REST API · OpenAPI 3.0 · v2.1

The complete API for
DPDP Act compliance.

188 endpoints across 25 tag groups. Consent collection, rights fulfilment, breach response, DPIA governance, webhook propagation — all programmatically accessible with cryptographic proof on every write.

188
Endpoints
25
Tag Groups
<50ms
Status Lookup
Open Swagger UI Quick Start 
# Step 1 — Request OTP
curl -X POST https://api.vishwaasai.in/api/v1/auth/request-otp \
  -H "Content-Type: application/json" \
  -d '{"email": "admin@acme-corp.in"}'

# Step 2 — Verify OTP → receive JWT
curl -X POST https://api.vishwaasai.in/api/v1/auth/verify-otp \
  -H "Content-Type: application/json" \
  -d '{"email": "admin@acme-corp.in", "otp": "123456"}'

# Returns:
{
  "success": true,
  "data": {
    "access_token": "eyJhbGci...",
    "refresh_token": "eyJhbGci..."
  }
}
# Real-time status lookup — <50ms, Redis-cached
curl https://api.vishwaasai.in/api/v1/consent/status/dp_01HX.../mkt_email \
  -H "X-API-Key: <api_key>"

# Returns:
{
  "status": "active",
  "granted_at": "2026-03-01T10:22:00Z",
  "expires_at": null
}

# Batch lookup — up to 1,000 principals, <200ms
curl -X POST https://api.vishwaasai.in/api/v1/consent/batch-status \
  -H "X-API-Key: <api_key>" \
  -d '{"purpose_code":"mkt_email","dp_ids":["dp_01...","dp_02..."]}'
# Python — verify HMAC webhook signature
import hmac, hashlib

def verify_webhook(payload: bytes, secret: str, header_sig: str) -> bool:
    expected = "sha256=" + hmac.new(
        secret.encode(), payload, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, header_sig)

# Webhook event payload shape
{
  "event": "consent.withdrawn",
  "data_principal_id": "dp_01HX...",
  "purpose_code": "mkt_email",
  "timestamp": "2026-03-15T08:44:10Z",
  "record_hash": "sha256:a3f2..."
}
Base URL: https://api.vishwaasai.in/api/v1
Swagger →

JWT + API Key Auth

OTP flow · M2M API keys

Cryptographic Proof

SHA-256 · RSA · RFC 3161

Real-time Webhooks

HMAC-signed · <5 sec propagation

OpenAPI 3.0 Spec

JSON · YAML · Swagger UI

Quick Start

Get started in 3 steps

Authenticate, collect your first consent record, and verify its cryptographic integrity — in under 5 minutes.

1

Request OTP & receive JWT

POST /auth/request-otp 
curl -X POST https://api.vishwaasai.in/api/v1/auth/request-otp \
  -H "Content-Type: application/json" \
  -d '{"email": "admin@your-org.in"}'

# Then verify the OTP from your inbox:
curl -X POST https://api.vishwaasai.in/api/v1/auth/verify-otp \
  -H "Content-Type: application/json" \
  -d '{"email": "admin@your-org.in", "otp": "123456"}'
# → { "access_token": "...", "refresh_token": "..." }
2

Collect your first consent record

POST /consent/collect 
curl -X POST https://api.vishwaasai.in/api/v1/consent/collect \
  -H "Authorization: Bearer <access_token>" \
  -H "Content-Type: application/json" \
  -d '{
    "data_principal_id": "dp_01HX...",
    "purpose_code":      "mkt_email",
    "channel":           "api",
    "consent_text":      "I agree to receive marketing emails"
  }'

# Response includes full proof chain:
{
  "id":                "cr_01J...",
  "status":            "active",
  "record_hash":       "sha256:a3f2b1...",
  "chain_hash":        "sha256:9c1bd2...",
  "digital_signature": "RSA-PSS:...",
  "tsa_token":         "RFC3161:..."
}
3

Verify hash chain integrity

POST /consent/verify-integrity/:id 
curl -X POST https://api.vishwaasai.in/api/v1/consent/verify-integrity/cr_01J... \
  -H "Authorization: Bearer <access_token>"

# Returns:
{
  "integrity_valid": true,
  "chain_position":  247,
  "verified_at":     "2026-03-15T09:00:01Z"
}
Authentication

Authentication

All API calls (except public endpoints and health checks) require one of two auth methods depending on context.

JWT Bearer Token

For human admin users. Obtained via OTP flow. Rate-limited: 3 OTP requests per 5 minutes per email.

Authorization: Bearer <token>

API Key

For machine-to-machine (M2M) integrations. Configure via Settings → API Keys. Scoped per tenant.

X-API-Key: <api_key>

Tag 1 — Auth

9 endpoints
POST/auth/request-otpRequest a 6-digit OTP (rate-limited: 3/5min/email)
POST/auth/verify-otpVerify OTP → receive JWT access + refresh tokens
POST/auth/refreshRefresh access token using refresh token
POST/auth/logoutInvalidate current session
GET/auth/meGet current authenticated user profile
PUT/auth/meUpdate profile (name, language preference)
POST/portal/auth/request-otpOTP for data principal portal login
POST/portal/auth/verify-otpVerify OTP → receive portal JWT
POST/portal/auth/refreshRefresh portal session
Standard Format

Response Envelope

All API responses follow a consistent envelope structure regardless of endpoint.

{
  "success": true,
  "data": { /* response payload */ },
  "meta": {
    "page":  1,
    "limit": 20,
    "total": 150
  },
  "errors": [
    { "code": "VALIDATION_ERROR", "message": "...", "field": "purpose_code" }
  ]
}
200 OK

success: true · data populated

401 UNAUTHORIZED

Missing or expired JWT / API Key

422 UNPROCESSABLE

Zod DTO validation failure — errors array populated

Tag 5

Notices

13 endpoints

Versioning, multilingual authoring, legal review, DPO approval workflow, and delivery tracking. Every published notice is locked and auditable.

GET/noticesList privacy notices
POST/noticesCreate a new notice
GET/notices/:id/versionsAll versions of a notice (full version history)
POST/notices/:id/publishPublish a notice version (content locked after publish)
POST/notices/:id/legal-reviewSubmit notice for legal review
POST/notices/:id/dpo-approveDPO approves a notice
GET/notices/public/:tenantSlugPUBLICLatest published notice for tenant — no auth required
POST/notices/:id/deliver/:dpIdDeliver a notice to a specific data principal
Tag 6

Data Principal Rights (DPR)

15 endpoints

Access, correction, erasure, grievance, and nomination flows with SLA visibility, identity verification, evidence output, and DPBI escalation path.

GET/dprList DPR requests (filterable by type, status, SLA)
POST/dprSubmit a new DPR request
POST/dpr/:id/verify-identityRecord identity verification method and status
POST/dpr/:id/escalate-dpbiEscalate to DPBI (adds to escalation log)
GET/dpr/erasure-jobsList erasure jobs across all DPR requests
GET/dpr/reportDPR performance report (signed PDF/Excel)
POST/portal/dprPORTALSubmit a rights request as a data principal
Tag 7

Breach Management

12 endpoints

72-hour clock awareness, DPBI notification, principal alerts, remediation tracking. Reporting a breach immediately starts the countdown timer.

POST/breachesReport a breach — starts 72-hour DPBI clock
GET/breaches/:idGet breach details with live DPBI countdown
POST/breaches/:id/notify-dpbiSubmit DPBI notification (marks timestamp)
POST/breaches/:id/notify-principalsDispatch principal alert emails at scale
POST/breaches/:id/add-remediationAdd a remediation step with evidence
POST/breaches/:id/closeClose incident (requires DPO sign-off)
GET/breaches/registerBreach Register export (signed PDF)
Tag 8

DPIA & Governance

13 endpoints

Structured assessment, DPO sign-off, risk tracking, certificates, and signed register exports.

GET/dpiasList all DPIAs
POST/dpiasCreate a new DPIA
POST/dpias/:id/submit-reviewSubmit for DPO review
POST/dpias/:id/approveDPO approves a DPIA
POST/dpias/:id/risksAdd a risk to a DPIA
GET/dpias/:id/certificateGenerate DPIA certificate (signed PDF)
GET/dpias/registerDPIA Register export (signed PDF)
Tag 9

Vendor Management

9 endpoints

Processor visibility, DPA status, assessment cadence, cross-border oversight, and signed risk reports.

GET/vendorsList all vendors
POST/vendorsOnboard a new vendor
POST/vendors/:id/assessCreate a vendor assessment
PUT/vendors/:id/dpaUpload / update Data Processing Agreement
POST/vendors/:id/cross-borderDocument a cross-border transfer arrangement
GET/vendors/reportVendor Risk Report (signed PDF)
Tag 14

Consent Propagation

14 endpoints

Downstream webhook management, HMAC-signed delivery, dead-letter queue, retry logic, and propagation monitoring. Withdrawal events propagate in <5 seconds.

GET/propagation/webhooksList registered webhooks
POST/propagation/webhooksRegister a new webhook
POST/propagation/webhooks/:id/testSend a test event to a webhook
POST/propagation/webhooks/:id/rotate-secretRotate HMAC signing secret
GET/propagation/monitorDashboard: delivered / retrying / dead-letter
POST/propagation/dead-letter/:id/retryRetry a dead-letter item
GET/propagation/downstream-appsList registered downstream applications
Tags 11–13

Identity Resolution & Unified Profiles

28 endpoints

Source system connectors, identity resolution rules, human review queue, and canonical unified profile access including identity graph and data asset map.

POST/source-systemsRegister a new source system (CRM, HRIS, etc.)
POST/source-systems/:id/syncTrigger a manual sync
POST/identity-resolution/runTrigger an identity resolution pass
POST/identity-resolution/queue/:id/approveApprove a match (creates canonical link)
GET/unified-profiles/:idUnified profile: consent history, identity graph, data asset map
GET/unified-profiles/:id/identity-graphAll external IDs linked to this principal
GET/unified-profiles/:id/consent-timelineFull consent history (signed PDF export)
Tag 15

Dashboard

8 endpoints
GET/dashboardTenant compliance dashboard (KPIs, posture score)
GET/dashboard/consent-metricsConsent collection trends and rates
GET/dashboard/dpr-metricsDPR queue stats, SLA compliance, completion rate
GET/dashboard/risk-heatmapData asset × processing risk matrix
GET/dashboard/activity-feedLive stream of compliance-significant events
POST/dashboard/reportGenerate a compliance report (PDF/Excel)
All Tag Groups

All 25 API Tag Groups

Full reference across all 188 endpoints. Browse the interactive Swagger UI for request/response schemas, DTOs, and live test execution.

Tag Group Endpoints
01Auth9
02Tenant Management25
03Consent17
04Campaigns7
05Notices13
06DPR15
07Breach12
08DPIA13
09Vendor9
10Data Map7
11Source Systems12
12Identity Resolution10
13Unified Profiles6
14Consent Propagation14
15Dashboard8
16Portal13
17Cookie9
18Integration9
19Audit3
20Training8
21Settings13
22Notification1
23Health2
24Data Principals6
25Reports3
Total188
Environments

Environments & Swagger UI

QA Environment

Safe sandbox for integration testing. Use MailHog to intercept OTP emails. No real data.

Base: trust.crossidentityqa.com/api/v1
Swagger UI → trust.crossidentityqa.com/api/docs

Production

Live environment. AWS Mumbai (ap-south-1). All writes cryptographically signed and stored with 7-year retention.

Base: api.vishwaasai.in/api/v1
Swagger UI → api.vishwaasai.in/api/docs

What the interactive Swagger UI gives you

▪

Browse all 188 endpoints across 25 tag groups

▪

Execute API calls directly from the browser with JWT auth

▪

View request/response schemas (Zod-validated DTOs)

▪

Download the OpenAPI 3.0 spec as JSON or YAML

Open Swagger UI Request API Access