---
title: "Retrieves all held info for offender"
method: GET
path: "/subject-access-request"
tags: ["Subject Access Request"]
---

# Retrieves all held info for offender

`GET /subject-access-request`

## Request

- Base URL: `https://complexity-of-need-staging.hmpps.service.justice.gov.uk`
- URL: `https://complexity-of-need-staging.hmpps.service.justice.gov.uk/subject-access-request`
- Auth: API key in header `Authorization`

* NOMIS Prison Number (PRN) must be provided as part of the request.
* The role ROLE_SAR_DATA_ACCESS is required
* If the product uses the identifier type transmitted in the request, it can respond with its data and HTTP code 200
* If the product uses the identifier type transmitted in the request but has no data to respond with, it should respond with HTTP code 204
* If the product does not use the identifier type transmitted in the request, it should respond with HTTP code 209

## Query parameters

- `prn` string: NOMIS Offender Number
- `crn` string
- `fromDate` string
- `toDate` string

## Response `200`

Offender found

- SarOffenderData
  - `content` SarComplexityOfNeed[], required
    - `level` 'low' | 'medium' | 'high', required: Complexity of Need Level
    - `notes` string: Free-text notes for this entry
    - `createdTimeStamp` string, date_time, required: The date & time this entry was created (in RFC 3339 format)
    - `updatedTimeStamp` string, date_time, required: The date & time this entry was updated (in RFC 3339 format)
    - `active` boolean, required: Whether it is active or not

## Other responses

- `204`: Offender not found
- `209`: CRN parameter not allowed
- `210`: Invalid date format
- `400`: Both PRN and CRN parameter passed
- `401`: Request is not authorised
- `403`: Invalid token role

## Changes

- **2026-03-09** (v1) `5cc96f70a170`: 1 breaking
  - removed the required property `content/items/offenderNo` from the response with the `200` status
- **2026-01-29** (v1) `c7e6919b78a0`: 1 breaking, 1 warning
  - removed the required property `content/items/sourceSystem` from the response with the `200` status
  - removed the optional property `content/items/sourceUser` from the response with the `200` status
- **2024-12-03** (v1) `dce766466a85`: 1 info
  - added the required property `content/items/updatedTimeStamp` to the response with the `200` status

[Operation history](https://skmtc.dev/ministryofjustice/apis/complexity-of-need-api/changes/subject-access-request/get.md)

---

[API](https://skmtc.dev/ministryofjustice/apis/complexity-of-need-api.md) - [All operations](https://skmtc.dev/ministryofjustice/apis/complexity-of-need-api/llms.txt) - [OpenAPI document](https://skmtc.dev/ministryofjustice/apis/complexity-of-need-api/revisions/5e5e329d7462?raw)