Is there a consent management API for the DPDP Act?

Yes. Six REST endpoints cover capture, withdrawal, receipt retrieval and evidence export, and six webhook events carry state changes outward. Consent is purpose-scoped at the API level, so withdrawal from one purpose does not touch the others.

Which SDKs are available?

React and Vue for web, iOS and Android for mobile, and a server-side client for backend capture. Each wraps the same endpoints, so a consent captured through a widget and one captured through the API produce the same record.

How do I record which notice version a Data Principal saw?

Pass the notice version and language with the capture call. Both are stored on the receipt, so the record shows which text was shown, in which language, before consent — which is the question Sec. 5 turns on in a dispute.

What happens when a Data Principal withdraws consent?

The consent.withdrawn event fires to every subscribed endpoint with the purpose and a cessation timestamp. Each acknowledgement is written to the ledger, so propagation is provable rather than assumed.

Yes. Sandbox keys issue against a test tenant with the same endpoints, webhooks and receipt format as production, so integration work does not run against real personal data.

Developer documentation

Consent capture is one call. Making withdrawal arrive is the hard part.

Endpoints: 6
Webhook events: 6
API version: v1

Capture, withdraw and evidence consent across your stack — embed the widget, call the REST API, or install the SDK. The propagation downstream is the part we do for you.

Quickstart

Everything on this page, in one file

Initialise, create a purpose-scoped receipt, and wire the two events that carry a statutory obligation — granted, and withdrawn.

quickstart.js@myconsent/sdk

1import { MyConsent, ConsentLevel } from '@myconsent/sdk';
2
3// Initialize the SDK
4const client = new MyConsent({
5  tenantId: process.env.MYCONSENT_TENANT_ID,
6  region: 'IN',
7  apiVersion: 'v1'
8});
9
10// Create a contextual consent receipt
11const receipt = await client.consent.create({
12  userId: 'user_abc123',
13  purposes: [
14    ConsentLevel.GRANULAR_BIO,
15    ConsentLevel.SENSITIVE_DATA,
16    ConsentLevel.CROSS_BORDER
17  ],
18  retention: {
19    period: '1Y',
20    autoDelete: true,
21    onWithdrawal: 'immediate'
22  },
23  context: {
24    ipAddress: 'request.ip',
25    userAgent: 'request.userAgent',
26    timestamp: new Date().toISOString()
27  }
28});
29
30// Subscribe to consent events
31client.events.on('consent.granted', (evt) => {
32  console.log('Consent granted:', evt.receiptId);
33  receipt.audit(evt); // Immutable logging
34});
35
36client.events.on('consent.withdrawn', async (evt) => {
37  await client.data.erase(evt.userId, {
38    scope: 'all',
39    proof: true // Returns deletion certificate
40  });
41});

RESTful API

Full GraphQL & REST API for every consent operation. Webhooks for real-time event streaming.

Multi-Platform SDKs

Native support for React, Vue, iOS, Android, and IoT devices. Zero-config deployment.

Enterprise Security

OAuth2, JWT and mTLS, with envelope-encrypted key management and rotation.

REST

Six endpoints

Every consent operation, plus the audit trail and the rights request. GraphQL covers the same surface.

Method	Path	What it does
POST	/api/v1/consent	Create a new consent receipt
GET	/api/v1/consent/{id}	Retrieve consent details
DELETE	/api/v1/consent/{id}	Withdraw and erase consent
GET	/api/v1/audit/{id}	Retrieve audit trail
POST	/api/v1/dsr/{userId}	Process data subject request
POST	/api/v1/webhook/subscribe	Register event webhook

Webhook events

Priority is what a missed delivery costs you, not how often the event fires.

consent.grantedHIGHUser has granted consent
consent.withdrawnCRITICALUser has withdrawn consent
consent.expiringMEDIUMConsent expiring within 30 days
dsr.completedHIGHData subject request fulfilled
breach.detectedCRITICALPotential data breach detected
audit.updatedLOWAudit log entry created

Want the sandbox keys?

We will provision a tenant against your own purposes so you can exercise capture, withdrawal and the evidence export before anything touches production.

What the endpoints sit on top of is the consent management platform, and what it costs is on pricing.

Talk to an engineer

Questions people ask

Is there a consent management API for the DPDP Act?: Yes. Six REST endpoints cover capture, withdrawal, receipt retrieval and evidence export, and six webhook events carry state changes outward. Consent is purpose-scoped at the API level, so withdrawal from one purpose does not touch the others.
Which SDKs are available?: React and Vue for web, iOS and Android for mobile, and a server-side client for backend capture. Each wraps the same endpoints, so a consent captured through a widget and one captured through the API produce the same record.
How do I record which notice version a Data Principal saw?: Pass the notice version and language with the capture call. Both are stored on the receipt, so the record shows which text was shown, in which language, before consent — which is the question Sec. 5 turns on in a dispute.
What happens when a Data Principal withdraws consent?: The consent.withdrawn event fires to every subscribed endpoint with the purpose and a cessation timestamp. Each acknowledgement is written to the ledger, so propagation is provable rather than assumed.
Is there a sandbox?: Yes. Sandbox keys issue against a test tenant with the same endpoints, webhooks and receipt format as production, so integration work does not run against real personal data.