Developers
API reference
116 endpoints across the DPDP Suite, grouped by the credential each requires. Generated from the live route table — see Authentication for the key model and the Quickstart for runnable examples.
Publishable pk_ key
Public / browser · 11
Consent capture + the OTP ceremony from the browser. Safe to ship to the client.
| Method | Path |
|---|---|
| POST | /v1/passkeys/auth/begin |
| POST | /v1/passkeys/auth/finish |
| POST | /v1/passkeys/register/begin |
| POST | /v1/passkeys/register/finish |
| POST | /v1/principal/identity/exchange |
| POST | /v1/principal/otp/begin |
| POST | /v1/principal/otp/verify |
| POST | /v1/public/consent/begin |
| POST | /v1/public/consent/capture |
| GET | /v1/public/cookie-banner |
| GET | /v1/public/notice/{noticeId}/{version}/{language} |
Secret sk_ key
Tenant API · 84
Your backend: capture/check consent, rights admin, breach, RoPA, governance, evidence.
| Method | Path |
|---|---|
| GET | /v1/admin/analyticsauditor |
| GET | /v1/admin/audit |
| GET | /v1/admin/corrections |
| POST | /v1/admin/corrections/{id}/action |
| POST | /v1/admin/corrections/{id}/reject |
| GET | /v1/admin/erasure-denialsauditor |
| POST | /v1/admin/erasure-denialsagent |
| GET | /v1/admin/erasures |
| POST | /v1/admin/evidence-packauditor |
| GET | /v1/admin/exportauditor |
| GET | /v1/admin/grievances |
| POST | /v1/admin/grievances/{id}/acknowledge |
| POST | /v1/admin/grievances/{id}/resolve |
| GET | /v1/admin/grievances/breaching |
| POST | /v1/admin/principal-trail |
| POST | /v1/admin/principals |
| POST | /v1/admin/retention/preview |
| POST | /v1/admin/self-checkauditor |
| GET | /v1/admin/usage |
| POST | /v1/admin/verify-chain |
| GET | /v1/age/{principalId}auditor |
| POST | /v1/age/parental-consentagent |
| POST | /v1/age/verifyagent |
| GET | /v1/breaches |
| POST | /v1/breaches |
| GET | /v1/breaches/{id} |
| GET | /v1/breaches/{id}/dossier |
| POST | /v1/breaches/{id}/intimation |
| POST | /v1/breaches/{id}/mitigation |
| POST | /v1/breaches/{id}/satisfy |
| POST | /v1/breaches/siemagent |
| POST | /v1/consent/begin |
| POST | /v1/consent/can-processagent |
| POST | /v1/consent/capture |
| POST | /v1/consent/checkagent |
| GET | /v1/cookiesauditor |
| POST | /v1/cookiesagent |
| POST | /v1/cookies/{id}/removeagent |
| POST | /v1/cookies/scanagent |
| GET | /v1/data-mapauditor |
| POST | /v1/data-mapagent |
| POST | /v1/data-map/{id}/removeagent |
| GET | /v1/data-map/coverageauditor |
| GET | /v1/dpaauditor |
| POST | /v1/dpa/acceptowner |
| GET | /v1/dpiaauditor |
| POST | /v1/dpiaagent |
| GET | /v1/dpia/{id}auditor |
| POST | /v1/dpia/{id}agent |
| POST | /v1/dpia/{id}/statusagent |
| POST | /v1/dsar/fulfilagent |
| GET | /v1/dsar/fulfilmentsauditor |
| GET | /v1/dsar/fulfilments/{id}auditor |
| POST | /v1/dsar/fulfilments/{id}/completeagent |
| GET | /v1/languages |
| POST | /v1/notices |
| GET | /v1/notices/{noticeId}/{version} |
| GET | /v1/notices/{noticeId}/{version}/{language} |
| GET | /v1/notices/{noticeId}/{version}/coverage |
| POST | /v1/notices/{noticeId}/approve |
| GET | /v1/passkeysauditor |
| POST | /v1/passkeys/{credentialId}/revokeagent |
| GET | /v1/passkeys/logauditor |
| GET | /v1/ropa |
| GET | /v1/ropa-snapshot |
| DELETE | /v1/ropa/{activityId} |
| GET | /v1/ropa/{activityId} |
| PUT | /v1/ropa/{activityId} |
| POST | /v1/sdf/algorithmic-due-diligence |
| POST | /v1/sdf/audit |
| POST | /v1/sdf/designation |
| POST | /v1/sdf/dpia |
| POST | /v1/sdf/dpo |
| POST | /v1/sdf/readiness |
| GET | /v1/vendorsauditor |
| POST | /v1/vendorsagent |
| GET | /v1/vendors/{id}auditor |
| POST | /v1/vendors/{id}agent |
| POST | /v1/vendors/{id}/removeagent |
| GET | /v1/vendors/attentionauditor |
| GET | /v1/webhooks |
| POST | /v1/webhooks |
| DELETE | /v1/webhooks/{endpointId} |
| GET | /v1/webhooks/deliveries |
x-principal-token
Data-principal · 10
§11/§12 rights for a verified end-user (after OTP/SSO).
| Method | Path |
|---|---|
| POST | /v1/grievances |
| GET | /v1/grievances/{id} |
| POST | /v1/rights/access |
| POST | /v1/rights/correction |
| POST | /v1/rights/erasure |
| POST | /v1/rights/erasure/cancel |
| POST | /v1/rights/nominees |
| POST | /v1/rights/nominees/list |
| POST | /v1/rights/nominees/remove |
| POST | /v1/rights/withdrawal |
Operator key
Operator / platform · 9
Tenant lifecycle + key minting (the platform owner).
| Method | Path |
|---|---|
| GET | /v1/keys |
| POST | /v1/keys |
| POST | /v1/keys/{keyId}/revoke |
| GET | /v1/tenants |
| POST | /v1/tenants |
| GET | /v1/tenants/{tenantId} |
| POST | /v1/tenants/{tenantId}/activate |
| PATCH | /v1/tenants/{tenantId}/config |
| POST | /v1/tenants/{tenantId}/suspend |
No key
Open (unauthenticated) · 2
Verify a consent chain with no key — even a third party can.
| Method | Path |
|---|---|
| POST | /v1/verify |
| GET | /v1/verify/jwks/{tenantId} |
Request/response body schemas are being enriched. The endpoint set, methods, path params and auth scope here are generated from the production route table, so they stay in sync with the API.
Make your first authenticated call
Grab a key from the auth model, then run the Quickstart to capture and verify a consent chain end-to-end.