Compliance

Data requests, legal document versions, breaches, impact assessments, retention and records of processing.

Scopes for this area: compliance:read, compliance:write and compliance:admin.

78 operations

legal wizard

Method	Route	What it does	Level	Command
GET	/compliance/legal/wizard	What the legal documents still need: jurisdictions (with a recommendation), the questions that are open and what is prefilled.	read	rivier compliance legal wizard get

legal settings

Method	Route	What it does	Level	Command
GET	/compliance/legal/settings	The jurisdictions, features, details and languages the legal documents are built from.	read	rivier compliance legal settings get
PUT	/compliance/legal/settings	Choose jurisdictions and fill in the details the documents need. Never publishes anything.	write	rivier compliance legal settings update

legal status

Method	Route	What it does	Level	Command
GET	/compliance/legal/status	Every legal document: what is published, what is open, and which need an update and why.	read	rivier compliance legal status get

legal version

Method	Route	What it does	Level	Command
GET	/compliance/legal/documents/{doc}/versions	The versions of one legal document.	read	rivier compliance legal version list
POST	/compliance/legal/documents/{doc}/versions	Draft a new version of a legal document from the current choices. A draft is never public.	write	rivier compliance legal version draft
GET	/compliance/legal/documents/{doc}/versions/{n}	One version with its sections, sources, what is missing and the warnings; HTML and markdown included.	read	rivier compliance legal version get
GET	/compliance/legal/documents/{doc}/diff	What changed between two versions, section by section.	read	rivier compliance legal version diff
POST	/compliance/legal/documents/{doc}/versions/{n}/review	Put a draft in review: it shows as waiting for the people who approve it. Changes nothing public.	write	rivier compliance legal version review
POST	/compliance/legal/documents/{doc}/versions/{n}/approve	Approve a draft. A person with the approver role, acknowledging that it is a template and not legal advice.	write	rivier compliance legal version approve
POST	/compliance/legal/documents/{doc}/versions/{n}/publish	Publish an approved version at its public address with an effective date. A person with the manager role.	write	rivier compliance legal version publish
GET	/compliance/legal/documents/{doc}/versions/{n}/export	A version as HTML, markdown or PDF to download.	read	rivier compliance legal version export

legal section

Method	Route	What it does	Level	Command
PATCH	/compliance/legal/documents/{doc}/versions/{n}/sections/{clause}	Change the wording of one section of a draft; an edit sends an approved version back to draft.	write	rivier compliance legal section edit

legal document

Method	Route	What it does	Level	Command
POST	/compliance/legal/documents/{doc}/withdraw	Take a published legal document down.	write	rivier compliance legal document withdraw

Method	Route	What it does	Level	Command
GET	/compliance/legal/consent-texts	Ready-made consent wording for signup, checkout, newsletter forms and the cookie banner, linked to the published documents.	read	rivier compliance legal consent texts

checklist

Method	Route	What it does	Level	Command
GET	/compliance/center/checklist	The obligations that apply to this project, what Rivier does about each, what is left to the business, the evidence held and the sources. A list of facts, not a score.	read	rivier compliance checklist get
POST	/compliance/center/checklist/confirm	Record that the business has done its part of an obligation (or withdraw that record). A person's statement; Rivier never counts it as its own claim.	write	rivier compliance checklist confirm

dsar request

Method	Route	What it does	Level	Command
GET	/compliance/center/requests	Requests from people about their data, soonest deadline first, with what is overdue or due within a week and the response periods by jurisdiction.	read	rivier compliance dsar request list
POST	/compliance/center/requests	Open a request on behalf of a person (an email, a phone call): the deadline starts now.	write	rivier compliance dsar request open
GET	/compliance/center/requests/{id}	One request: deadline, identity check, what was found where, the plan and the full log.	read	rivier compliance dsar request get
POST	/compliance/center/requests/{id}/identity	Record that the person's identity was checked, and how. A person with the approver role.	write	rivier compliance dsar request verify
POST	/compliance/center/requests/{id}/discover	Look for the person in every connected module. Counts only; modules not connected are named as such.	write	rivier compliance dsar request discover
POST	/compliance/center/requests/{id}/export	Release the data held about the person, for a person to send to them. Needs a verified identity and the approver role.	write	rivier compliance dsar request export
POST	/compliance/center/requests/{id}/erase/prepare	Prepare a deletion: which modules would be emptied. Nothing is removed until a person approves.	write	rivier compliance dsar request prepare erase
POST	/compliance/center/requests/{id}/erase/approve	Approve and carry out a prepared deletion, by sending the request reference. A person with the manager role; verified identity required.	write	rivier compliance dsar request approve erase
POST	/compliance/center/requests/{id}/extend	Extend the deadline once, where the law allows, with the reason (the requester is told).	write	rivier compliance dsar request extend
POST	/compliance/center/requests/{id}/refuse	Refuse a request, with the reason.	write	rivier compliance dsar request refuse
POST	/compliance/center/requests/{id}/complete	Close a request as done or partly done, with the note sent to the person.	write	rivier compliance dsar request complete
POST	/compliance/center/requests/{id}/withdraw	Record that the person withdrew their request.	write	rivier compliance dsar request withdraw

ropa

Method	Route	What it does	Level	Command
GET	/compliance/center/ropa	The record of processing activities, generated from what the project does plus entries the business added; JSON or markdown.	read	rivier compliance ropa get

ropa activity

Method	Route	What it does	Level	Command
POST	/compliance/center/ropa/activities	Add a processing activity the generator cannot see.	write	rivier compliance ropa activity add
DELETE	/compliance/center/ropa/activities/{id}	Remove an activity the business added.	write	rivier compliance ropa activity remove

provider

Method	Route	What it does	Level	Command
GET	/compliance/center/providers	Service providers with the status of the data processing terms. Naming a provider is the business's decision.	read	rivier compliance provider list
PUT	/compliance/center/providers/terms	Record whether the data processing terms are signed with a provider.	write	rivier compliance provider set terms
GET	/compliance/center/providers/dpa-template	A template of data processing terms to send to a provider.	read	rivier compliance provider dpa template

dpia

Method	Route	What it does	Level	Command
GET	/compliance/center/dpias	Impact assessments, the triggers found for this project and the template.	read	rivier compliance dpia list
POST	/compliance/center/dpias	Start an impact assessment, prefilled from a processing activity.	write	rivier compliance dpia create
PATCH	/compliance/center/dpias/{id}	Fill in the sections of an impact assessment.	write	rivier compliance dpia update
POST	/compliance/center/dpias/{id}/approve	Approve a complete impact assessment. A person with the manager role.	write	rivier compliance dpia approve

breach

Method	Route	What it does	Level	Command
GET	/compliance/center/breaches	The breach register with the notification clocks for each jurisdiction and the checklist.	read	rivier compliance breach list
POST	/compliance/center/breaches	Log a breach or a suspected breach; the clock starts at the moment of awareness.	write	rivier compliance breach log
GET	/compliance/center/breaches/{id}	One breach entry with its clocks.	read	rivier compliance breach get
POST	/compliance/center/breaches/{id}/assess	Assess the risk and the jurisdictions affected. A person.	write	rivier compliance breach assess
POST	/compliance/center/breaches/{id}/notified	Record that an authority or the people were told. A person.	write	rivier compliance breach notified
POST	/compliance/center/breaches/{id}/close	Close a breach entry with a note. A person with the manager role.	write	rivier compliance breach close

retention

Method	Route	What it does	Level	Command
GET	/compliance/center/retention	Retention policies, the stores they apply to, recent runs and alerts.	read	rivier compliance retention get
PUT	/compliance/center/retention	Set how long each kind of data is kept. A person with the manager role.	write	rivier compliance retention set
POST	/compliance/center/retention/run	Run the retention schedule now: a dry run records what is past its time; applying deletes it and needs a person.	write	rivier compliance retention run
POST	/compliance/center/evidence/retention-runs	A job in another module records a retention run it did.	write	rivier compliance retention evidence

Method	Route	What it does	Level	Command
POST	/compliance/center/consent-receipts	The consent widget records a receipt: versions, region, choices, receipt id; no address. Chained by hash.	write	rivier compliance consent receipt record
GET	/compliance/center/consent-receipts/verify	Check that the chain of consent receipts is intact.	read	rivier compliance consent receipt verify
GET	/compliance/center/consent-receipts	The newest consent receipts and how many there are: when, region, banner and rule versions, the choices and the browser's privacy signals. Nothing in a receipt says who the visitor is.	read	rivier compliance consent receipt list
GET	/compliance/center/consent-receipts.csv	Every consent receipt as a CSV file, oldest first, with the hashes that chain them.	read	rivier compliance consent receipt export

monitor

Method	Route	What it does	Level	Command
GET	/compliance/center/monitor	What changed in the rule packs since the project last acknowledged them, which of it applies, and which documents and analytics settings are affected.	read	rivier compliance monitor changes
GET	/compliance/center/monitor/watch	Every source the obligations rest on with its age and flags, the stale analytics rows and the watch list of pending changes.	read	rivier compliance monitor watch
POST	/compliance/center/monitor/acknowledge	Record that the changes were read; clears the review flags. A person with the manager role.	write	rivier compliance monitor acknowledge

analytics rules

Method	Route	What it does	Level	Command
GET	/compliance/center/analytics-rules	The analytics rows: for each region the highest mode, opt-in rule, signals, retention, children policy, fallback mode and review date.	read	rivier compliance analytics rules get
POST	/compliance/center/analytics-rules/decide	The analytics mode for one visitor: region, browser signals, consent and the site's own setting go in; the mode, the reason and whether a prompt is needed come out.	read	rivier compliance analytics rules decide

readiness

Method	Route	What it does	Level	Command
GET	/compliance/center/readiness	Legal pages and consent readiness before going live: which required pages are not published, and whether the consent widget, the cookie list and consent receipts are in place (reported as not connected until the widget is). Facts, not certification.	read	rivier compliance readiness get

overview

Method	Route	What it does	Level	Command
GET	/compliance/center/overview	The overview: open actions, deadlines, documents, requests, rule changes and the standing notice. No score and no badge.	read	rivier compliance overview get

evidence

Method	Route	What it does	Level	Command
GET	/compliance/center/evidence.zip	A ZIP for an auditor: checklist, requests, register, records, documents, with a manifest and hashes.	read	rivier compliance evidence export

profile

Method	Route	What it does	Level	Command
GET	/compliance/profile	Jurisdictions and audience the project is held to.	read	rivier compliance profile get
PUT	/compliance/profile	Set jurisdictions and audience.	write	rivier compliance profile set

check

Method	Route	What it does	Level	Command
POST	/compliance/check	Check text against the rules in force.	read	rivier compliance check run

report

Method	Route	What it does	Level	Command
GET	/compliance/report	What is compliant and what is not.	read	rivier compliance report get

pack

Method	Route	What it does	Level	Command
GET	/compliance/packs	Rule packs.	read	rivier compliance pack list
POST	/compliance/packs	Add a rule pack.	write	rivier compliance pack create
POST	/compliance/packs/sync	Sync packs from the library.	write	rivier compliance pack sync
GET	/compliance/packs/{id}	One rule pack.	read	rivier compliance pack get
GET	/compliance/packs/{id}/versions	A pack's versions.	read	rivier compliance pack versions
GET	/compliance/packs/{id}/diff	What changed between two versions.	read	rivier compliance pack diff

control

Method	Route	What it does	Level	Command
GET	/compliance/controls	The controls a pack enforces.	read	rivier compliance control list

event

Method	Route	What it does	Level	Command
GET	/compliance/events	What was checked, blocked or relaxed.	read	rivier compliance event list

relaxation

Method	Route	What it does	Level	Command
GET	/compliance/relaxations	Rules a person relaxed, with the reason.	read	rivier compliance relaxation list
POST	/compliance/relaxations	Relax a rule with a recorded reason.	write	rivier compliance relaxation create
POST	/compliance/relaxations/assess	What relaxing a rule would allow.	write	rivier compliance relaxation assess
POST	/compliance/relaxations/{id}/reactivate	Put a relaxed rule back in force.	write	rivier compliance relaxation reactivate
DELETE	/compliance/relaxations/{id}	Delete a relaxation.	write	rivier compliance relaxation delete