# GDPR

**Summary:** Endpoints for GDPR

- Role: [Developers](https://www.subrite.no/developers)
- Source: https://www.subrite.no/developers/gdpr
- Updated: 2026-10-13
- Markdown index: https://www.subrite.no/developers/llms.txt

<a id="get-api-v1-gdpr-self-assessment"></a>
## Get the current tenant's GDPR self-assessment

`GET /api/v1/gdpr/self-assessment`

**Authentication:** Bearer token (JWT)

### Responses

#### 200

Content type: `application/json` · `GdprSelfAssessmentResponseDto`

| Name | Type | Description |
| --- | --- | --- |
| `id` (Required) | `number` |   |
| `version` (Required) | `number` |   |
| `status` (Required) | `string` | Allowed values: `"not_started"`, `"in_progress"`, `"completed"` |
| `choices` (Required) | `object with string values` | Map of optional processing-area id to the chosen legal basis |
| `customerWindowMonths` (Required) | `number` | Months after a subscription ends during which the member is still an existing customer for marketing (0 = active subscriptions only) |
| `completedAt` (Required) | `string (date-time)` | Can be null |
| `lastReviewedByName` (Required) | `string` | Can be null |
| `lastReviewedByRole` (Required) | `string` | Can be null |
| `lastReviewedAt` (Required) | `string (date-time)` | Can be null |

#### 401

unauthorized

#### 403

Content type: `application/json` · `ErrorResponse`

forbiddenResource

| Name | Type | Description |
| --- | --- | --- |
| `messageCode` (Required) | `string` |   |
| `message` | `string` |   |
| `errors` (Required) | `array of FieldError` |   |
| `errors[].field` (Required when parent is present) | `string` |   |
| `errors[].fieldValue` (Required when parent is present) | `string` |   |
| `errors[].identifier` (Required when parent is present) | `string` |   |
| `errors[].identifierValue` (Required when parent is present) | `string` |   |
| `errors[].messageCode` (Required when parent is present) | `string` |   |
| `errors[].message` | `string` |   |
| `errors[].errorType` (Required when parent is present) | `string` |   |

**Example response**

`application/json`

```json
{
  "messageCode": "string",
  "message": "string",
  "errors": [
    {}
  ]
}
```

#### 500

Content type: `application/json` · `ErrorResponse`

internalServerError

Same fields as [Get the current tenant's GDPR self-assessment (403)](https://www.subrite.no/developers/gdpr?md=true#get-api-v1-gdpr-self-assessment).

### Example request

```bash
curl https://api.subrite.no/api/v1/gdpr/self-assessment \
  --header 'Authorization: Bearer <token>'
```

### Example response

200 · `application/json`

```json
{
  "id": 0,
  "version": 0,
  "status": "not_started",
  "choices": {
    "property1": "legitimate_interests",
    "property2": "legitimate_interests"
  },
  "customerWindowMonths": 0,
  "completedAt": "2019-08-24T14:15:22Z",
  "lastReviewedByName": "string",
  "lastReviewedByRole": "string",
  "lastReviewedAt": "2019-08-24T14:15:22Z"
}
```

<a id="put-api-v1-gdpr-self-assessment"></a>
## Save the GDPR self-assessment choices

`PUT /api/v1/gdpr/self-assessment`

**Authentication:** Bearer token (JWT)

### Request body

Content type: `application/json` · Required · `SaveGdprSelfAssessmentDto`

| Name | Type | Description |
| --- | --- | --- |
| `choices` (Required) | `object with string values` | Map of optional processing-area id to the chosen legal basis |
| `customerWindowMonths` | `number` | Months after a subscription ends during which the member is still an existing customer for marketing (0 = active subscriptions only). Omit to keep the stored value. · Allowed values: `0`, `3`, `6`, `12` |

**Example request body**

`application/json`

```json
{
  "choices": {
    "email-mkt": "consent",
    "podcast": "legitimate_interests"
  },
  "customerWindowMonths": 3
}
```

### Responses

#### 200

Content type: `application/json` · `GdprSelfAssessmentResponseDto`

Same fields as [Get the current tenant's GDPR self-assessment (200)](https://www.subrite.no/developers/gdpr?md=true#get-api-v1-gdpr-self-assessment).

#### 401

unauthorized

#### 403

Content type: `application/json` · `ErrorResponse`

forbiddenResource

Same fields as [Get the current tenant's GDPR self-assessment (403)](https://www.subrite.no/developers/gdpr?md=true#get-api-v1-gdpr-self-assessment).

**Example response**

`application/json`

```json
{
  "messageCode": "string",
  "message": "string",
  "errors": [
    {}
  ]
}
```

#### 500

Content type: `application/json` · `ErrorResponse`

internalServerError

Same fields as [Get the current tenant's GDPR self-assessment (403)](https://www.subrite.no/developers/gdpr?md=true#get-api-v1-gdpr-self-assessment).

### Example request

```bash
curl https://api.subrite.no/api/v1/gdpr/self-assessment \
  --request PUT \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{
  "choices": {
    "email-mkt": "consent",
    "podcast": "legitimate_interests"
  },
  "customerWindowMonths": 3
}'
```

### Example response

200 · `application/json`

```json
{
  "id": 0,
  "version": 0,
  "status": "not_started",
  "choices": {
    "property1": "legitimate_interests",
    "property2": "legitimate_interests"
  },
  "customerWindowMonths": 0,
  "completedAt": "2019-08-24T14:15:22Z",
  "lastReviewedByName": "string",
  "lastReviewedByRole": "string",
  "lastReviewedAt": "2019-08-24T14:15:22Z"
}
```

<a id="get-api-v1-gdpr-self-assessment-customer-window-counts"></a>
## Count former customers each customer-relationship window would still treat as existing customers

`GET /api/v1/gdpr/self-assessment/customer-window-counts`

**Authentication:** Bearer token (JWT)

### Responses

#### 200

Content type: `application/json` · `GdprCustomerWindowCountsResponseDto`

| Name | Type | Description |
| --- | --- | --- |
| `windows` (Required) | `array of GdprCustomerWindowCountDto` |   |
| `windows[].windowMonths` (Required when parent is present) | `number` | Allowed values: `0`, `3`, `6`, `12` |
| `windows[].formerCustomers` (Required when parent is present) | `number` | Members with no active subscription whose last subscription ended within this window |

#### 401

unauthorized

#### 403

Content type: `application/json` · `ErrorResponse`

forbiddenResource

Same fields as [Get the current tenant's GDPR self-assessment (403)](https://www.subrite.no/developers/gdpr?md=true#get-api-v1-gdpr-self-assessment).

**Example response**

`application/json`

```json
{
  "messageCode": "string",
  "message": "string",
  "errors": [
    {}
  ]
}
```

#### 500

Content type: `application/json` · `ErrorResponse`

internalServerError

Same fields as [Get the current tenant's GDPR self-assessment (403)](https://www.subrite.no/developers/gdpr?md=true#get-api-v1-gdpr-self-assessment).

### Example request

```bash
curl https://api.subrite.no/api/v1/gdpr/self-assessment/customer-window-counts \
  --header 'Authorization: Bearer <token>'
```

### Example response

200 · `application/json`

```json
{
  "windows": [
    {}
  ]
}
```

<a id="get-api-v1-gdpr-self-assessment-history"></a>
## Get the GDPR self-assessment audit history, newest first

`GET /api/v1/gdpr/self-assessment/history`

**Authentication:** Bearer token (JWT)

### Parameters

| Name | In | Type | Description |
| --- | --- | --- | --- |
| `page` | query | `number` | Default: `1` · `minimum`: `1` |
| `take` | query | `number` | Default: `10` · `minimum`: `1`, `maximum`: `50` |
| `orderBy` | query | `string` | Allowed values: `"createdAt"`, `"id"`, `"updatedAt"` · Default: `"createdAt"` |
| `orderDirection` | query | `string` | Allowed values: `"asc"`, `"desc"` · Default: `"desc"` |

### Responses

#### 200

Content type: `application/json` · `GdprHistoryItemResponseDtoPaginated`

| Name | Type | Description |
| --- | --- | --- |
| `items` (Required) | `array of GdprHistoryItemResponseDto` |   |
| `items[].id` (Required when parent is present) | `number` |   |
| `items[].action` (Required when parent is present) | `string` | Allowed values: `"started"`, `"choice_changed"`, `"window_changed"`, `"completed"`, `"reopened"`, `"downloaded"` |
| `items[].actorName` (Required when parent is present) | `string` |   |
| `items[].actorRole` (Required when parent is present) | `string` |   |
| `items[].detail` (Required when parent is present) | `string` | Can be null |
| `items[].createdAt` (Required when parent is present) | `string (date-time)` |   |
| `meta` (Required) | `PageMeta` |   |
| `meta.page` (Required) | `number` |   |
| `meta.take` (Required) | `number` |   |
| `meta.count` (Required) | `number` |   |
| `meta.pageCount` (Required) | `number` |   |
| `meta.hasPreviousPage` (Required) | `boolean` |   |
| `meta.hasNextPage` (Required) | `boolean` |   |

#### 401

unauthorized

#### 403

Content type: `application/json` · `ErrorResponse`

forbiddenResource

Same fields as [Get the current tenant's GDPR self-assessment (403)](https://www.subrite.no/developers/gdpr?md=true#get-api-v1-gdpr-self-assessment).

**Example response**

`application/json`

```json
{
  "messageCode": "string",
  "message": "string",
  "errors": [
    {}
  ]
}
```

#### 500

Content type: `application/json` · `ErrorResponse`

internalServerError

Same fields as [Get the current tenant's GDPR self-assessment (403)](https://www.subrite.no/developers/gdpr?md=true#get-api-v1-gdpr-self-assessment).

### Example request

```bash
curl https://api.subrite.no/api/v1/gdpr/self-assessment/history \
  --header 'Authorization: Bearer <token>'
```

### Example response

200 · `application/json`

```json
{
  "items": [
    {}
  ],
  "meta": {
    "page": 0,
    "take": 0,
    "count": 0,
    "pageCount": 0,
    "hasPreviousPage": true,
    "hasNextPage": true
  }
}
```

<a id="get-api-v1-gdpr-documents-self-assessment"></a>
## Download the GDPR self-assessment record as a PDF

`GET /api/v1/gdpr/documents/self-assessment`

**Authentication:** Bearer token (JWT)

### Responses

#### 200

#### 401

unauthorized

#### 403

Content type: `application/json` · `ErrorResponse`

forbiddenResource

Same fields as [Get the current tenant's GDPR self-assessment (403)](https://www.subrite.no/developers/gdpr?md=true#get-api-v1-gdpr-self-assessment).

**Example response**

`application/json`

```json
{
  "messageCode": "string",
  "message": "string",
  "errors": [
    {}
  ]
}
```

#### 500

Content type: `application/json` · `ErrorResponse`

internalServerError

Same fields as [Get the current tenant's GDPR self-assessment (403)](https://www.subrite.no/developers/gdpr?md=true#get-api-v1-gdpr-self-assessment).

### Example request

```bash
curl https://api.subrite.no/api/v1/gdpr/documents/self-assessment \
  --header 'Authorization: Bearer <token>'
```

<a id="get-api-v1-gdpr-documents-dpa"></a>
## Download the personalised Data Processing Agreement as a PDF

`GET /api/v1/gdpr/documents/dpa`

**Authentication:** Bearer token (JWT)

### Responses

#### 200

#### 401

unauthorized

#### 403

Content type: `application/json` · `ErrorResponse`

forbiddenResource

Same fields as [Get the current tenant's GDPR self-assessment (403)](https://www.subrite.no/developers/gdpr?md=true#get-api-v1-gdpr-self-assessment).

**Example response**

`application/json`

```json
{
  "messageCode": "string",
  "message": "string",
  "errors": [
    {}
  ]
}
```

#### 500

Content type: `application/json` · `ErrorResponse`

internalServerError

Same fields as [Get the current tenant's GDPR self-assessment (403)](https://www.subrite.no/developers/gdpr?md=true#get-api-v1-gdpr-self-assessment).

### Example request

```bash
curl https://api.subrite.no/api/v1/gdpr/documents/dpa \
  --header 'Authorization: Bearer <token>'
```