Data Agreement

Create data agreement

POST/v4/config/consent/data-agreement

Creates a data agreement: one purpose for which your organisation processes personal data, with its lawful basis, data policy and data attributes. Individuals give or refuse their consent to it through consent records.

With active: true the server publishes the data agreement: it saves the first revision with version 1.0.0, and individuals can consent to it. With active: false it saves a draft, without a revision; the answer then has a revision that the server made for the answer only (its id is empty).

The server sets the controller (your organisation), the IDs of the data attributes and the lifecycle. To link the data agreement to an OpenID4VC credential definition or presentation definition of your wallet, send dataExchange with the profile OID4VC.

Language of the request sample

curl -X POST 'https://demo-api.igrant.io/v4/config/consent/data-agreement' \
  -H 'Authorization: ApiKey <your-api-key>' \
  -H 'Content-Type: application/json' \
  -d '{
  "dataAgreement": {
    "purpose": "Loyalty data sharing",
    "purposeDescription": "Share the purchase history with partners that give loyalty offers.",
    "lawfulBasis": "consent",
    "methodOfUse": "data_source",
    "policy": {
      "name": "Privacy policy",
      "url": "https://www.example.com/privacy-policy",
      "jurisdiction": "Sweden",
      "industrySector": "Retail",
      "dataRetentionPeriodDays": 365,
      "geographicRestriction": "European Union",
      "storageLocation": "Sweden",
      "thirdPartyDataSharing": true
    },
    "active": true,
    "forgettable": false,
    "dataAttributes": [
      {
        "name": "Purchase history",
        "description": "Products bought in the last 12 months",
        "category": "Purchases",
        "sensitivity": false
      }
    ],
    "dataUsingServices": [
      {
        "name": "Example Bank",
        "sector": "Finance",
        "location": "Sweden",
        "privacyDashboardUrl": "https://bank.example.com/privacy"
      },
      {
        "name": "Example Airline",
        "sector": "Travel",
        "location": "Sweden",
        "privacyDashboardUrl": "https://airline.example.com/privacy"
      }
    ]
  }
}'

{
  "dataAgreement": {
    "id": "6af0821c2d6fb7b6ac6efc78",
    "version": "1.0.0",
    "controllerId": "6ae2bf741c3dadfeb27982ec",
    "controllerUrl": "https://org1.example.com/policy",
    "controllerName": "Organization 1",
    "policy": {
      "id": "6af0821c2d6fb7b6ac6efc79",
      "name": "Privacy policy",
      "version": "",
      "url": "https://www.example.com/privacy-policy",
      "jurisdiction": "Sweden",
      "industrySector": "Retail",
      "dataRetentionPeriodDays": 365,
      "geographicRestriction": "European Union",
      "storageLocation": "Sweden",
      "thirdPartyDataSharing": true
    },
    "purpose": "Loyalty data sharing",
    "purposeDescription": "Share the purchase history with partners that give loyalty offers.",
    "lawfulBasis": "consent",
    "methodOfUse": "data_source",
    "dpiaDate": "",
    "dpiaSummaryUrl": "",
    "signature": {
      "id": "6af0821c2d6fb7b6ac6efc7a",
      "payload": "",
      "signature": "",
      "verificationMethod": "",
      "verificationPayload": "",
      "verificationPayloadHash": "",
      "verificationArtifact": "",
      "verificationSignedBy": "",
      "verificationSignedAs": "",
      "verificationJwsHeader": "",
      "timestamp": "",
      "signedWithoutObjectReference": false,
      "objectType": "",
      "objectReference": ""
    },
    "active": true,
    "forgettable": false,
    "compatibleWithVersionId": "",
    "lifecycle": "complete",
    "dataAttributes": [
      {
        "id": "6af0821c2d6fb7b6ac6efc7b",
        "name": "Purchase history",
        "description": "Products bought in the last 12 months",
        "sensitivity": false,
        "category": "Purchases",
        "restrictions": null
      }
    ],
    "dataUse": "data_source",
    "dpia": "",
    "compatibleWithVersion": "",
    "controller": {
      "id": "6ae2bf741c3dadfeb27982ec",
      "name": "Organization 1",
      "url": "https://org1.example.com/policy"
    },
    "dataExchange": {
      "dataExchangeProfile": "",
      "id": ""
    },
    "dataSources": [],
    "dataUsingServices": [
      {
        "name": "Example Bank",
        "sector": "Finance",
        "location": "Sweden",
        "privacyDashboardUrl": "https://bank.example.com/privacy"
      },
      {
        "name": "Example Airline",
        "sector": "Travel",
        "location": "Sweden",
        "privacyDashboardUrl": "https://airline.example.com/privacy"
      }
    ],
    "openApiSpecification": null,
    "nats": {
      "subjects": null,
      "url": ""
    },
    "dataExchangeMethod": ""
  },
  "revision": {
    "id": "6af0821c2d6fb7b6ac6efc7c",
    "schemaName": "DataAgreement",
    "objectId": "6af0821c2d6fb7b6ac6efc78",
    "signedWithoutObjectId": false,
    "timestamp": "2026-11-08T14:07:24Z",
    "authorizedByIndividualId": "",
    "authorizedByOther": "6ae2bf74a401855d2806ab5d",
    "predecessorHash": "",
    "predecessorSignature": "",
    "objectData": "{\"id\":\"6af0821c2d6fb7b6ac6efc78\",\"version\":\"1.0.0\",\"controllerId\":\"6ae2bf741c3dadfeb27982ec\",\"controllerUrl\":\"https://org1.example.com/policy\",\"controllerName\":\"Organization 1\",\"policy\":{\"id\":\"6af0821c2d6fb7b6ac6efc79\",\"name\":\"Privacy policy\",\"version\":\"\",\"url\":\"https://www.example.com/privacy-policy\",\"jurisdiction\":\"Sweden\",\"industrySector\":\"Retail\",\"dataRetentionPeriodDays\":365,\"geographicRestriction\":\"European Union\",\"storageLocation\":\"Sweden\",\"thirdPartyDataSharing\":true},\"purpose\":\"Loyalty data sharing\",\"purposeDescription\":\"Share the purchase history with partners that give loyalty offers.\",\"lawfulBasis\":\"consent\",\"methodOfUse\":\"data_source\",\"dpiaDate\":\"\",\"dpiaSummaryUrl\":\"\",\"signature\":{\"id\":\"6af0821c2d6fb7b6ac6efc7a\",\"payload\":\"\",\"signature\":\"\",\"verificationMethod\":\"\",\"verificationPayload\":\"\",\"verificationPayloadHash\":\"\",\"verificationArtifact\":\"\",\"verificationSignedBy\":\"\",\"verificationSignedAs\":\"\",\"verificationJwsHeader\":\"\",\"timestamp\":\"\",\"signedWithoutObjectReference\":false,\"objectType\":\"\",\"objectReference\":\"\"},\"active\":true,\"forgettable\":false,\"compatibleWithVersionId\":\"\",\"lifecycle\":\"complete\",\"dataAttributes\":[{\"id\":\"6af0821c2d6fb7b6ac6efc7b\",\"name\":\"Purchase history\",\"description\":\"Products bought in the last 12 months\",\"sensitivity\":false,\"category\":\"Purchases\",\"restrictions\":null}],\"dataUse\":\"data_source\",\"dpia\":\"\",\"compatibleWithVersion\":\"\",\"controller\":{\"id\":\"6ae2bf741c3dadfeb27982ec\",\"name\":\"Organization 1\",\"url\":\"https://org1.example.com/policy\"},\"dataExchange\":{\"dataExchangeProfile\":\"\",\"id\":\"\"},\"dataSources\":[],\"dataUsingServices\":[{\"name\":\"Example Bank\",\"sector\":\"Finance\",\"location\":\"Sweden\",\"privacyDashboardUrl\":\"https://bank.example.com/privacy\"},{\"name\":\"Example Airline\",\"sector\":\"Travel\",\"location\":\"Sweden\",\"privacyDashboardUrl\":\"https://airline.example.com/privacy\"}],\"openApiSpecification\":null,\"nats\":{\"subjects\":null,\"url\":\"\"},\"dataExchangeMethod\":\"\"}",
    "successorId": "",
    "serializedHash": "0c118036247654a4cf7a5ec25d94c42b20f771c5",
    "serializedSnapshot": "{\"schemaName\":\"DataAgreement\",\"objectId\":\"6af0821c2d6fb7b6ac6efc78\",\"signedWithoutObjectId\":false,\"timestamp\":\"2026-11-08T14:07:24Z\",\"authorizedByIndividualId\":\"\",\"authorizedByOther\":\"6ae2bf74a401855d2806ab5d\",\"objectData\":\"{\\\"id\\\":\\\"6af0821c2d6fb7b6ac6efc78\\\",\\\"version\\\":\\\"1.0.0\\\",\\\"controllerId\\\":\\\"6ae2bf741c3dadfeb27982ec\\\",\\\"controllerUrl\\\":\\\"https://org1.example.com/policy\\\",\\\"controllerName\\\":\\\"Organization 1\\\",\\\"policy\\\":{\\\"id\\\":\\\"6af0821c2d6fb7b6ac6efc79\\\",\\\"name\\\":\\\"Privacy policy\\\",\\\"version\\\":\\\"\\\",\\\"url\\\":\\\"https://www.example.com/privacy-policy\\\",\\\"jurisdiction\\\":\\\"Sweden\\\",\\\"industrySector\\\":\\\"Retail\\\",\\\"dataRetentionPeriodDays\\\":365,\\\"geographicRestriction\\\":\\\"European Union\\\",\\\"storageLocation\\\":\\\"Sweden\\\",\\\"thirdPartyDataSharing\\\":true},\\\"purpose\\\":\\\"Loyalty data sharing\\\",\\\"purposeDescription\\\":\\\"Share the purchase history with partners that give loyalty offers.\\\",\\\"lawfulBasis\\\":\\\"consent\\\",\\\"methodOfUse\\\":\\\"data_source\\\",\\\"dpiaDate\\\":\\\"\\\",\\\"dpiaSummaryUrl\\\":\\\"\\\",\\\"signature\\\":{\\\"id\\\":\\\"6af0821c2d6fb7b6ac6efc7a\\\",\\\"payload\\\":\\\"\\\",\\\"signature\\\":\\\"\\\",\\\"verificationMethod\\\":\\\"\\\",\\\"verificationPayload\\\":\\\"\\\",\\\"verificationPayloadHash\\\":\\\"\\\",\\\"verificationArtifact\\\":\\\"\\\",\\\"verificationSignedBy\\\":\\\"\\\",\\\"verificationSignedAs\\\":\\\"\\\",\\\"verificationJwsHeader\\\":\\\"\\\",\\\"timestamp\\\":\\\"\\\",\\\"signedWithoutObjectReference\\\":false,\\\"objectType\\\":\\\"\\\",\\\"objectReference\\\":\\\"\\\"},\\\"active\\\":true,\\\"forgettable\\\":false,\\\"compatibleWithVersionId\\\":\\\"\\\",\\\"lifecycle\\\":\\\"complete\\\",\\\"dataAttributes\\\":[{\\\"id\\\":\\\"6af0821c2d6fb7b6ac6efc7b\\\",\\\"name\\\":\\\"Purchase history\\\",\\\"description\\\":\\\"Products bought in the last 12 months\\\",\\\"sensitivity\\\":false,\\\"category\\\":\\\"Purchases\\\",\\\"restrictions\\\":null}],\\\"dataUse\\\":\\\"data_source\\\",\\\"dpia\\\":\\\"\\\",\\\"compatibleWithVersion\\\":\\\"\\\",\\\"controller\\\":{\\\"id\\\":\\\"6ae2bf741c3dadfeb27982ec\\\",\\\"name\\\":\\\"Organization 1\\\",\\\"url\\\":\\\"https://org1.example.com/policy\\\"},\\\"dataExchange\\\":{\\\"dataExchangeProfile\\\":\\\"\\\",\\\"id\\\":\\\"\\\"},\\\"dataSources\\\":[],\\\"dataUsingServices\\\":[{\\\"name\\\":\\\"Example Bank\\\",\\\"sector\\\":\\\"Finance\\\",\\\"location\\\":\\\"Sweden\\\",\\\"privacyDashboardUrl\\\":\\\"https://bank.example.com/privacy\\\"},{\\\"name\\\":\\\"Example Airline\\\",\\\"sector\\\":\\\"Travel\\\",\\\"location\\\":\\\"Sweden\\\",\\\"privacyDashboardUrl\\\":\\\"https://airline.example.com/privacy\\\"}],\\\"openApiSpecification\\\":null,\\\"nats\\\":{\\\"subjects\\\":null,\\\"url\\\":\\\"\\\"},\\\"dataExchangeMethod\\\":\\\"\\\"}\",\"organisationId\":\"\"}",
    "organisationId": "6ae2bf741c3dadfeb27982ec"
  }
}

Authorizations

Authorizationstringheaderrequired
Your API key with the prefix ApiKey: ApiKey <your-api-key>. Get an API key.
Scope:data-agreements:create

Body

application/json

dataAgreementobjectrequired
The data agreement that you create or update. The server sets the ID, the version, the controller (your organisation) and the lifecycle. When active is true, purpose, purposeDescription, policy and dataAttributes are mandatory too.

Response

application/json

The data agreement and its revision.

dataAgreementobject
A data agreement describes one purpose for which the organisation processes personal data (ISO/IEC TS 27560). Many individuals can consent to the same data agreement: each consent is a consent record.
revisionobject
One saved version of a record (a data agreement, a policy, a consent record or a data disclosure agreement). Each change makes a new revision. The revision holds the record as JSON and a SHA-1 hash of the snapshot, and it links to the hash of the revision before it, so that you can detect a changed history. Only successorId changes after the server saves a revision.