Data requests

List data update requests of the individual

GET/v4/service/consent/organisation/data-update

Lists all the requests of the individual to update its data in your organisation, open and closed, in no fixed order. dataRequests is null when the individual has made none. The items do not show the consent record, the data agreement or the data attribute of a request: the webhook event data.update.initiated has them. This route takes an API key or a token of the identity provider of the organisation, not an individual token or a token of the privacy dashboard login.

Language of the request sample

curl 'https://demo-api.igrant.io/v4/service/consent/organisation/data-update' \
  -H 'Authorization: ApiKey <your-api-key>'

{
  "dataRequests": [
    {
      "id": "6af2cdfc2d6fb7b6ac6efd17",
      "userId": "6af081b138e8f33dcf799628",
      "userName": "[email protected]",
      "organisationId": "6ae2bf741c3dadfeb27982ec",
      "type": 3,
      "typeStr": "Update Data",
      "state": 1,
      "requestedDate": "2026-11-10 07:55:40 +0000 UTC",
      "closedDate": "0001-01-01 00:00:00 +0000 UTC",
      "stateStr": "Request initiated",
      "comment": ""
    }
  ]
}

Authorizations

Authorizationstringheaderrequired
Your API key with the prefix ApiKey: ApiKey <your-api-key>. Get an API key.
Scope:data-requests:read

Headers

X-ConsentBB-IndividualIdstring
ID of the individual, or its externalId. Mandatory with an API key: without it the answer is 400 ("IndividualId is not present in request header"), and an unknown individual gets 400 too. With an individual token, leave it out: the server takes the individual from the token. Send it only on the routes that list it: with an API key that has resource scopes (for example consent-records:read), another route answers 400 to a request with this header.
Example:"6af081b138e8f33dcf799628"

Response

application/json

The data update requests of the individual.

dataRequestsobject[] | null