Privacy API
GDPR / CCPA / privacy_region self-service on the authenticated user.
Requires Module Hub onboarding ext-privacy columns. Missing schema → 404/400 module_not_installed.
Routes (all under /auth/user/me)
| Method | Path | Notes |
|---|---|---|
GET | /auth/user/me/privacy | Current privacy status |
POST | /auth/user/me/privacy/gdpr-consent | Record consent; optional policy_version, privacy_region |
DELETE | /auth/user/me/privacy/gdpr-consent | Withdraw (gdpr_consent=false) |
POST | /auth/user/me/privacy/ccpa-opt-out | { "opt_out": true|false } |
Auth: session (kyselyAuthMiddleware). Ultra rate limit on writes: 20 / 10 minutes per IP.
Timestamps (*_at) are set server-side only.
First-run wizard may still send privacy fields via onboarding complete; prefer these routes afterward.
Business updates are not on these routes — use Business API / PUT /auth/user/me.
Admin privacy override
PATCH /auth/admin/users/:id/privacy — see Admin API.
Examples
http
GET /auth/user/me/privacy
X-Session-ID: <session>http
POST /auth/user/me/privacy/gdpr-consent
Content-Type: application/json
X-Session-ID: <session>
{ "consent": true, "policy_version": "v2.1", "privacy_region": "eu" }http
DELETE /auth/user/me/privacy/gdpr-consent
X-Session-ID: <session>http
POST /auth/user/me/privacy/ccpa-opt-out
Content-Type: application/json
X-Session-ID: <session>
{ "opt_out": true }