---
title: "Submit a UU PDP breach notification"
method: POST
path: "/api/v1/ojk/breach/notify"
tags: ["OJK Compliance"]
---

# Submit a UU PDP breach notification

`POST /api/v1/ojk/breach/notify`

## Request

- Base URL: `https://orchestrator.getaxonflow.com`
- URL: `https://orchestrator.getaxonflow.com/api/v1/ojk/breach/notify`
- Auth: none declared
- TypeScript: <https://skmtc.dev/getaxonflow/apis/axonflow-orchestrator-api/docs/api/v1/ojk/breach/notify/post.ts> (a function with typed inputs; its response is checked against the schema)

Submits a personal-data breach notification per UU PDP Art. 46. The
server assigns the id, sets `notification_deadline` to
`discovery_time + 72h`, defaults `notified_authority` to `MOCDA`, and
stamps `submitted_at`. The returned `status` is normally `submitted`,
or `overdue` when the 72-hour deadline had already lapsed at
submission.

**Enterprise Feature**.

## Headers

- `X-Tenant-ID` string
- `X-Org-ID` string

## Request body

- OJKBreachNotification: UU PDP Art. 46 breach notification. On submission the server assigns id / created_at / submitted_at and computes notification_deadline (discovery_time + 72h) — client-supplied values for those fields are ignored. notified_authority defaults to MOCDA only when the client omits it; a supplied value is honored.
  - `id` string: Server-assigned
  - `incident_timestamp` string, date-time, required
  - `discovery_time` string, date-time, required
  - `notification_deadline` string, date-time: Server-computed (discovery_time + 72h)
  - `data_subjects_affected` integer, required
  - `data_types_involved` string[], required
  - `description` string, required
  - `remediation_steps` string[], required
  - `notified_authority` string: Defaults to MOCDA
  - `status` 'draft' | 'submitted' | 'acknowledged' | 'overdue' | 'failed'
  - `submitted_at` string, date-time
  - `acknowledged_at` string, date-time
  - `created_at` string, date-time

## Response `201`

Breach notification recorded

- OJKBreachNotification: UU PDP Art. 46 breach notification. On submission the server assigns id / created_at / submitted_at and computes notification_deadline (discovery_time + 72h) — client-supplied values for those fields are ignored. notified_authority defaults to MOCDA only when the client omits it; a supplied value is honored.
  - `id` string: Server-assigned
  - `incident_timestamp` string, date-time, required
  - `discovery_time` string, date-time, required
  - `notification_deadline` string, date-time: Server-computed (discovery_time + 72h)
  - `data_subjects_affected` integer, required
  - `data_types_involved` string[], required
  - `description` string, required
  - `remediation_steps` string[], required
  - `notified_authority` string: Defaults to MOCDA
  - `status` 'draft' | 'submitted' | 'acknowledged' | 'overdue' | 'failed'
  - `submitted_at` string, date-time
  - `acknowledged_at` string, date-time
  - `created_at` string, date-time

## Other responses

- `400`: Missing tenant headers (`missing_tenant`), malformed body (`invalid_request`), or validation failure (`validation_error`: incident_timestamp/discovery_time required, positive data_subjects_affected, data_types_involved / description / remediation_steps required per UU PDP Art. 46)
- `500`: Failed to submit breach notification (code `internal_error`)

---

[API](https://skmtc.dev/getaxonflow/apis/axonflow-orchestrator-api.md) - [All operations](https://skmtc.dev/getaxonflow/apis/axonflow-orchestrator-api/llms.txt) - [OpenAPI document](https://skmtc.dev/getaxonflow/apis/axonflow-orchestrator-api/revisions/f408ef3ec9dd?raw)