Data Subject Requests API

Full DSR lifecycle management — create, verify, assign, track, extend, complete, or deny data subject requests. All endpoints require JWT authentication.

Request CRUD (20 endpoints)

POST /api/v1/dsr/requests 🔒

Create a new data subject request.

Request Body

Field	Type	Required	Description
`type`	string	Yes	`access`, `deletion`, `rectification`, `portability`, `opt-out`, `restriction`
`subjectName`	string	Yes	Data subject's name
`subjectEmail`	string	Yes	Data subject's email
`description`	string	No	Request details
`framework`	string	No	Applicable framework (e.g. `gdpr`, `ccpa`)

curl -X POST https://api.privabase.com/api/v1/dsr/requests \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "deletion",
    "subjectName": "Jane Doe",
    "subjectEmail": "jane@example.com",
    "framework": "gdpr"
  }'

GET /api/v1/dsr/requests 🔒

List all DSR requests. Supports filtering and pagination.

GET /api/v1/dsr/requests/:id 🔒

Get a specific DSR request with full details and history.

PUT /api/v1/dsr/requests/:id 🔒

Update a DSR request.

PUT /api/v1/dsr/requests/:id/status 🔒

Update request status directly.

DELETE /api/v1/dsr/requests/:id 🔒

Delete a DSR request.

Lifecycle Actions

POST /api/v1/dsr/requests/:id/verify 🔒

Initiate identity verification for the data subject.

POST /api/v1/dsr/requests/:id/verify/complete 🔒

Mark identity verification as complete.

POST /api/v1/dsr/requests/:id/assign 🔒

Assign a request to a team member.

Request Body

{ "assigneeId": "user-uuid" }

POST /api/v1/dsr/requests/:id/notes 🔒

Add an internal note to a request.

Request Body

{ "note": "Verified identity via phone call on 2026-03-13" }

POST /api/v1/dsr/requests/:id/extend 🔒

Extend the response deadline (e.g. GDPR allows 2-month extension for complex requests).

Request Body

{ "reason": "Complex request requiring additional data gathering", "days": 60 }

POST /api/v1/dsr/requests/:id/complete 🔒

Mark a request as completed.

POST /api/v1/dsr/requests/:id/deny 🔒

Deny a request with a reason.

Request Body

{ "reason": "Unable to verify identity after multiple attempts" }

Bulk Operations

POST /api/v1/dsr/bulk/status 🔒

Bulk update status for multiple requests.

Request Body

{ "requestIds": ["id1", "id2"], "status": "in-progress" }

POST /api/v1/dsr/bulk/assign 🔒

Bulk assign requests to a team member.

Reporting

GET /api/v1/dsr/export 🔒

Export DSR requests as CSV or JSON for compliance reporting.

GET /api/v1/dsr/stats 🔒

Get DSR statistics — total, by status, by type, average response time.

GET /api/v1/dsr/overdue 🔒

List overdue DSR requests.

GET /api/v1/dsr/sla-report 🔒

Get SLA compliance report — percentage of requests met within regulatory deadlines.

GET /api/v1/dsr/templates 🔒

Get DSR response templates for different request types and frameworks.