OneTrust

OneTrust Transactions API

The Transactions APIs are used to manage consent transactions.

Documentation GitHub OpenAPI

Business capability

Privacy & Data Protection Management BC-130.50

Operations 2

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

PUT /api/consentmanager/v1/transactions/withdraw/fordatasubject Withdraw consent on a data subject's behalf · Withdraw Consent on Behalf of a Data Subject #

Ask an LLM

“Can an admin withdraw consent for a customer who asked by phone?”

“Is recording who withdrew consent required?”

Tell an agent destructive · confirm first

Withdraw consent for {identifier} to purpose {PurposeId}, withdrawn by {withdrawnBy}.

On behalf of {identifier}, revoke purpose {PurposeId}; withdrawn by {withdrawnBy}, notes {Notes}.

GET /api/consentmanager/v1/transactions/withdraw/purpose/{purposeId} Withdraw a data subject's consent via link · Withdraw Data Subject's Consent #

Ask an LLM

“Can a data subject withdraw their own consent for one purpose through a simple GET link?”

“Where should the identifier go when withdrawing self-service consent?”

Tell an agent destructive · confirm first

Withdraw {identifier}'s own consent to purpose {purposeId}.

Record that {identifier} withdrew from purpose {purposeId} themselves.

Documentation

https://developer.onetrust.com/onetrust/reference/attribute-management

https://developer.onetrust.com/onetrust/reference/activity-log

https://developer.onetrust.com/onetrust/reference/preferences-v2

https://developer.onetrust.com/onetrust/reference/banner

https://developer.onetrust.com/onetrust/reference/consent-receipts

https://developer.onetrust.com/onetrust/reference/applications

https://developer.onetrust.com/onetrust/reference/categorizations

https://developer.onetrust.com/onetrust/reference/domain-data

https://developer.onetrust.com/onetrust/reference/preferences

https://developer.onetrust.com/onetrust/reference/mobile-app-data

https://developer.onetrust.com/onetrust/reference/privacy-notice-v2

https://developer.onetrust.com/onetrust/reference/collection-points

https://developer.onetrust.com/onetrust/reference/catalog-search-v1

https://developer.onetrust.com/onetrust/reference/classification

https://developer.onetrust.com/onetrust/reference/custom-scan

https://developer.onetrust.com/onetrust/reference/carbon-management

https://developer.onetrust.com/onetrust/reference/audit-records

https://developer.onetrust.com/onetrust/reference/bulk-export

https://developer.onetrust.com/onetrust/reference/attachments

https://developer.onetrust.com/onetrust/reference/system-credentials

https://developer.onetrust.com/onetrust/reference/inventory-relationships-v2

https://developer.onetrust.com/onetrust/reference/model-management

https://developer.onetrust.com/onetrust/reference/tasks

https://developer.onetrust.com/onetrust/reference/groups-v2

https://developer.onetrust.com/onetrust/reference/assessment-actions

https://developer.onetrust.com/onetrust/reference/inventory

https://developer.onetrust.com/onetrust/reference/inventory-1

https://developer.onetrust.com/onetrust/reference/drop-management

https://developer.onetrust.com/onetrust/reference/incidents

https://developer.onetrust.com/onetrust/reference/document-controller

https://developer.onetrust.com/onetrust/reference/audits

https://developer.onetrust.com/onetrust/reference/initiatives

https://developer.onetrust.com/onetrust/reference/document-attachments

https://developer.onetrust.com/onetrust/reference/issues

https://developer.onetrust.com/onetrust/reference/control-implementations

https://developer.onetrust.com/onetrust/reference/training

https://developer.onetrust.com/onetrust/reference/contracts

Specifications

https://artifacts.apis.io/onetrust/openapi/onetrust-transactions-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this

find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/onetrust:onetrust-transactions-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  title: Consent & Preferences - Universal Consent & Preference…
  version: '1.0'
  contact:
    name: OneTrust Support
    url: https://my.onetrust.com/s/contactsupport
  license:
    name: Apache 2.0
    url: https://www.apache.org/licenses/LICENSE-2.0
  description: The Universal Consent & Preference Management APIs are used to integrate external systems and streamline the flow of data with Universal Consent & Preference Management in the OneTrust Platform.
servers:
- url: https://{hostname}
  variables:
    hostname:
      default: hostname
      description: The OneTrust hostname such as app.onetrust.com, app-eu.onetrust.com, app-de.onetrust.com, app-uk.onetrust.com, app-apac.onetrust.com, trial.onetrust.com, or uat.onetrust.com.
tags:
- name: Transactions
  description: The Transactions APIs are used to manage consent transactions.
  externalDocs:
    description: OpenAPI 3.1.0 - Download Definition
    url: https://developer.onetrust.com/onetrust/openapi/consent-preferences-universal-consent-preference-management-oas.json
  x-displayName: Transactions
paths:
  /api/consentmanager/v1/transactions/withdraw/fordatasubject:
    put:
      operationId: withdrawTransactionBehalfOfDatasubjectUsingPUT
      summary: Withdraw Consent on Behalf of a Data Subject
      description: Use this API to withdraw consent on behalf of a data subject for a specific Purpose. The data subject identifier must be included either in the `identifier` query or header parameter, preferably passed in the header.
      tags:
      - Transactions
      x-onetrust:
        spec-label: https://developer.onetrust.com/onetrust/openapi/consent-preferences-universal-consent-preference-management-oas.json
      parameters:
      - name: identifier
        in: query
        description: Data Subject Identifier (prefer the header parameter).
        required: false
        schema:
          type: string
          example: user@example.com
        deprecated: true
      - name: identifier
        in: header
        description: Data Subject Identifier (prefer the header parameter).
        required: false
        schema:
          type: string
          example: user@example.com
      - name: withdrawnBy
        in: query
        description: User withdrawing consent on behalf of data subject.
        required: true
        schema:
          type: string
          example: admin@example.com
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ConsentPreferences-UniversalConsentPreferenceManag_WithdrawOnBehalfOfRequest'
      responses:
        '200':
          description: OK - Successfully withdrew consent on behalf of data subject
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ConsentPreferences-UniversalConsentPreferenceManag_TransactionWithdrawResult'
        '400':
          description: Bad Request
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '429':
          description: "Too Many Requests. \nFor more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview)."
          headers:
            Retry-After:
              schema:
                description: The number of seconds after which requests will be allowed again.
                format: int32
            ot-period:
              schema:
                description: The unit of time for which the rate limit applies
                enum:
                - HOUR
                - MINUTE
            ot-ratelimit-event-id:
              schema:
                description: The unique identifier for the rate-limiting event.
                format: uuid
            ot-request-made:
              schema:
                description: The number of requests made within the specified period.
                format: int32
            ot-requests-allowed:
              schema:
                description: The number of requests allowed within the specified period.
                format: int32
        '500':
          description: Internal Server Error
      deprecated: true
      security:
      - ConsentPreferences-UniversalConsentPreferenceManag_OAUTH2:
        - CONSENT
  /api/consentmanager/v1/transactions/withdraw/purpose/{purposeId}:
    get:
      operationId: withdrawTransactionByPurposeAndIdentifierUsingGET
      summary: Withdraw Data Subject's Consent
      description: 'Use this API to withdraw a data subject''s consent for a specific Purpose. The data subject identifier must be included either in the `identifier` query or header parameter, preferably passed in the header.


        > 🗒 Things to Know

        >

        > - This API is not designed to be used in synchronous workflows. As an alternative, the Create Consent Receipts API can be called.'
      tags:
      - Transactions
      x-onetrust:
        spec-label: https://developer.onetrust.com/onetrust/openapi/consent-preferences-universal-consent-preference-management-oas.json
      parameters:
      - name: identifier
        in: query
        description: Data Subject Identifier (prefer the header parameter).
        required: false
        schema:
          type: string
          example: user@example.com
        deprecated: true
      - name: identifier
        in: header
        description: Data Subject Identifier (prefer the header parameter).
        required: false
        schema:
          type: string
          example: user@example.com
      - name: purposeId
        in: path
        description: Unique Identifier for Purpose.
        required: true
        schema:
          type: string
          format: uuid
          example: 550e8400-e29b-41d4-a716-446655440000
      responses:
        '200':
          description: OK - Successfully withdrew consent
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ConsentPreferences-UniversalConsentPreferenceManag_TransactionWithdrawResult'
        '400':
          description: Bad Request
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '429':
          description: "Too Many Requests. \nFor more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview)."
          headers:
            Retry-After:
              schema:
                description: The number of seconds after which requests will be allowed again.
                format: int32
            ot-period:
              schema:
                description: The unit of time for which the rate limit applies
                enum:
                - HOUR
                - MINUTE
            ot-ratelimit-event-id:
              schema:
                description: The unique identifier for the rate-limiting event.
                format: uuid
            ot-request-made:
              schema:
                description: The number of requests made within the specified period.
                format: int32
            ot-requests-allowed:
              schema:
                description: The number of requests allowed within the specified period.
                format: int32
        '500':
          description: Internal Server Error
      deprecated: true
      security:
      - ConsentPreferences-UniversalConsentPreferenceManag_OAUTH2:
        - CONSENT
        - CONSENT_READ
components:
  schemas:
    ConsentPreferences-UniversalConsentPreferenceManag_TransactionWithdrawResult:
      type: object
      properties:
        Status:
          description: Message representing the consent withdrawal status
          type: string
          example: Consent withdrawn successfully
    ConsentPreferences-UniversalConsentPreferenceManag_WithdrawOnBehalfOfRequest:
      type: object
      properties:
        Notes:
          description: Additional notes to be recorded as part of withdrawal
          type: string
          example: Withdrawing consent as per data subject request
        PurposeId:
          description: Unique identifier of the purpose for which consent is being withdrawn
          type: string
          format: uuid
          example: f2229953-b4b5-4042-8cb9-b78038cc4c46
        Origin:
          description: Source or origin of the withdrawal request (e.g., IMPORT, API, SDK, ONETRUST, PREFERENCE_CENTER)
          type: string
          example: API
      required:
      - PurposeId
  securitySchemes:
    ConsentPreferences-UniversalConsentPreferenceManag_OAUTH2:
      type: oauth2
      flows:
        clientCredentials:
          tokenUrl: https://{hostname}/api/access/v1/oauth/token
          scopes:
            CONSENT: Consent Scope gives the user access to read/write operations
            CONSENT_READ: Consent Read Scope gives the user read-only access
    ConsentAPI_OAUTH2:
      type: oauth2
      flows:
        clientCredentials:
          tokenUrl: https://{hostname}/api/access/v1/oauth/token
          scopes:
            CONSENT: Consent Scope gives the user access to read/write operations
            CONSENT_READ: Consent Read Scope gives the user read-only access
    DSPreferneceCache_OAUTH2:
      type: oauth2
      flows:
        clientCredentials:
          tokenUrl: https://{hostname}/api/access/v1/oauth/token
          scopes:
            CONSENT: Consent Scope gives the user access to read/write operations
            CONSENT_READ: Consent Read Scope gives the user read-only access
x-readme:
  explorer-enabled: false
  proxy-enabled: false
  metrics-enabled: false
x-onetrust:
  spec-label: OpenAPI 3.1.0