API reference
Privacy
11 operations in this area of the contract. Every one declares the permission it requires.
Contract version 0.2.0All areas
Operations
/v1/privacy/authority-requestsList authority requests and legal-hold state
Show parameters and responsesHide parameters and responses
Parameters
| Name | In | Type | Description |
|---|---|---|---|
status | query | pending_review | active | refused | release_pending | released | — |
limit | query | integer | Page size, capped at 200. |
Responses
200Authority request queueAuthorityRequestPage
/v1/privacy/authority-requestsRecord an authority request and propose subject holds
Creates pending hold rows and a maker-checker proposal. Holds become active only after a different authorised reviewer approves. This is neutral intake, not an EFCC schema, authenticity attestation, or direct submission mechanism (Q34).
Show parameters and responsesHide parameters and responses
Responses
202Recorded and awaiting activation reviewAuthorityRequest422—
/v1/privacy/authority-requests/{authorityRequestID}Read an authority request, holds and immutable history
Show parameters and responsesHide parameters and responses
Parameters
| Name | In | Type | Description |
|---|---|---|---|
authorityRequestIDrequired | path | string | — |
Responses
200Authority requestAuthorityRequest404—
/v1/privacy/authority-requests/{authorityRequestID}/releasePropose release of every hold on an authority request
Release is itself maker-checker governed. Until a different authorised actor approves, every linked hold remains blocking; a refused release restores `active`.
Show parameters and responsesHide parameters and responses
Parameters
| Name | In | Type | Description |
|---|---|---|---|
authorityRequestIDrequired | path | string | — |
Responses
202Release proposed and holds still blockingAuthorityRequest409—
/v1/privacy/authority-requests/{authorityRequestID}/response-exportsGenerate and retain a hashed evidence manifest
Returns a neutral inventory with per-domain record counts, SHA-256 digests, scope and provenance. It is auditable and reproducible, but intentionally is not an invented EFCC payload and performs no external submission.
Show parameters and responsesHide parameters and responses
Parameters
| Name | In | Type | Description |
|---|---|---|---|
authorityRequestIDrequired | path | string | — |
Responses
201Recorded response-package manifestAuthorityResponsePackage409—
/v1/privacy/authority-requests/{authorityRequestID}/response-exports/{exportID}Read an exact previously generated evidence manifest
The stored JSON is the same manifest whose SHA-256 was recorded and audited at generation.
Show parameters and responsesHide parameters and responses
Parameters
| Name | In | Type | Description |
|---|---|---|---|
authorityRequestIDrequired | path | string | — |
exportIDrequired | path | string | — |
Responses
200Stored response-package manifestAuthorityResponsePackage404—
/v1/privacy/erasuresList data-subject erasure requests
Show parameters and responsesHide parameters and responses
Parameters
| Name | In | Type | Description |
|---|---|---|---|
status | query | pending_review | approved | refused | executed | — |
limit | query | integer | Page size, capped at 200. |
Responses
200Erasure request queueErasureRequestPage
/v1/privacy/erasuresRecord an erasure request and restrict the subject pending review
Creates a maker-checker proposal. Recording the request does not decide Q5 and does not destroy data. The linked party becomes `restricted` until a second authorised actor approves or refuses it.
Show parameters and responsesHide parameters and responses
Responses
202Recorded and awaiting a different reviewer's decisionErasureRequest409—422—
/v1/privacy/erasures/{erasureID}Read an erasure request and immutable history
Show parameters and responsesHide parameters and responses
Parameters
| Name | In | Type | Description |
|---|---|---|---|
erasureIDrequired | path | string | — |
Responses
200Erasure requestErasureRequest404—
/v1/privacy/erasures/{erasureID}/executeExecute an approved erasure if no hold blocks it
Fails closed while any hold is active or release-pending. Otherwise destroys the wrapped subject DEK and redacts mutable plaintext onboarding PII. AML transaction, screening, risk, alert, case, report and audit skeletons remain; the audit hash chain is never rewritten. Repeating a completed execution is idempotent.
Show parameters and responsesHide parameters and responses
Parameters
| Name | In | Type | Description |
|---|---|---|---|
erasureIDrequired | path | string | — |
Responses
200Executed request, or the already-executed request on a retryErasureRequest404—409Not approved, or blocked by an active/release-pending legal hold
/v1/privacy/subjects/{partyID}/statusRead a subject's restricted/erased state and hold count
This endpoint is intentionally protected by `privacy.request.read`, not customer read. Front-office roles cannot infer that an authority has placed a customer on hold (Q34).
Show parameters and responsesHide parameters and responses
Parameters
| Name | In | Type | Description |
|---|---|---|---|
partyIDrequired | path | string | — |
Responses
200Privacy and hold statusPrivacySubjectStatus404—