DPDP Rules 2025: Key Changes, Obligations & Implementation Guide

Developer Portal & Agent Hub

Build compliant privacy workflows with IndiaConsent APIs

Self-serve API keys, sandbox environments, cryptographic ledger verification, and native Model Context Protocol (MCP) tools for human engineers and autonomous AI agents.

Get API Keys OpenAPI 3.1 Spec MCP Manifest

Authentication & Access

Self-Serve API Keys & OAuth 2.0

Manage credentials in dashboard

Client Credentials

Generate secure client ID and secret pairs directly in your Data Fiduciary portal. Supports RFC 6749 machine-to-machine authentication.

Scoped Permissions

Granular DPDP scopes (consent:read, consent:write, grievance:manage) guarantee least-privilege access.

Agentic Auth (A2A)

Automated agents authenticate via RFC 8414 metadata and WorkOS-compatible discovery without requiring hardcoded static tokens.

Integration Guide

Quickstart Implementation

Sample snippets showing token exchange and statutory consent creation with idempotency tokens.

# 1. Obtain an OAuth 2.0 Access Token
curl -X POST https://auth.indiaconsent.com/oauth/token \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "client_credentials",
    "client_id": "YOUR_CLIENT_ID",
    "client_secret": "YOUR_CLIENT_SECRET",
    "scope": "consent:write consent:read"
  }'

# 2. Record a statutory consent artifact with an Idempotency-Key
curl -X POST https://api.indiaconsent.com/v1/consents \
  -H "Authorization: Bearer <ACCESS_TOKEN>" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: 9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d" \
  -d '{
    "dataPrincipalId": "dp_ind_84729104",
    "noticeVersion": "2025.1",
    "language": "hi",
    "purposeIds": ["pur_identity_verify", "pur_credit_eval"],
    "retentionPeriodDays": 365,
    "consentTimestamp": "2026-10-06T12:00:00Z"
  }'

Testing & Reliability

Sandbox Environment & Protocol Standards

Test your integrations against our sandbox gateway with automated mocking, idempotency verification, and structured telemetry.

Gateway Specifications

Sandbox Base URLhttps://sandbox.api.indiaconsent.com/v1

Production Base URLhttps://api.indiaconsent.com/v1

Sandbox Auth URLhttps://sandbox.auth.indiaconsent.com/oauth/token

Supported TransportsHTTPS / REST JSON, Streamable HTTP (MCP)

Idempotency StandardRFC 9457 / Header: Idempotency-Key (UUID v4)

Error Response StandardRFC 7807 Problem Details (application/problem+json)

Structured RFC 7807 JSON Error Responses

All IndiaConsent APIs return machine-readable JSON Problem Details (application/problem+json). Errors always supply actionable hint resolution strings for autonomous agents.

{
  "type": "https://www.indiaconsent.com/errors/invalid-purpose",
  "title": "Invalid Purpose Declaration",
  "status": 400,
  "code": "INVALID_PURPOSE_ID",
  "message": "The purposeId 'pur_unknown' is not registered under your Fiduciary profile.",
  "hint": "Register purposes via the Fiduciary Console or verify allowed IDs in your contract schema."
}

API Reference

Core Statutory Endpoints

Compliant REST operations for DPDP Act 2023 Sections 6, 11, 12, 13, and 14.

Method & Endpoint	Scope Required	Idempotency	Description
POST/consents	consent:write	Supported	Capture statutory consent artifact signed with tamper-evident SHA-256 ledger digest.
GET/consents/{consentId}	consent:read	—	Retrieve full signed consent artifact record by unique artifact UUID.
POST/consents/{consentId}/withdraw	consent:withdraw	Supported	Execute instant consent revocation under Section 6(4) with sub-500ms webhook propagation.
POST/consents/verify	consent:read	Supported	Cryptographically verify artifact integrity, signatures, and validity against the ledger.
POST/grievances	grievance:manage	Supported	Lodge formal DPDP grievance redressal ticket with designated Data Protection Officer (DPO).
GET/grievances/{ticketId}	grievance:manage	—	Query status, investigation updates, and statutory closure deadlines for grievance tickets.
POST/rights	rights:request	Supported	Submit Data Principal Rights request (Section 11 Access, Section 12 Erasure, Section 14 Nomination).

Developer Ecosystem

Official CLI Tool & Multi-Language SDKs

Automate DPDP consent verification, artifact signing, and grievance handling using official client libraries and CLI tools.

npm / CLIGitHub

indiaconsent (CLI Tool)

Terminal CLI for scripting DPDP artifact verification, consent capture, and DPO grievance lodging without writing custom code.

npm install -g indiaconsent

npmGitHub

@indiaconsent/sdk (Node.js & TS)

Official TypeScript / JavaScript client with built-in OAuth token rotation, RFC 9457 idempotency keys, and typed models.

npm install @indiaconsent/sdk

PyPIGitHub

indiaconsent (Python SDK)

Python client library with synchronous and async httpx support, automated retry policies, and cryptographic ledger verification.

pip install indiaconsent

Go ModulesGitHub

indiaconsent-go (Go Module)

High-throughput Go client library optimized for low-latency microservice consent verification and audit logging.

go get github.com/alignmycareer/indiaconsent-go

Machine-Readable Hub

Specifications & Agent Manifests

Standardized metadata files consumed by AI agents, IDE extensions, and OpenAPI generators.

REST Spec

OpenAPI 3.1.0 Specification

Complete machine-readable OpenAPI schema with declared OAuth scopes, parameter schemas, and RFC 7807 error responses.

/openapi.json

Agent Tools

Model Context Protocol (MCP)

Streamable HTTP manifest exposing IndiaConsent tools natively to Claude, ChatGPT, and AI agents.

/mcp.json

RFC 8414

OAuth 2.0 Authorization Server

RFC 8414 metadata documenting token endpoints, PKCE S256 challenge methods, and grant types.

/.well-known/oauth-authorization-server

Discovery

Agent LLMs Index (llms.txt)

Curated Markdown index for LLMs and autonomous agents detailing product boundaries, pricing, and auth.

/llms.txt

Ready to integrate IndiaConsent?

Get self-serve API keys in minutes or test against our sandbox environment. Free tier includes up to 5,000 consent transactions.

Create API Key Contact DPO Team