Data Subject Access Request (DSAR)

Submit Global Opt-Out Request

Use this API to submit a global opt-out Data Subject Access Request (DSAR) on behalf of a data subject.

post/cfw/cmp/v1/dsar

Request

Base URL
https://mobile-data.onetrust.io
URL
https://mobile-data.onetrust.io/cfw/cmp/v1/dsar
Auth
none declared. Required headers: OT-CDN-Location, OT-App-Id, OT-Device-Type, OT-SDK-Version

Headers

The location of the CDN.

OT-App-Idstring required

The unique identifier for the app or domain.

Example:95c1b37a-c271-44e8-9dd3-1742d82ec948-test

OT-Device-Type'mobile' | 'ctv' required

The type of device.

OT-SDK-Versionstring required

The published version of the app or domain.

Example:202403.2.0

OT-SDK-Identificationstring nullable

The OT SDK identification.

Example:iOS/17.0/202411.1.0

OT-Languagestring nullable

The language in which the user interface should be displayed.

Example:en

OT-Country-Codestring nullable

The country code from which the user is accessing the app or website.

Example:US

OT-Region-Codestring nullable

The region code from which the user is accessing the app or website.

Example:GA

OT-Fetch-Type'APP_DATA_ONLY' | 'APP_DATA_AND_PROFILE' | 'APP_DATA_AND_SYNC_PROFILE' nullable

The type of data to download.

OT-Consent-Stringstring nullable

The encoded consent string that contains the interface's metadata.

Example:eyJsYXN0TGF1bmNoRGF0ZSI6MTcxMjMzMDgyOTEwMywic2hvdWxkU2hvd0Jhbm5lciI6MSwiZHNJZCI6IjljZDFjZGM1LTMwNmUtNGQ0Yi05MWFiLTg2MzdjODQ3ZjA3NyIsImFwcElkIjoiOTVjMWIzN2EtYzI3MS00NGU4LTlkZDMtMTc0MmQ4MmVjOTQ4LXRlc3QiLCJjZG4iOiJjZG4uY29va2llbGF3Lm9yZyIsImlzQW5vbnltb3VzIjoxLCJleHBpcnlEYXRlIjpudWxsfQ==

OT-Identifierstring nullable

The unique identifier for the data subject.

Example:9cd1cdc5-306e-4d4b-91ab-8637c847f077

OT-Identifier-Typestring nullable

The identifier type associated with the unique identifier in OT-Identifier header

Example:Email

OT-Identifier-UpdateType'Rename-Identifier' nullable

The update type for the identifier. This header is used to specify how the identifier should be updated.

OT-Sync-Profile-Authstring nullable

The JSON Web Token (JWT) generated using Public Keys within the OneTrust application.

Example:eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJncGJ1cmRlbGxAb25ldHJ1c3QuY29tIiwibmFtZSI6Ikdlb3JnZSBQLiBCdXJkZWxsIiwiaWF0IjoxNTE2MjM5MDIyfQ.qisq7xmfAqXkkSckWpeJKs86JlXuKmClEgMaooSaih0

OT-Platform'Apple' | 'Android' nullable

To handle platform-specific features like ATT (App Tracking Transparency for Apple) or GoogleAdId (for Android) in a structured way, you can send the platform type in the parameters of an API or request.

OT-Exclude-Html-Tagsboolean nullable

This is specifically to unbold the vendor numbers only.

OT-Is-Anonymous-Userboolean nullable

This flag indicates whether the request is anonymous. When true, profile creation is skipped.

Request body

Example request

{
  "globalOptOut": {
    "identifier": "john@gmail.com",
    "purposes": [
      "C0001"
    ]
  }
}

Response

Created

responseunknown

otConsentStringstring

Example response

{
  "errors": [
    {
      "code": "ERROR_CODE_BLOB_LOCATIONS_UNAVAILABLE",
      "message": "Unable to fetch data for the specified Application ID. Please check your configurations."
    }
  ],
  "warnings": [
    {
      "code": "WARNING_CODE_PUBLISHED_VERSION_MISMATCH",
      "message": "Requested data for the OT-SDK-Version does not match the published version on the OneTrust server. The latest published version will be returned instead."
    }
  ],
  "storageKeys": {
    "OT_GlobalOptOut": {
      "C0001": {
        "lastOptedOut": "2025-10-15T10:30:00Z",
        "identifier": "test@example.com"
      }
    }
  },
  "otConsentString": "eyJMYXN0TGF1bmNoRGF0ZSI6MTcwNDczNzM3OTY1MSwiU2hvdWxkU2hvd0Jhbm5lciI6MSwiRFNJRCI6InN1cC1uZXdsa2diIn0="
}

Changes

No recorded changes to this operation across all 1 revision of this API.