Rights requests

One endpoint links a rights request to your own identifier for the person. Paths are relative to https://console.dpconsent.com/consent/sdk/v1. Requests themselves arrive through the hosted form or the console; see How people ask. The hosted form's fields and the status page are at the end.

Endpoints#

`POST /requests/link`#

Points a rights request at the identifier the person's records are kept under, so the request finds those records.

Key	Scope	`Idempotency-Key`	Webhook sent
Secret	`requests:write`	Ignored	None

Parameters

Name	Type	Required	Description
`reference`	string	Yes	The request's reference, in the form `DSR-2026-4F2A91`. It is in the `subject_request.received` event and in the console.
`subjectId`	string, up to 255	Yes	Your identifier for the person.
`subjectType`	string	Yes	`EMAIL`, `PHONE`, `USER_ID`, `DEVICE_ID`, `SESSION_ID` or `COOKIE_ID`.

Request

cURLShell

curl -X POST https://console.dpconsent.com/consent/sdk/v1/requests/link \
  -H "Authorization: Bearer $PIEDAP_SECRET_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "reference": "DSR-2026-4F2A91",
    "subjectId": "usr_8f2K1xQz",
    "subjectType": "USER_ID"
  }'

Node.jsJavaScript

const linked = await client.linkRequest(
  'DSR-2026-4F2A91',
  'usr_8f2K1xQz',
  'USER_ID',
);

Python

linked = client.link_request(
    "DSR-2026-4F2A91",
    "usr_8f2K1xQz",
    "USER_ID",
)

Response

200:

JSON

{ "reference": "DSR-2026-4F2A91", "linkedRecordCount": 2 }

Field	Type	Description
`reference`	string	The request that was linked.
`linkedRecordCount`	integer	How many consent records the request now matches.

The request's timeline notes that the key linked it. The request keeps no readable copy of your identifier.

Errors

Status	Code	When
`404`	`REQUEST_NOT_FOUND`	No request in the project has this reference.
`403`	`SCOPE_REQUIRED`	The key lacks `requests:write`, or the call was made with a publishable key.
`400`	None. The message is a list	A field is missing, or `reference` is not in the form `DSR-2026-4F2A91`.
`429`	None. The message is `Too many requests`	The budget for calls on a person, 60 a minute by default, is used up.

Also the errors every call can return.

Hosted request pages#

The request form#

/pages/<publishable key>/request posts these fields. Link to it, or frame it.

Field	Required	Description
`requestType`	Yes	`ACCESS`, `ERASURE`, `WITHDRAW_CONSENT`, `NOMINATION`, `GRIEVANCE` or `RECTIFICATION`. With `PRODUCT_SCOPE=global`, also `PORTABILITY`, `OBJECTION` or `RESTRICTION`.
`subjectId`	Yes	The identifier of the person the data is about. Hashed before it is stored.
`actingAs`	No	`SELF`, the default, `PARENT`, `LAWFUL_GUARDIAN` or `NOMINEE`. A nominee cannot make a `NOMINATION`.
`representativeName`	When `actingAs` is not `SELF`	The name of whoever asks. Encrypted.
`representativeId`	For `NOMINEE`	Their own email address or phone number. Kept as a keyed hash. A nominee's must match the one recorded when they were nominated.
`contact`	No	Where to reply. Encrypted.
`note`	No	Details, up to 2,000 characters.

A request made for someone else is fulfilled only after your team confirms their authority in the console. See Handle a request made for someone else.

The status page#

GET /pages/request-status?token=… shows the reference, the type, the status, the deadline while the request is open, and your team's reply once it is closed. For a request from the hosted form, the reply shows only after the person confirmed the request.

The link arrives as statusUrl in subject_request.received and subject_request.completed. The confirmation page shows it too. It works for 180 days.

subject_request.received
Handle a request
People for the calls that carry a request out

Endpoints#

POST /requests/link#

Hosted request pages#

The request form#

The status page#

Related#

`POST /requests/link`#