OneTrust Documents API

openapi: 3.2.0
info:
  title: Tech Risk & Compliance - Enterprise Policy Management…
  version: '1.0'
  contact:
    name: OneTrust Support
    url: https://my.onetrust.com/s/contactsupport
  license:
    name: Apache 2.0
    url: https://www.apache.org/licenses/LICENSE-2.0
  description: The Enterprise Policy Management APIs are used to integrate external systems and streamline the flow of data with Enterprise Policy Management in the OneTrust platform.
servers:
- url: https://{hostname}/api/enterprise-policy
  variables:
    hostname:
      default: hostname
      description: The OneTrust hostname such as app.onetrust.com, app-eu.onetrust.com, app-de.onetrust.com, app-uk.onetrust.com, app-apac.onetrust.com, trial.onetrust.com, or uat.onetrust.com.
tags:
- name: Documents
  description: The Documents APIs are used to manage document objects such as policies, standards, procedures, and privacy notices.
  externalDocs:
    description: OpenAPI 3.1.0 - Download Definition
    url: https://developer.onetrust.com/onetrust/openapi/tech-risk-compliance-enterprise-policy-management.json
paths:
  /v1/{complianceType}/create:
    post:
      operationId: createPolicy
      summary: Create Document
      description: Use this API to create a policy, standard, procedure, or privacy notice.
      tags:
      - Documents
      x-onetrust:
        spec-label: https://developer.onetrust.com/onetrust/openapi/tech-risk-compliance-enterprise-policy-management.json
      parameters:
      - name: complianceType
        in: path
        description: The type of compliance document.
        required: true
        schema:
          type: string
          enum:
          - policies
          - standards
          - procedures
          - privacynotices
        example: policies
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PolicyCreationApiRequest'
            example:
              defaultLanguageCode: it
              orgGroup:
                id: c1f58408-f575-403b-bc80-f707f9091264
                name: Gilbert Hughes & Company
              name: Policy Name
              description: Policy Description
              effectiveDate: '2024-12-15'
              expirationDate: '2024-12-30'
              owners:
              - id: 27ad529a-afcc-4f22-a7ff-fafa6526edfb
                name: Owner Name
                email: owner@domain.com
              approvers:
              - id: 27ad529a-afcc-4f22-a7ff-fafa6526edfb
                name: Approver Name
                email: approver@domain.com
      responses:
        '201':
          description: Created
          content:
            '*/*':
              schema:
                type: string
                format: uuid
        '400':
          description: Bad Request
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '429':
          description: "Too Many Requests. \nFor more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview)."
          headers:
            Retry-After:
              schema:
                description: The number of seconds after which requests will be allowed again.
                format: int32
            ot-period:
              schema:
                description: The unit of time for which the rate limit applies
                enum:
                - HOUR
                - MINUTE
            ot-ratelimit-event-id:
              schema:
                description: The unique identifier for the rate-limiting event.
                format: uuid
            ot-request-made:
              schema:
                description: The number of requests made within the specified period.
                format: int32
            ot-requests-allowed:
              schema:
                description: The number of requests allowed within the specified period.
                format: int32
        '500':
          description: Internal Server Error
      security:
      - OAUTH2:
        - POLICY
  /v1/{complianceType}/list:
    get:
      operationId: getLatestPolicies
      summary: Get List of Documents
      description: Use this API to retrieve a list of policies, standards, procedures, or privacy notices by the specified compliance document type.
      tags:
      - Documents
      x-onetrust:
        spec-label: https://developer.onetrust.com/onetrust/openapi/tech-risk-compliance-enterprise-policy-management.json
      parameters:
      - name: page
        in: query
        description: The page number of the results.
        schema:
          type: integer
          default: 0
      - name: size
        in: query
        description: The number of results per page.
        schema:
          type: integer
          default: 10
          maximum: 2000
          minimum: 1
      - name: sort
        in: query
        description: The sort criteria that dictates the order of the results.
        schema:
          type: string
          default: createdDate,desc
      - name: complianceType
        in: path
        description: The type of compliance document.
        required: true
        schema:
          type: string
          enum:
          - policies
          - standards
          - procedures
          - privacynotices
        example: policies
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/PolicyListApiResponse'
        '400':
          description: Bad Request
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '429':
          description: "Too Many Requests. \nFor more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview)."
          headers:
            Retry-After:
              schema:
                description: The number of seconds after which requests will be allowed again.
                format: int32
            ot-period:
              schema:
                description: The unit of time for which the rate limit applies
                enum:
                - HOUR
                - MINUTE
            ot-ratelimit-event-id:
              schema:
                description: The unique identifier for the rate-limiting event.
                format: uuid
            ot-request-made:
              schema:
                description: The number of requests made within the specified period.
                format: int32
            ot-requests-allowed:
              schema:
                description: The number of requests allowed within the specified period.
                format: int32
        '500':
          description: Internal Server Error
      security:
      - OAUTH2:
        - POLICY
        - POLICY_READ
  /v1/{complianceType}/{id}/details:
    get:
      operationId: getPolicy
      summary: Get Document
      description: Use this API to retrieve details for the specified policy, standard, procedure, or privacy notice.
      tags:
      - Documents
      x-onetrust:
        spec-label: https://developer.onetrust.com/onetrust/openapi/tech-risk-compliance-enterprise-policy-management.json
      parameters:
      - name: complianceType
        in: path
        description: The type of compliance document.
        required: true
        schema:
          type: string
          enum:
          - policies
          - standards
          - procedures
          - privacynotices
        example: policies
      - name: id
        in: path
        description: The unique identifier of the policy, standard, procedure, or privacy notice. This value is obtained using the [Get List of Documents API](/onetrust/reference/getlatestpolicies).
        required: true
        schema:
          type: string
          format: uuid
        example: 6756206c-845c-4ecc-8826-0e25d12b0d0c
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyApiResponse'
        '400':
          description: Bad Request
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '429':
          description: "Too Many Requests. \nFor more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview)."
          headers:
            Retry-After:
              schema:
                description: The number of seconds after which requests will be allowed again.
                format: int32
            ot-period:
              schema:
                description: The unit of time for which the rate limit applies
                enum:
                - HOUR
                - MINUTE
            ot-ratelimit-event-id:
              schema:
                description: The unique identifier for the rate-limiting event.
                format: uuid
            ot-request-made:
              schema:
                description: The number of requests made within the specified period.
                format: int32
            ot-requests-allowed:
              schema:
                description: The number of requests allowed within the specified period.
                format: int32
        '500':
          description: Internal Server Error
      security:
      - OAUTH2:
        - POLICY
        - POLICY_READ
  /v1/{complianceType}/{id}/published-version:
    get:
      operationId: getPublishedPolicyVersion
      summary: Get Document Version
      description: Use this API to retrieve the last published version of a policy, standard, procedure, or privacy notice by the specified date.
      tags:
      - Documents
      x-onetrust:
        spec-label: https://developer.onetrust.com/onetrust/openapi/tech-risk-compliance-enterprise-policy-management.json
      parameters:
      - name: complianceType
        in: path
        description: The type of compliance document.
        required: true
        schema:
          type: string
          enum:
          - policies
          - standards
          - procedures
          - privacynotices
        example: policies
      - name: id
        in: path
        description: The unique identifier of the policy, standard, procedure, or privacy notice. This value is obtained using the [Get List of Documents API](/onetrust/reference/getlatestpolicies).
        required: true
        schema:
          type: string
          format: uuid
        example: 41955b71-e581-4187-ab6c-d00d1403350c
      - name: date
        in: query
        description: The date and time on which the policy, standard, procedure, or privacy notice was published.
        required: true
        schema:
          type: string
          pattern: ^\d{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])(T([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]))?$
        example: '2024-12-13T23:59:59'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyApiResponse'
        '400':
          description: Bad Request
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '429':
          description: "Too Many Requests. \nFor more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview)."
          headers:
            Retry-After:
              schema:
                description: The number of seconds after which requests will be allowed again.
                format: int32
            ot-period:
              schema:
                description: The unit of time for which the rate limit applies
                enum:
                - HOUR
                - MINUTE
            ot-ratelimit-event-id:
              schema:
                description: The unique identifier for the rate-limiting event.
                format: uuid
            ot-request-made:
              schema:
                description: The number of requests made within the specified period.
                format: int32
            ot-requests-allowed:
              schema:
                description: The number of requests allowed within the specified period.
                format: int32
        '500':
          description: Internal Server Error
      security:
      - OAUTH2:
        - POLICY
        - POLICY_READ
  /v1/{complianceType}/{policyId}/versions/create:
    post:
      operationId: createPolicyVersions
      summary: Create Document Version
      description: Use this API to create a new version of a policy, standard, or procedure.
      tags:
      - Documents
      x-onetrust:
        spec-label: https://developer.onetrust.com/onetrust/openapi/tech-risk-compliance-enterprise-policy-management.json
      parameters:
      - name: complianceType
        in: path
        description: The type of compliance document.
        required: true
        schema:
          type: string
          enum:
          - policies
          - standards
          - procedures
        example: policies
      - name: policyId
        in: path
        description: The unique identifier of the policy, standard, or procedure. This value is obtained using the [Get List of Documents API](/onetrust/reference/getlatestpolicies).
        required: true
        schema:
          type: string
          format: uuid
        example: 2039a744-6bd4-47a7-af11-1b4ad49c0c04
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: array
              items:
                $ref: '#/components/schemas/PolicyVersionCreateApiRequest'
            example: "[\n {\n \"policyContentType\": \"PDF\",\n \"attachmentId\": \"bfdb6840-6e0a-4a3d-9385-a611dbbadca3\",\n \"publishVersionType\" : \"Minor\",\n \"versionSequence\" : 3,\n \"status\" : \"DRAFT\",\n \"descriptionOfChanges\" : null\n },\n {\n \"policyContentType\": \"PDF\",\n \"attachmentId\": \"bfdb6840-6e0a-4a3d-9385-a611dbbadca3\",\n \"publishVersionType\" : \"Major\",\n \"versionSequence\" : 2,\n \"status\" : \"PUBLISHED\",\n \"descriptionOfChanges\" : \"description version 2\"\n },\n {\n \"policyContentType\": \"PDF\",\n \"attachmentId\": \"bfdb6840-6e0a-4a3d-9385-a611dbbadca3\",\n \"versionSequence\" : 1,\n \"status\" : \"ARCHIVED\",\n }\n]"
      responses:
        '201':
          description: Created
        '400':
          description: Bad Request
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '429':
          description: "Too Many Requests. \nFor more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview)."
          headers:
            Retry-After:
              schema:
                description: The number of seconds after which requests will be allowed again.
                format: int32
            ot-period:
              schema:
                description: The unit of time for which the rate limit applies
                enum:
                - HOUR
                - MINUTE
            ot-ratelimit-event-id:
              schema:
                description: The unique identifier for the rate-limiting event.
                format: uuid
            ot-request-made:
              schema:
                description: The number of requests made within the specified period.
                format: int32
            ot-requests-allowed:
              schema:
                description: The number of requests allowed within the specified period.
                format: int32
        '500':
          description: Internal Server Error
      security:
      - OAUTH2:
        - POLICY
components:
  schemas:
    PolicyListApiResponse:
      type: object
      properties:
        guid:
          description: The unique identifier of the policy, standard, procedure, or privacy notice.
          type: string
          format: uuid
        organizationName:
          description: The name of the organization responsible for the policy, standard, procedure, or privacy notice.
          type: string
        name:
          description: The name of the policy, standard, procedure, or privacy notice.
          type: string
        description:
          description: The description of the policy, standard, procedure, or privacy notice.
          type: string
        owners:
          description: The details of the user(s) responsible for creating and updating the policy, standard, procedure, or privacy notice.
          type: array
          items:
            $ref: '#/components/schemas/OwnerResponse'
        approvers:
          description: The details of the user(s) responsible for approving all drafts and changes made to the policy, standard, procedure, or privacy notice.
          type: array
          items:
            $ref: '#/components/schemas/ApproverResponse'
        effectiveDate:
          description: The date on which the policy, standard, procedure, or privacy notice takes effect.
          type: string
          format: date
          example: '2024-12-13'
        expirationDate:
          description: The date on which the policy, standard, procedure, or privacy notice expires.
          type: string
          format: date
          example: '2024-12-31'
        id:
          description: The unique identifier of the policy, standard, procedure, or privacy notice.
          type: integer
          format: int64
        defaultLanguageCode:
          description: 'The default language of the policy, standard, procedure, or privacy notice.


            For more information, see [Supported Languages and HTML Language Codes.](https://developer.onetrust.com/onetrust/reference/supported-languages-and-html-language-codes-1)'
          type: string
          pattern: ^[a-z]{2}(-[a-z]{2})?$
        createdDate:
          description: The date and time on which the policy, standard, procedure, or privacy notice was created.
          type: string
          format: date-time
        organizationId:
          description: The unique identifier of the organization responsible for the policy, standard, procedure, or privacy notice.
          type: string
          format: uuid
    PolicyVersionCreateApiRequest:
      type: object
      properties:
        policyContentType:
          description: The method used to build the policy, standard, or procedure.
          type: string
          enum:
          - PDF
          - MS_WOPI
        attachmentId:
          description: The unique identifier of the file attached to the policy, standard, or procedure. This value is obtained using the [Upload File API](/onetrust/reference/fileupload).
          type: string
          format: uuid
        publishVersionType:
          description: The version type of the policy, standard, or procedure.
          type: string
          enum:
          - Major
          - Minor
        versionSequence:
          description: The version number of the policy, standard, or procedure. The number should be incremented to the next major or minor version based on the `publishVersionType` parameter.
          type: integer
          format: int32
        status:
          description: The publish status for the version of the policy, standard, or procedure.
          type: string
          enum:
          - DRAFT
          - PUBLISHED
          - ARCHIVED
        descriptionOfChanges:
          description: The description of changes made to the policy, standard, or procedure for the version.
          type: string
          maxLength: 10000
          minLength: 0
      required:
      - policyContentType
      - status
      - versionSequence
    OwnerAssignmentRequest:
      type: object
      properties:
        id:
          description: The unique identifier of the policy, standard, procedure, or privacy notice owner. This value is obtained using the [Get List of Users API](/onetrust/reference/getusers).
          type: string
          format: uuid
      required:
      - id
    ApproverResponse:
      type: object
      properties:
        id:
          description: The unique identifier of a policy, standard, procedure, or privacy notice approver.
          type: string
          format: uuid
        name:
          description: The name of a policy, standard, procedure, or privacy notice approver.
          type: string
        email:
          description: The email address of a policy, standard, procedure, or privacy notice approver.
          type: string
          format: email
    ApproverAssignmentRequest:
      type: object
      properties:
        id:
          description: The unique identifier of the policy, standard, procedure, or privacy notice approver. This value is obtained using the [Get List of Users API](/onetrust/reference/getusers).
          type: string
          format: uuid
      required:
      - id
    PolicyCreationApiRequest:
      type: object
      properties:
        orgGroup:
          description: The details of the organization responsible for the policy, standard, procedure, or privacy notice.
          $ref: '#/components/schemas/OrgGroupAssignmentRequest'
        name:
          description: The name of the policy, standard, procedure, or privacy notice.
          type: string
          maxLength: 200
          minLength: 1
        description:
          description: The description of the policy, standard, procedure, or privacy notice.
          type: string
          maxLength: 2000
          minLength: 0
        effectiveDate:
          description: The date on which the policy, standard, procedure, or privacy notice takes effect.
          type: string
          format: date
          example: '2024-12-13'
        expirationDate:
          description: The date on which the policy, standard, procedure, or privacy notice expires.
          type: string
          format: date
          example: '2024-12-31'
        approvers:
          description: The details of the user(s) responsible for approving all drafts and changes made to the policy, standard, procedure, or privacy notice.
          type: array
          items:
            $ref: '#/components/schemas/ApproverAssignmentRequest'
        owners:
          description: The details of the user(s) responsible for creating and updating the policy, standard, procedure, or privacy notice.
          type: array
          items:
            $ref: '#/components/schemas/OwnerAssignmentRequest'
        defaultLanguageCode:
          description: The default language of the policy, standard, procedure, or privacy notice.
          type: string
          pattern: ^[a-z]{2}(-[a-z]{2})?$
      required:
      - approvers
      - defaultLanguageCode
      - name
      - orgGroup
      - owners
    OrgGroupResponse:
      type: object
      properties:
        id:
          description: The unique identifier of the organization responsible for the policy, standard, procedure, or privacy notice.
          type: string
          format: uuid
        name:
          description: The name of the organization responsible for the policy, standard, procedure, or privacy notice.
          type: string
    PolicyApiResponse:
      type: object
      properties:
        guid:
          description: The unique identifier of the policy, standard, procedure, or privacy notice.
          type: string
          format: uuid
        name:
          description: The name of the policy, standard, procedure, or privacy notice.
          type: string
        description:
          description: The description of the policy, standard, procedure, or privacy notice.
          type: string
        orgGroup:
          description: The details of the organization responsible for the policy, standard, procedure, or privacy notice.
          $ref: '#/components/schemas/OrgGroupResponse'
        owners:
          description: The details of the user(s) responsible for creating and updating the policy, standard, procedure, or privacy notice.
          type: array
          items:
            $ref: '#/components/schemas/OwnerResponse'
        approvers:
          description: The details of the user(s) responsible for approving all drafts and changes made to the policy, standard, procedure, or privacy notice.
          type: array
          items:
            $ref: '#/components/schemas/ApproverResponse'
        effectiveDate:
          description: The date on which the policy, standard, procedure, or privacy notice takes effect.
          type: string
          format: date
          example: '2024-12-13'
        expirationDate:
          description: The date on which the policy, standard, procedure, or privacy notice expires.
          type: string
          format: date
          example: '2024-12-31'
        id:
          description: The unique identifier of the policy, standard, procedure, or privacy notice.
          type: integer
          format: int64
        defaultLanguageCode:
          description: 'The default language of the policy, standard, procedure, or privacy notice.


            For more information, see [Supported Languages and HTML Language Codes.](https://developer.onetrust.com/onetrust/reference/supported-languages-and-html-language-codes-1)'
          type: string
          pattern: ^[a-z]{2}(-[a-z]{2})?$
        versions:
          description: The details of the versions of the policy, standard, procedure, or privacy notice.
          type: array
          items:
            $ref: '#/components/schemas/PolicyVersionApiResponse'
    PolicyVersionApiResponse:
      type: object
      properties:
        id:
          description: The unique identifier for a specific version of a policy, standard, procedure, or privacy notice.
          type: string
          format: uuid
        attachmentId:
          description: The unique identifier of a file attached to a policy, standard, procedure, or privacy notice.
          type: string
          format: uuid
        descriptionOfChanges:
          description: The description of changes made to a policy, standard, procedure, or privacy notice for a version.
          type: string
          maxLength: 10000
          minLength: 0
        publishedDate:
          description: The date and time on which a version of a policy, standard, procedure, or privacy notice was published.
          type: string
          format: date-time
        createdDate:
          description: The date and time on which a version of a policy, standard, procedure, or privacy notice was created.
          type: string
          format: date-time
        versionStatus:
          description: The status of a policy, standard, procedure, or privacy notice version.
          type: string
          enum:
          - DRAFT
          - PUBLISHED
          - ARCHIVED
        policyContentType:
          description: The method used to build a policy, standard, procedure, or privacy notice.
          type: string
          enum:
          - ONETRUST
          - MS_WOPI
          - PDF
        sections:
          description: The sections of a policy, standard, procedure, or privacy notice.
          type: array
          items:
            $ref: '#/components/schemas/PolicyVersionSectionResponse'
        majorVersion:
          description: The number of major versions created for a policy, standard, procedure, or privacy notice.
          type: integer
          format: int64
        minorVersion:
          description: The number of minor versions created for a policy, standard, procedure, or privacy notice.
          type: integer
          format: int64
    PolicyVersionSectionResponse:
      type: object
      properties:
        name:
          description: The name of a section within a policy, standard, procedure, or privacy notice.
          type: string
        description:
          description: The description of a section within a policy, standard, procedure, or privacy notice.
          type: string
        content:
          description: The content of a section within a policy, standard, procedure, or privacy notice.
          type: string
        sectionType:
          description: The type of section within a policy, standard, procedure, or privacy notice.
          type: string
          enum:
          - PLAIN
          - TEMPLATE
        order:
          description: The numerical order in which a section appears within a policy, standard, procedure, or privacy notice.
          type: integer
          format: int32
    OrgGroupAssignmentRequest:
      type: object
      properties:
        id:
          description: The unique identifier of the organization responsible for the policy, standard, procedure, or privacy notice.. This value is obtained using the [Get List of Organizations API](/onetrust/reference/organizationtreestructureusingget).
          type: string
          format: uuid
        name:
          description: The name of the organization responsible for the policy, standard, procedure, or privacy notice.
          type: string
          minLength: 1
      required:
      - id
      - name
    OwnerResponse:
      type: object
      properties:
        id:
          description: The unique identifier of a policy, standard, procedure, or privacy notice owner.
          type: string
          format: uuid
        name:
          description: The name of a policy, standard, procedure, or privacy notice owner.
          type: string
        email:
          description: The email address of a policy, standard, procedure, or privacy notice owner.
          type: string
          format: email
  securitySchemes:
    OAUTH2:
      type: oauth2
      flows:
        clientCredentials:
          tokenUrl: https://{hostname}/api/access/v1/oauth/token
          scopes:
            POLICY: Policy scope for external systems.
            POLICY_READ: Policy read scope for external systems.
x-onetrust:
  spec-label: OpenAPI 3.1.0
  links:
  - '[{''Policy Management Knowledge Base'': ''https://my.onetrust.com/s/topic/0TO1Q000000bHfCWAU/policy-management''}]'
x-readme:
  explorer-enabled: false
  proxy-enabled: false
  metrics-enabled: false