OneTrust Data Subject Access Request (DSAR) API

openapi: 3.2.0
info:
  title: Consent & Preferences - Consent Management Platform (CMP)…
  description: These are server-based APIs that will act as a medium between the OT hosted server that owns business logic and the client-side SDK, which will take the responsibility to render elements on UI based on the response sent via APIs.
  version: 202608.1.0
  contact:
    name: OneTrust Support
    url: https://my.onetrust.com/s/contactsupport
  license:
    name: Apache 2.0
    url: https://www.apache.org/licenses/LICENSE-2.0
servers:
- url: https://mobile-data.onetrust.io
  description: The OneTrust Consent Management Platform endpoint.
tags:
- name: Data Subject Access Request (DSAR)
paths:
  /cfw/cmp/v1/dsar:
    post:
      operationId: post_Dsar
      summary: Submit Global Opt-Out Request
      description: Use this API to submit a global opt-out Data Subject Access Request (DSAR) on behalf of a data subject.
      tags:
      - Data Subject Access Request (DSAR)
      x-onetrust:
        release-status: Public Preview
        release-status-link: https://developer.onetrust.com/onetrust/changelog/onetrust-20240520-released
      parameters:
      - name: OT-CDN-Location
        in: header
        required: true
        schema:
          description: The location of the CDN.
          type: string
          enum:
          - cdn.cookielaw.org
          - cdn-apac.onetrust.com
          - cdn.au.onetrust.com
          - cdn-ukwest.onetrust.com
          - cookie-cdn.cookiepro.com
          - otcc-demo.otprivacy.com
          - otcc-training.onetrust.com
      - name: OT-App-Id
        in: header
        required: true
        schema:
          description: The unique identifier for the app or domain.
          type: string
          example: 95c1b37a-c271-44e8-9dd3-1742d82ec948-test
          pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}(-test)?$
      - name: OT-Device-Type
        in: header
        required: true
        schema:
          description: The type of device.
          type: string
          enum:
          - mobile
          - ctv
      - name: OT-SDK-Version
        in: header
        required: true
        schema:
          description: The published version of the app or domain.
          type: string
          example: 202403.2.0
          pattern: ^\d{6}\.\d+\.\d+$
      - name: OT-SDK-Identification
        in: header
        required: false
        schema:
          description: The OT SDK identification.
          type:
          - string
          - 'null'
          example: iOS/17.0/202411.1.0
      - name: OT-Language
        in: header
        required: false
        schema:
          description: The language in which the user interface should be displayed.
          type:
          - string
          - 'null'
          example: en
      - name: OT-Country-Code
        in: header
        required: false
        schema:
          description: The country code from which the user is accessing the app or website.
          type:
          - string
          - 'null'
          example: US
      - name: OT-Region-Code
        in: header
        required: false
        schema:
          description: The region code from which the user is accessing the app or website.
          type:
          - string
          - 'null'
          example: GA
      - name: OT-Fetch-Type
        in: header
        required: false
        schema:
          description: The type of data to download.
          type:
          - string
          - 'null'
          enum:
          - APP_DATA_ONLY
          - APP_DATA_AND_PROFILE
          - APP_DATA_AND_SYNC_PROFILE
      - name: OT-Consent-String
        in: header
        required: false
        schema:
          description: The encoded consent string that contains the interface's metadata.
          type:
          - string
          - 'null'
          example: eyJsYXN0TGF1bmNoRGF0ZSI6MTcxMjMzMDgyOTEwMywic2hvdWxkU2hvd0Jhbm5lciI6MSwiZHNJZCI6IjljZDFjZGM1LTMwNmUtNGQ0Yi05MWFiLTg2MzdjODQ3ZjA3NyIsImFwcElkIjoiOTVjMWIzN2EtYzI3MS00NGU4LTlkZDMtMTc0MmQ4MmVjOTQ4LXRlc3QiLCJjZG4iOiJjZG4uY29va2llbGF3Lm9yZyIsImlzQW5vbnltb3VzIjoxLCJleHBpcnlEYXRlIjpudWxsfQ==
      - name: OT-Identifier
        in: header
        required: false
        schema:
          description: The unique identifier for the data subject.
          type:
          - string
          - 'null'
          examples:
          - 9cd1cdc5-306e-4d4b-91ab-8637c847f077
          - gpburdell@onetrust.com
      - name: OT-Identifier-Type
        in: header
        required: false
        schema:
          description: The identifier type associated with the unique identifier in OT-Identifier header
          type:
          - string
          - 'null'
          example: Email
      - name: OT-Identifier-UpdateType
        in: header
        required: false
        schema:
          type:
          - string
          - 'null'
          enum:
          - Rename-Identifier
      - name: OT-Sync-Profile-Auth
        in: header
        required: false
        schema:
          description: The JSON Web Token (JWT) generated using Public Keys within the OneTrust application.
          type:
          - string
          - 'null'
          example: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJncGJ1cmRlbGxAb25ldHJ1c3QuY29tIiwibmFtZSI6Ikdlb3JnZSBQLiBCdXJkZWxsIiwiaWF0IjoxNTE2MjM5MDIyfQ.qisq7xmfAqXkkSckWpeJKs86JlXuKmClEgMaooSaih0
      - name: OT-Platform
        in: header
        required: false
        schema:
          description: To handle platform-specific features like ATT (App Tracking Transparency for Apple) or GoogleAdId (for Android) in a structured way, you can send the platform type in the parameters of an API or request.
          type:
          - string
          - 'null'
          enum:
          - Apple
          - Android
      - name: OT-Exclude-Html-Tags
        in: header
        required: false
        schema:
          description: This is specifically to unbold the vendor numbers only.
          type:
          - boolean
          - 'null'
      requestBody:
        content:
          application/json:
            schema:
              description: Request body cannot be empty
              type: object
              properties:
                globalOptOut:
                  type: object
                  properties:
                    identifier:
                      description: Email address entered by the user via the pop-up. DSAR only supports email.
                      type: string
                    purposes:
                      description: Array of groupId for all global opt-out purposes that were opted out.
                      type: array
                      items:
                        type: string
                  required:
                  - identifier
                  - purposes
              example:
                globalOptOut:
                  identifier: john@gmail.com
                  purposes:
                  - C0001
              required:
              - globalOptOut
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                allOf:
                - type: object
                  properties:
                    errors:
                      type: array
                      items:
                        type: object
                        properties:
                          code:
                            type: string
                            example: ERROR_CODE_BLOB_LOCATIONS_UNAVAILABLE
                            enum:
                            - SUCCESS
                            - ERROR_CODE_TEXT_RESOURCE_NOT_FOUND
                            - ERROR_CODE_NO_CONTENT
                            - ERROR_CODE_BLOB_LOCATIONS_UNAVAILABLE
                            - ERROR_CODE_INVALID_LOCATION
                            - ERROR_CODE_INVALID_COUNTRY_OR_REGION
                            - ERROR_CODE_INVALID_DEVICE_TYPE
                            - ERROR_CODE_INVALID_FETCH_TYPE
                            - ERROR_CODE_INVALID_CONSENT_REQUEST
                            - ERROR_CODE_HTTP_IF_NONE_MATCHED
                            - ERROR_CODE_SYNC_GROUP
                            - ERROR_CODE_FAILURE
                            - ERROR_CODE_DEFAULT_PURPOSE_STATUS
                            - ERROR_CODE_INVALID_OT_CONSENT_STRING
                            - ERROR_CODE_GENERIC_ERROR
                            - ERROR_CODE_MISSING_REQUIRED_HEADER
                            - ERROR_CODE_NO_ACCESS
                            - ERROR_CODE_INVALID_INTERACTION_TYPE
                            - ERROR_CODE_INVALID_CONTENT_TYPE_HEADER
                            - ERROR_IDENTIFIER_MISMATCH
                            - ERROR_UCP_NOT_CONFIGURED
                            - ERROR_CODE_INVALID_TC_STRING
                            - ERROR_GOOGLE_ADS_DISABLED
                            - ERROR_CODE_CONSENT_LOGGING
                            - ERROR_CODE_INVALID_REQUEST_BODY
                            - ERROR_CODE_UNSUPPORTED_VERSION
                            - ERROR_CODE_INVALID_AGE_RANGE
                            - ERROR_CODE_EMPTY_CONSENT
                            - ERROR_CODE_GLOBAL_OPT_OUT_NOT_CONFIGURED
                            - ERROR_CODE_GLOBAL_OPT_OUT_DISABLED
                            - ERROR_CODE_DSAR
                          message:
                            type: string
                            example: Unable to fetch data for the specified Application ID. Please check your configurations.
                            enum:
                            - Not Found
                            - No content
                            - success
                            - Unable to fetch data for the specified Application ID. Please check your configurations.
                            - Invalid location
                            - Invalid country code or region code. If you want to skip validation, please set the header 'OT-Geolocation-Skip-Validation' to true.
                            - Invalid Device Type
                            - Invalid Fetch type
                            - Missing either or all of TenantId or Identifier or Authorization
                            - If-None-Match
                            - syncGroup
                            - failure
                            - NO_CONSENT
                            - Invalid OT consent string
                            - Something went wrong
                            - No access to this resource
                            - Invalid Interaction Type
                            - Content-Type header should be application/json
                            - Input Identifier does not match with one in consent string
                            - The UC Purposes API call was successful, but no data is available for display.
                            - UC Purposes is disabled.
                            - Error decoding TC string, default consent is returned.
                            - Google Ads is disabled.
                            - Consent Logging has failed, please retry in sometime and if issue still persists please reach out to support team.
                            - Error parsing request body
                            - The published version is not supported. Please publish a newer version.
                            - The upper bound of the age range must be greater than lower bound.
                            - At least one purpose consent is required.
                            - Global Opt-Out is not configured.
                            - Global Opt-Out is disabled.
                        required:
                        - code
                        - message
                    warnings:
                      type: array
                      items:
                        type: object
                        properties:
                          code:
                            type: string
                            example: WARNING_CODE_PUBLISHED_VERSION_MISMATCH
                            enum:
                            - WARNING_CODE_PUBLISHED_VERSION_MISMATCH
                          message:
                            type: string
                            example: Requested data for the OT-SDK-Version does not match the published version on the OneTrust server. The latest published version will be returned instead.
                            enum:
                            - Requested data for the OT-SDK-Version does not match the published version on the OneTrust server. The latest published version will be returned instead.
                        required:
                        - code
                        - message
                - type: object
                  properties:
                    response:
                      description: Response from the DSAR service
                - type: object
                  properties:
                    storageKeys:
                      type: object
                      example:
                        OT_GlobalOptOut:
                          C0001:
                            lastOptedOut: '2025-10-15T10:30:00Z'
                            identifier: test@example.com
                      properties:
                        OT_GlobalOptOut:
                          type: object
                          additionalProperties:
                            type: object
                            properties:
                              lastOptedOut:
                                type: string
                              identifier:
                                type: string
                            required:
                            - lastOptedOut
                            - identifier
                      required:
                      - OT_GlobalOptOut
                  required:
                  - storageKeys
                - type: object
                  properties:
                    otConsentString:
                      type: string
                      example: eyJMYXN0TGF1bmNoRGF0ZSI6MTcwNDczNzM3OTY1MSwiU2hvdWxkU2hvd0Jhbm5lciI6MSwiRFNJRCI6InN1cC1uZXdsa2diIn0=
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                type: object
                properties:
                  errors:
                    type: array
                    items:
                      type: object
                      properties:
                        code:
                          type: string
                          example: ERROR_CODE_BLOB_LOCATIONS_UNAVAILABLE
                        message:
                          type: string
                          example: Unable to fetch data for the specified Application ID. Please check your configurations.
                      required:
                      - code
                      - message
                required:
                - errors
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                type: object
                properties:
                  errors:
                    type: array
                    items:
                      type: object
                      properties:
                        code:
                          type: string
                          example: ERROR_CODE_NO_ACCESS
                        message:
                          type: string
                          example: No access to this resource
                      required:
                      - code
                      - message
                required:
                - errors
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                type: object
                properties:
                  errors:
                    type: array
                    items:
                      type: object
                      properties:
                        code:
                          type: string
                          example: ERROR_CODE_TEXT_RESOURCE_NOT_FOUND
                        message:
                          type: string
                          example: Not Found
                      required:
                      - code
                      - message
                required:
                - errors
        '429':
          description: Too Many Requests. \nFor more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview).
          headers:
            Retry-After:
              schema:
                description: The number of seconds after which requests will be allowed again.
                format: int32
            ot-period:
              schema:
                description: The unit of time for which the rate limit applies
                enum:
                - HOUR
                - MINUTE
            ot-ratelimit-event-id:
              schema:
                description: The unique identifier for the rate-limiting event.
                format: uuid
            ot-request-made:
              schema:
                description: The number of requests made within the specified period.
                format: int32
            ot-requests-allowed:
              schema:
                description: The number of requests allowed within the specified period.
                format: int32
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                type: object
                properties:
                  errors:
                    type: array
                    items:
                      type: object
                      properties:
                        code:
                          type: string
                          example: ERROR_CODE_GENERIC_ERROR
                        message:
                          type: string
                          example: Something went wrong
                      required:
                      - code
                      - message
                required:
                - errors
externalDocs:
  url: https://developer.onetrust.com/onetrust/docs/implementation-guidance
  description: Implementation Guidance
x-onetrust:
  spec-label: OpenAPI 3.1.0
  links:
  - Consent & Preference Management Knowledge Base: https://my.onetrust.com/s/topic/0TO3q000000kIWOGA2/consent-management
    Implementation Guidance: https://developer.onetrust.com/onetrust/docs/implementation-guidance
  - '{''Consent & Preference Management Knowledge Base'': ''https://my.onetrust.com/s/topic/0TO3q000000kIWOGA2/consent-management'', ''Implementation Guidance'': ''https://developer.onetrust.com/onetrust/docs/implementation-guidance''}'
x-readme:
  explorer-enabled: true
  proxy-enabled: true
  metrics-enabled: false