# Compliance

Data requests, legal document versions, breaches, impact assessments, retention and records of processing.

Scopes for this area: `compliance:read`, `compliance:write` and `compliance:admin`.

78 operations.

## legal wizard

| Method | Route | What it does | Level | Command |
| --- | --- | --- | --- | --- |
| GET | `/compliance/legal/wizard` | What the legal documents still need: jurisdictions (with a recommendation), the questions that are open and what is prefilled. | read | `rivier compliance legal wizard get` |

## legal settings

| Method | Route | What it does | Level | Command |
| --- | --- | --- | --- | --- |
| GET | `/compliance/legal/settings` | The jurisdictions, features, details and languages the legal documents are built from. | read | `rivier compliance legal settings get` |
| PUT | `/compliance/legal/settings` | Choose jurisdictions and fill in the details the documents need. Never publishes anything. | write | `rivier compliance legal settings update` |

## legal status

| Method | Route | What it does | Level | Command |
| --- | --- | --- | --- | --- |
| GET | `/compliance/legal/status` | Every legal document: what is published, what is open, and which need an update and why. | read | `rivier compliance legal status get` |

## legal version

| Method | Route | What it does | Level | Command |
| --- | --- | --- | --- | --- |
| GET | `/compliance/legal/documents/{doc}/versions` | The versions of one legal document. | read | `rivier compliance legal version list` |
| POST | `/compliance/legal/documents/{doc}/versions` | Draft a new version of a legal document from the current choices. A draft is never public. | write | `rivier compliance legal version draft` |
| GET | `/compliance/legal/documents/{doc}/versions/{n}` | One version with its sections, sources, what is missing and the warnings; HTML and markdown included. | read | `rivier compliance legal version get` |
| GET | `/compliance/legal/documents/{doc}/diff` | What changed between two versions, section by section. | read | `rivier compliance legal version diff` |
| POST | `/compliance/legal/documents/{doc}/versions/{n}/review` | Put a draft in review: it shows as waiting for the people who approve it. Changes nothing public. | write | `rivier compliance legal version review` |
| POST | `/compliance/legal/documents/{doc}/versions/{n}/approve` | Approve a draft. A person with the approver role, acknowledging that it is a template and not legal advice. | write | `rivier compliance legal version approve` |
| POST | `/compliance/legal/documents/{doc}/versions/{n}/publish` | Publish an approved version at its public address with an effective date. A person with the manager role. | write | `rivier compliance legal version publish` |
| GET | `/compliance/legal/documents/{doc}/versions/{n}/export` | A version as HTML, markdown or PDF to download. | read | `rivier compliance legal version export` |

## legal section

| Method | Route | What it does | Level | Command |
| --- | --- | --- | --- | --- |
| PATCH | `/compliance/legal/documents/{doc}/versions/{n}/sections/{clause}` | Change the wording of one section of a draft; an edit sends an approved version back to draft. | write | `rivier compliance legal section edit` |

## legal document

| Method | Route | What it does | Level | Command |
| --- | --- | --- | --- | --- |
| POST | `/compliance/legal/documents/{doc}/withdraw` | Take a published legal document down. | write | `rivier compliance legal document withdraw` |

## legal consent

| Method | Route | What it does | Level | Command |
| --- | --- | --- | --- | --- |
| GET | `/compliance/legal/consent-texts` | Ready-made consent wording for signup, checkout, newsletter forms and the cookie banner, linked to the published documents. | read | `rivier compliance legal consent texts` |

## checklist

| Method | Route | What it does | Level | Command |
| --- | --- | --- | --- | --- |
| GET | `/compliance/center/checklist` | The obligations that apply to this project, what Rivier does about each, what is left to the business, the evidence held and the sources. A list of facts, not a score. | read | `rivier compliance checklist get` |
| POST | `/compliance/center/checklist/confirm` | Record that the business has done its part of an obligation (or withdraw that record). A person's statement; Rivier never counts it as its own claim. | write | `rivier compliance checklist confirm` |

## dsar request

| Method | Route | What it does | Level | Command |
| --- | --- | --- | --- | --- |
| GET | `/compliance/center/requests` | Requests from people about their data, soonest deadline first, with what is overdue or due within a week and the response periods by jurisdiction. | read | `rivier compliance dsar request list` |
| POST | `/compliance/center/requests` | Open a request on behalf of a person (an email, a phone call): the deadline starts now. | write | `rivier compliance dsar request open` |
| GET | `/compliance/center/requests/{id}` | One request: deadline, identity check, what was found where, the plan and the full log. | read | `rivier compliance dsar request get` |
| POST | `/compliance/center/requests/{id}/identity` | Record that the person's identity was checked, and how. A person with the approver role. | write | `rivier compliance dsar request verify` |
| POST | `/compliance/center/requests/{id}/discover` | Look for the person in every connected module. Counts only; modules not connected are named as such. | write | `rivier compliance dsar request discover` |
| POST | `/compliance/center/requests/{id}/export` | Release the data held about the person, for a person to send to them. Needs a verified identity and the approver role. | write | `rivier compliance dsar request export` |
| POST | `/compliance/center/requests/{id}/erase/prepare` | Prepare a deletion: which modules would be emptied. Nothing is removed until a person approves. | write | `rivier compliance dsar request prepare erase` |
| POST | `/compliance/center/requests/{id}/erase/approve` | Approve and carry out a prepared deletion, by sending the request reference. A person with the manager role; verified identity required. | write | `rivier compliance dsar request approve erase` |
| POST | `/compliance/center/requests/{id}/extend` | Extend the deadline once, where the law allows, with the reason (the requester is told). | write | `rivier compliance dsar request extend` |
| POST | `/compliance/center/requests/{id}/refuse` | Refuse a request, with the reason. | write | `rivier compliance dsar request refuse` |
| POST | `/compliance/center/requests/{id}/complete` | Close a request as done or partly done, with the note sent to the person. | write | `rivier compliance dsar request complete` |
| POST | `/compliance/center/requests/{id}/withdraw` | Record that the person withdrew their request. | write | `rivier compliance dsar request withdraw` |

## ropa

| Method | Route | What it does | Level | Command |
| --- | --- | --- | --- | --- |
| GET | `/compliance/center/ropa` | The record of processing activities, generated from what the project does plus entries the business added; JSON or markdown. | read | `rivier compliance ropa get` |

## ropa activity

| Method | Route | What it does | Level | Command |
| --- | --- | --- | --- | --- |
| POST | `/compliance/center/ropa/activities` | Add a processing activity the generator cannot see. | write | `rivier compliance ropa activity add` |
| DELETE | `/compliance/center/ropa/activities/{id}` | Remove an activity the business added. | write | `rivier compliance ropa activity remove` |

## provider

| Method | Route | What it does | Level | Command |
| --- | --- | --- | --- | --- |
| GET | `/compliance/center/providers` | Service providers with the status of the data processing terms. Naming a provider is the business's decision. | read | `rivier compliance provider list` |
| PUT | `/compliance/center/providers/terms` | Record whether the data processing terms are signed with a provider. | write | `rivier compliance provider set terms` |
| GET | `/compliance/center/providers/dpa-template` | A template of data processing terms to send to a provider. | read | `rivier compliance provider dpa template` |

## dpia

| Method | Route | What it does | Level | Command |
| --- | --- | --- | --- | --- |
| GET | `/compliance/center/dpias` | Impact assessments, the triggers found for this project and the template. | read | `rivier compliance dpia list` |
| POST | `/compliance/center/dpias` | Start an impact assessment, prefilled from a processing activity. | write | `rivier compliance dpia create` |
| PATCH | `/compliance/center/dpias/{id}` | Fill in the sections of an impact assessment. | write | `rivier compliance dpia update` |
| POST | `/compliance/center/dpias/{id}/approve` | Approve a complete impact assessment. A person with the manager role. | write | `rivier compliance dpia approve` |

## breach

| Method | Route | What it does | Level | Command |
| --- | --- | --- | --- | --- |
| GET | `/compliance/center/breaches` | The breach register with the notification clocks for each jurisdiction and the checklist. | read | `rivier compliance breach list` |
| POST | `/compliance/center/breaches` | Log a breach or a suspected breach; the clock starts at the moment of awareness. | write | `rivier compliance breach log` |
| GET | `/compliance/center/breaches/{id}` | One breach entry with its clocks. | read | `rivier compliance breach get` |
| POST | `/compliance/center/breaches/{id}/assess` | Assess the risk and the jurisdictions affected. A person. | write | `rivier compliance breach assess` |
| POST | `/compliance/center/breaches/{id}/notified` | Record that an authority or the people were told. A person. | write | `rivier compliance breach notified` |
| POST | `/compliance/center/breaches/{id}/close` | Close a breach entry with a note. A person with the manager role. | write | `rivier compliance breach close` |

## retention

| Method | Route | What it does | Level | Command |
| --- | --- | --- | --- | --- |
| GET | `/compliance/center/retention` | Retention policies, the stores they apply to, recent runs and alerts. | read | `rivier compliance retention get` |
| PUT | `/compliance/center/retention` | Set how long each kind of data is kept. A person with the manager role. | write | `rivier compliance retention set` |
| POST | `/compliance/center/retention/run` | Run the retention schedule now: a dry run records what is past its time; applying deletes it and needs a person. | write | `rivier compliance retention run` |
| POST | `/compliance/center/evidence/retention-runs` | A job in another module records a retention run it did. | write | `rivier compliance retention evidence` |

## consent receipt

| Method | Route | What it does | Level | Command |
| --- | --- | --- | --- | --- |
| POST | `/compliance/center/consent-receipts` | The consent widget records a receipt: versions, region, choices, receipt id; no address. Chained by hash. | write | `rivier compliance consent receipt record` |
| GET | `/compliance/center/consent-receipts/verify` | Check that the chain of consent receipts is intact. | read | `rivier compliance consent receipt verify` |
| GET | `/compliance/center/consent-receipts` | The newest consent receipts and how many there are: when, region, banner and rule versions, the choices and the browser's privacy signals. Nothing in a receipt says who the visitor is. | read | `rivier compliance consent receipt list` |
| GET | `/compliance/center/consent-receipts.csv` | Every consent receipt as a CSV file, oldest first, with the hashes that chain them. | read | `rivier compliance consent receipt export` |

## monitor

| Method | Route | What it does | Level | Command |
| --- | --- | --- | --- | --- |
| GET | `/compliance/center/monitor` | What changed in the rule packs since the project last acknowledged them, which of it applies, and which documents and analytics settings are affected. | read | `rivier compliance monitor changes` |
| GET | `/compliance/center/monitor/watch` | Every source the obligations rest on with its age and flags, the stale analytics rows and the watch list of pending changes. | read | `rivier compliance monitor watch` |
| POST | `/compliance/center/monitor/acknowledge` | Record that the changes were read; clears the review flags. A person with the manager role. | write | `rivier compliance monitor acknowledge` |

## analytics rules

| Method | Route | What it does | Level | Command |
| --- | --- | --- | --- | --- |
| GET | `/compliance/center/analytics-rules` | The analytics rows: for each region the highest mode, opt-in rule, signals, retention, children policy, fallback mode and review date. | read | `rivier compliance analytics rules get` |
| POST | `/compliance/center/analytics-rules/decide` | The analytics mode for one visitor: region, browser signals, consent and the site's own setting go in; the mode, the reason and whether a prompt is needed come out. | read | `rivier compliance analytics rules decide` |

## readiness

| Method | Route | What it does | Level | Command |
| --- | --- | --- | --- | --- |
| GET | `/compliance/center/readiness` | Legal pages and consent readiness before going live: which required pages are not published, and whether the consent widget, the cookie list and consent receipts are in place (reported as not connected until the widget is). Facts, not certification. | read | `rivier compliance readiness get` |

## overview

| Method | Route | What it does | Level | Command |
| --- | --- | --- | --- | --- |
| GET | `/compliance/center/overview` | The overview: open actions, deadlines, documents, requests, rule changes and the standing notice. No score and no badge. | read | `rivier compliance overview get` |

## evidence

| Method | Route | What it does | Level | Command |
| --- | --- | --- | --- | --- |
| GET | `/compliance/center/evidence.zip` | A ZIP for an auditor: checklist, requests, register, records, documents, with a manifest and hashes. | read | `rivier compliance evidence export` |

## profile

| Method | Route | What it does | Level | Command |
| --- | --- | --- | --- | --- |
| GET | `/compliance/profile` | Jurisdictions and audience the project is held to. | read | `rivier compliance profile get` |
| PUT | `/compliance/profile` | Set jurisdictions and audience. | write | `rivier compliance profile set` |

## check

| Method | Route | What it does | Level | Command |
| --- | --- | --- | --- | --- |
| POST | `/compliance/check` | Check text against the rules in force. | read | `rivier compliance check run` |

## report

| Method | Route | What it does | Level | Command |
| --- | --- | --- | --- | --- |
| GET | `/compliance/report` | What is compliant and what is not. | read | `rivier compliance report get` |

## pack

| Method | Route | What it does | Level | Command |
| --- | --- | --- | --- | --- |
| GET | `/compliance/packs` | Rule packs. | read | `rivier compliance pack list` |
| POST | `/compliance/packs` | Add a rule pack. | write | `rivier compliance pack create` |
| POST | `/compliance/packs/sync` | Sync packs from the library. | write | `rivier compliance pack sync` |
| GET | `/compliance/packs/{id}` | One rule pack. | read | `rivier compliance pack get` |
| GET | `/compliance/packs/{id}/versions` | A pack's versions. | read | `rivier compliance pack versions` |
| GET | `/compliance/packs/{id}/diff` | What changed between two versions. | read | `rivier compliance pack diff` |

## control

| Method | Route | What it does | Level | Command |
| --- | --- | --- | --- | --- |
| GET | `/compliance/controls` | The controls a pack enforces. | read | `rivier compliance control list` |

## event

| Method | Route | What it does | Level | Command |
| --- | --- | --- | --- | --- |
| GET | `/compliance/events` | What was checked, blocked or relaxed. | read | `rivier compliance event list` |

## relaxation

| Method | Route | What it does | Level | Command |
| --- | --- | --- | --- | --- |
| GET | `/compliance/relaxations` | Rules a person relaxed, with the reason. | read | `rivier compliance relaxation list` |
| POST | `/compliance/relaxations` | Relax a rule with a recorded reason. | write | `rivier compliance relaxation create` |
| POST | `/compliance/relaxations/assess` | What relaxing a rule would allow. | write | `rivier compliance relaxation assess` |
| POST | `/compliance/relaxations/{id}/reactivate` | Put a relaxed rule back in force. | write | `rivier compliance relaxation reactivate` |
| DELETE | `/compliance/relaxations/{id}` | Delete a relaxation. | write | `rivier compliance relaxation delete` |