How-to

Run a DSAR (access & erasure)

Rights act on a verified principal — never on a caller-supplied id — to prevent erasure-as-DoS and DSAR-as-exfiltration. First authenticate the principal, then call rights with the session.

1. Verify the principal (OTP)

The suite ships with built-in OTP providers — SMTP and HTTP/webhook. Set DPDP_OTP_PROVIDER to point at your email or SMS gateway; the suite routes the one-time code through it. No hosted OTP relay is included — you wire your own gateway, the suite handles the challenge lifecycle.

otp

curl -X POST $API/v1/principal/otp/begin -H "authorization: Bearer pk_live_…" \
  -d '{"principalId":"user-123","channel":"sms","address":"+9199…"}'
# → { "challengeId":"…" }   (code is sent via your configured DPDP_OTP_PROVIDER)
curl -X POST $API/v1/principal/otp/verify -H "authorization: Bearer pk_live_…" \
  -d '{"challengeId":"…","code":"482913"}'
# → { "token":"…", "assurance":"otp" }

2. Access (§11)

access

curl -X POST $API/v1/rights/access -H "x-principal-token: <token>"
# → summary of data + processing + who it was shared with

3. Erasure (§12) — needs step-up

Destructive erasure requires a step-up assurance — re-verify with stepUp:true:

erasure

# re-verify with stepUp, then:
curl -X POST $API/v1/rights/erasure -H "x-principal-token: <step-up-token>" \
  -d '{"requestId":"e-001","reasonCode":"no-longer-needed"}'
# → schedules a reversible grace window; on expiry the cascade crypto-shreds the principal's PII

Erasure runs the cascade (crypto-shred the vault + scrub grievance/correction/nominee PII) BEFORE writing the one-way §12 marker — so the marker never attests an erasure that didn't complete.

4. Fan-out erasure to your own data stores

The suite emits an erasure.executed webhook event when the crypto-shred completes. A runnable reference erasure-connector (in the dpdp-suite repo) shows how to subscribe to that event and propagate the deletion to your own databases, object stores, and downstream processors. The connector is a starting point — your stores and adapters remain your responsibility.

erasure-webhook

# erasure.executed payload (sent to your DPDP_WEBHOOK_URL)
{
  "event":       "erasure.executed",
  "principalId": "user-123",
  "requestId":   "e-001",
  "completedAt": "2026-06-30T10:00:00Z"
}

# Reference connector entry point (dpdp-suite repo):
# connectors/erasure-reference/index.ts
# — subscribe to the webhook, look up the principal in your store, delete, confirm

Crypto-shred →Authentication →Quickstart →