
GET | /certificate/public-key | The signing public key. Public. |
GET | /certificate/registry/{fingerprint} | Look a certificate up in the registry (revocation). |
Retention, readiness & stats
| Method | Endpoint | Purpose |
|---|
GET POST | /retention/policies | List or upsert per-purpose retention rules. |
POST | /retention/run | Run the retention sweep (supports a dry run). |
GET | /readiness | Graded DPDP retention-readiness score over your policies. |
GET | /stats | Aggregate dashboard counts. |
Rights & breaches
| Method | Endpoint | Purpose |
|---|
GET POST | /dsr | List or create data-subject requests (access/correction/…). |
GET POST | /dsr/{id} | Get or advance a request (acknowledge / complete / reject / extend). |
GET POST | /breaches | List or report breach incidents (metadata only, no PII). |
GET POST | /breaches/{id} | Get or advance a breach. |
GET | /breaches/{id}/notification | Draft the Board + principal notifications. |
Account & API keys
Dashboard endpoints (under /api/v1/auth/), used by the web app. These return a
JWT: signup/login give an access + refresh pair; send the access token
as Authorization: Bearer <token> on subsequent calls.
| Method | Endpoint | Purpose |
|---|
POST | /auth/signup · /auth/login | Create an account / sign in → access + refresh tokens. |
POST | /auth/refresh | Exchange a refresh token for a new access token. |
POST | /auth/logout | Revoke (blacklist) a refresh token. |
GET | /auth/me | Current user + the organizations they can act on. |
GET POST | /auth/keys | List or create API keys. |
POST | /auth/keys/{id}/revoke | Revoke an API key. |
Not Python? See Other languages — call any of these
over HTTP, or use the JS SDK.
