Data & privacy

DPDP: versioned privacy notices, rights requests with the 90-day clock (access reports, corrections, erasure), retention policies and legal holds, the audit log and the full company export.

GET/v1/privacy/audit-logs

The audit log

Newest first; values in diffs follow your field rules (masked numbers stay masked).

Access: Signed-in members only (web or Android session) — not for API keys. Permission privacy.audit_log.

Parameters

actorquery: string
A member id, or `system`.
actionquery: string
entity_typequery: string
entity_idquery: string
fromquery: string
YYYY-MM-DD, company calendar, inclusive.
toquery: string
YYYY-MM-DD, company calendar, inclusive.
qquery: string
cursorquery: string
Opaque cursor from the previous page (`meta.next_cursor`).
limitquery: integer
Page size, 1–200.

Response · 200

datarequired: array of AuditLogEntry
metarequired: PageMeta

Request

curl -X GET 'https://api.propzolo.com/v1/privacy/audit-logs' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": [
    {
      "id": "cmusrceel0000q7kaafxqi1om",
      "at": "2026-10-06T05:30:00.000Z",
      "actor": {
        "kind": "member",
        "member_id": "cmusrceel0000q7kaafxqi1om",
        "name": "string",
        "detail": "string"
      },
      "action": "string",
      "entity_type": "string",
      "entity_id": "string",
      "description": "string",
      "ip": "string",
      "user_agent": "string",
      "request_id": "string",
      "changes": [
        {
          "field": "string",
          "old": null,
          "new": null
        }
      ],
      "meta": {}
    }
  ],
  "meta": {
    "next_cursor": "string",
    "has_more": true
  }
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

GET/v1/privacy/audit-logs/export

Export the filtered audit log as CSV

Watermarked with your name; at most 10,000 entries (narrow the dates otherwise); audited.

Access: Signed-in members only (web or Android session) — not for API keys. Permission privacy.audit_log.

Parameters

actorquery: string
A member id, or `system`.
actionquery: string
entity_typequery: string
entity_idquery: string
fromquery: string
YYYY-MM-DD, company calendar, inclusive.
toquery: string
YYYY-MM-DD, company calendar, inclusive.
qquery: string

Response · 200

Returned as is.

Request

curl -X GET 'https://api.propzolo.com/v1/privacy/audit-logs/export' \
  -H 'Authorization: Bearer pz_live_…'

Response example

"string"

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

GET/v1/privacy/audit-logs/options

Values for the audit log filters

Access: Signed-in members only (web or Android session) — not for API keys. Permission privacy.audit_log.

Response · 200

datarequired: object
data.membersrequired: array of object
data.members[].idrequired: Id
Opaque record id.
data.members[].namerequired: string
data.actionsrequired: array of string
data.entity_typesrequired: array of string
metarequired: object

Request

curl -X GET 'https://api.propzolo.com/v1/privacy/audit-logs/options' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": {
    "members": [
      {
        "id": "cmusrceel0000q7kaafxqi1om",
        "name": "string"
      }
    ],
    "actions": [
      "string"
    ],
    "entity_types": [
      "string"
    ]
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

GET/v1/privacy/audit-logs/{id}

One audit entry with its diff

Access: Signed-in members only (web or Android session) — not for API keys. Permission privacy.audit_log.

Parameters

idpathrequired: Id
Opaque record id.

Response · 200

datarequired: AuditLogEntry
metarequired: object

Request

curl -X GET 'https://api.propzolo.com/v1/privacy/audit-logs/{id}' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": {
    "id": "cmusrceel0000q7kaafxqi1om",
    "at": "2026-10-06T05:30:00.000Z",
    "actor": {
      "kind": "member",
      "member_id": "cmusrceel0000q7kaafxqi1om",
      "name": "string",
      "detail": "string"
    },
    "action": "string",
    "entity_type": "string",
    "entity_id": "string",
    "description": "string",
    "ip": "string",
    "user_agent": "string",
    "request_id": "string",
    "changes": [
      {
        "field": "string",
        "old": null,
        "new": null
      }
    ],
    "meta": {}
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
404 Not found — records of another company are reported the same way.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

GET/v1/privacy/company-exports

Full company exports

The company owner only.

Access: Signed-in members only (web or Android session) — not for API keys. Permission imports_exports.full_export.

Response · 200

datarequired: array of CompanyExport
metarequired: object

Request

curl -X GET 'https://api.propzolo.com/v1/privacy/company-exports' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": [
    {
      "id": "cmusrceel0000q7kaafxqi1om",
      "status": "string",
      "requested_at": "2026-10-06T05:30:00.000Z",
      "requested_by": "string",
      "finished_at": "2026-10-06T05:30:00.000Z",
      "expires_at": "2026-10-06T05:30:00.000Z",
      "tables": 0,
      "rows": 0,
      "files": 0,
      "error": "string"
    }
  ],
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

POST/v1/privacy/company-exports

Export all company data

CSV + JSON per table and an index of stored files; the owner is notified when it is ready (24 h links).

Access: Signed-in members only (web or Android session) — not for API keys. Permission imports_exports.full_export.

Response · 202

datarequired: CompanyExport
metarequired: object

Request

curl -X POST 'https://api.propzolo.com/v1/privacy/company-exports' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": {
    "id": "cmusrceel0000q7kaafxqi1om",
    "status": "string",
    "requested_at": "2026-10-06T05:30:00.000Z",
    "requested_by": "string",
    "finished_at": "2026-10-06T05:30:00.000Z",
    "expires_at": "2026-10-06T05:30:00.000Z",
    "tables": 0,
    "rows": 0,
    "files": 0,
    "error": "string"
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

GET/v1/privacy/company-exports/{id}

Download links of a finished company export

Access: Signed-in members only (web or Android session) — not for API keys. Permission imports_exports.full_export.

Parameters

idpathrequired: Id
Opaque record id.

Response · 200

datarequired: CompanyExportDownload
metarequired: object

Request

curl -X GET 'https://api.propzolo.com/v1/privacy/company-exports/{id}' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": {
    "id": "cmusrceel0000q7kaafxqi1om",
    "expires_at": "2026-10-06T05:30:00.000Z",
    "manifest": {
      "url": "string",
      "filename": "string"
    },
    "files_index": {
      "url": "string",
      "filename": "string",
      "files": 0
    },
    "parts": [
      {
        "table": "string",
        "part": 0,
        "rows": 0,
        "csv_url": "string",
        "json_url": "string",
        "filename": "string"
      }
    ]
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
404 Not found — records of another company are reported the same way.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

GET/v1/privacy/holds

Legal holds

Access: Signed-in members only (web or Android session) — not for API keys. Permission privacy.retention.

Parameters

statusquery: "active" | "released" | "all"
contact_idquery: Id
Opaque record id.

Response · 200

datarequired: array of LegalHold
metarequired: object

Request

curl -X GET 'https://api.propzolo.com/v1/privacy/holds' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": [
    {
      "id": "cmusrceel0000q7kaafxqi1om",
      "entity_type": "string",
      "entity_id": "string",
      "entity_label": "string",
      "contact_id": "cmusrceel0000q7kaafxqi1om",
      "contact_name": "string",
      "reason": "string",
      "active": true,
      "expires_at": "2026-10-06T05:30:00.000Z",
      "placed_at": "2026-10-06T05:30:00.000Z",
      "placed_by": "string",
      "released_at": "2026-10-06T05:30:00.000Z",
      "released_by": "string",
      "release_note": "string"
    }
  ],
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

POST/v1/privacy/holds

Place a legal hold

A hold on a contact, lead or deal protects everything of that person from purges and erasure.

Access: Signed-in members only (web or Android session) — not for API keys. Permission privacy.retention.

Request body

entity_typerequired: LegalHoldEntity
entity_idrequired: Id
Opaque record id.
reasonrequired: string
expires_at: DateTime or null
Instant in ISO 8601, e.g. 2026-10-03T04:30:00.000Z.

Response · 201

datarequired: LegalHold
metarequired: object

Request

curl -X POST 'https://api.propzolo.com/v1/privacy/holds' \
  -H 'Authorization: Bearer pz_live_…' \
  -H 'Content-Type: application/json' \
  -d '{"entity_type":"contact","entity_id":"cmusrceel0000q7kaafxqi1om","reason":"string","expires_at":"2026-10-06T05:30:00.000Z"}'

Response example

{
  "data": {
    "id": "cmusrceel0000q7kaafxqi1om",
    "entity_type": "string",
    "entity_id": "string",
    "entity_label": "string",
    "contact_id": "cmusrceel0000q7kaafxqi1om",
    "contact_name": "string",
    "reason": "string",
    "active": true,
    "expires_at": "2026-10-06T05:30:00.000Z",
    "placed_at": "2026-10-06T05:30:00.000Z",
    "placed_by": "string",
    "released_at": "2026-10-06T05:30:00.000Z",
    "released_by": "string",
    "release_note": "string"
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
409 A unique value already exists, a concurrent change won, or the Idempotency-Key is still in use or was sent with a different request.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

POST/v1/privacy/holds/{id}/release

Release a legal hold

Access: Signed-in members only (web or Android session) — not for API keys. Permission privacy.retention.

Parameters

idpathrequired: Id
Opaque record id.

Request body

note: string or null

Response · 200

datarequired: LegalHold
metarequired: object

Request

curl -X POST 'https://api.propzolo.com/v1/privacy/holds/{id}/release' \
  -H 'Authorization: Bearer pz_live_…' \
  -H 'Content-Type: application/json' \
  -d '{"note":"string"}'

Response example

{
  "data": {
    "id": "cmusrceel0000q7kaafxqi1om",
    "entity_type": "string",
    "entity_id": "string",
    "entity_label": "string",
    "contact_id": "cmusrceel0000q7kaafxqi1om",
    "contact_name": "string",
    "reason": "string",
    "active": true,
    "expires_at": "2026-10-06T05:30:00.000Z",
    "placed_at": "2026-10-06T05:30:00.000Z",
    "placed_by": "string",
    "released_at": "2026-10-06T05:30:00.000Z",
    "released_by": "string",
    "release_note": "string"
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
404 Not found — records of another company are reported the same way.
409 A unique value already exists, a concurrent change won, or the Idempotency-Key is still in use or was sent with a different request.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

GET/v1/privacy/notices

Privacy notices with their publish history

Needs `settings.communication` or `privacy.requests`.

Access: Signed-in members only (web or Android session) — not for API keys. Permission settings.communication or privacy.requests.

Response · 200

datarequired: array of PrivacyNotice
metarequired: object

Request

curl -X GET 'https://api.propzolo.com/v1/privacy/notices' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": [
    {
      "id": "cmusrceel0000q7kaafxqi1om",
      "purpose": "string",
      "language": "string",
      "version": 0,
      "title": "string",
      "body": "string",
      "content_hash": "string",
      "status": "draft",
      "published_at": "2026-10-06T05:30:00.000Z",
      "published_by": "string",
      "retired_at": "2026-10-06T05:30:00.000Z",
      "created_at": "2026-10-06T05:30:00.000Z",
      "updated_at": "2026-10-06T05:30:00.000Z"
    }
  ],
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

POST/v1/privacy/notices

Start the next version of a notice (draft)

One draft per purpose and language; publishing makes it the version in force.

Access: Signed-in members only (web or Android session) — not for API keys. Permission settings.communication or privacy.requests.

Request body

purposerequired: NoticePurpose
languagerequired: NoticeLanguage
English or an Eighth Schedule language (ISO 639-1).
titlerequired: string
bodyrequired: string

Response · 201

datarequired: PrivacyNotice
metarequired: object

Request

curl -X POST 'https://api.propzolo.com/v1/privacy/notices' \
  -H 'Authorization: Bearer pz_live_…' \
  -H 'Content-Type: application/json' \
  -d '{"purpose":"general","language":"en","title":"string","body":"string"}'

Response example

{
  "data": {
    "id": "cmusrceel0000q7kaafxqi1om",
    "purpose": "string",
    "language": "string",
    "version": 0,
    "title": "string",
    "body": "string",
    "content_hash": "string",
    "status": "draft",
    "published_at": "2026-10-06T05:30:00.000Z",
    "published_by": "string",
    "retired_at": "2026-10-06T05:30:00.000Z",
    "created_at": "2026-10-06T05:30:00.000Z",
    "updated_at": "2026-10-06T05:30:00.000Z"
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
409 A unique value already exists, a concurrent change won, or the Idempotency-Key is still in use or was sent with a different request.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

PATCH/v1/privacy/notices/{id}

Edit a draft notice

Access: Signed-in members only (web or Android session) — not for API keys. Permission settings.communication or privacy.requests.

Parameters

idpathrequired: Id
Opaque record id.

Request body

title: string
body: string

Response · 200

datarequired: PrivacyNotice
metarequired: object

Request

curl -X PATCH 'https://api.propzolo.com/v1/privacy/notices/{id}' \
  -H 'Authorization: Bearer pz_live_…' \
  -H 'Content-Type: application/json' \
  -d '{"title":"string","body":"string"}'

Response example

{
  "data": {
    "id": "cmusrceel0000q7kaafxqi1om",
    "purpose": "string",
    "language": "string",
    "version": 0,
    "title": "string",
    "body": "string",
    "content_hash": "string",
    "status": "draft",
    "published_at": "2026-10-06T05:30:00.000Z",
    "published_by": "string",
    "retired_at": "2026-10-06T05:30:00.000Z",
    "created_at": "2026-10-06T05:30:00.000Z",
    "updated_at": "2026-10-06T05:30:00.000Z"
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
404 Not found — records of another company are reported the same way.
409 A unique value already exists, a concurrent change won, or the Idempotency-Key is still in use or was sent with a different request.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

DELETE/v1/privacy/notices/{id}

Delete a draft notice

Access: Signed-in members only (web or Android session) — not for API keys. Permission settings.communication or privacy.requests.

Parameters

idpathrequired: Id
Opaque record id.

Response · 200

datarequired: object
data.idrequired: Id
Opaque record id.
data.deletedrequired: true
metarequired: object

Request

curl -X DELETE 'https://api.propzolo.com/v1/privacy/notices/{id}' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": {
    "id": "cmusrceel0000q7kaafxqi1om",
    "deleted": true
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
404 Not found — records of another company are reported the same way.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

POST/v1/privacy/notices/{id}/publish

Publish a draft notice

The previous published version of the same purpose and language is retired.

Access: Signed-in members only (web or Android session) — not for API keys. Permission settings.communication or privacy.requests.

Parameters

idpathrequired: Id
Opaque record id.

Response · 200

datarequired: PrivacyNotice
metarequired: object

Request

curl -X POST 'https://api.propzolo.com/v1/privacy/notices/{id}/publish' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": {
    "id": "cmusrceel0000q7kaafxqi1om",
    "purpose": "string",
    "language": "string",
    "version": 0,
    "title": "string",
    "body": "string",
    "content_hash": "string",
    "status": "draft",
    "published_at": "2026-10-06T05:30:00.000Z",
    "published_by": "string",
    "retired_at": "2026-10-06T05:30:00.000Z",
    "created_at": "2026-10-06T05:30:00.000Z",
    "updated_at": "2026-10-06T05:30:00.000Z"
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
404 Not found — records of another company are reported the same way.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

POST/v1/privacy/notices/{id}/retire

Take a published notice down

Access: Signed-in members only (web or Android session) — not for API keys. Permission settings.communication or privacy.requests.

Parameters

idpathrequired: Id
Opaque record id.

Response · 200

datarequired: PrivacyNotice
metarequired: object

Request

curl -X POST 'https://api.propzolo.com/v1/privacy/notices/{id}/retire' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": {
    "id": "cmusrceel0000q7kaafxqi1om",
    "purpose": "string",
    "language": "string",
    "version": 0,
    "title": "string",
    "body": "string",
    "content_hash": "string",
    "status": "draft",
    "published_at": "2026-10-06T05:30:00.000Z",
    "published_by": "string",
    "retired_at": "2026-10-06T05:30:00.000Z",
    "created_at": "2026-10-06T05:30:00.000Z",
    "updated_at": "2026-10-06T05:30:00.000Z"
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
404 Not found — records of another company are reported the same way.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

GET/v1/privacy/requests

DPDP rights requests

Newest first. `view=open|overdue|closed`; `q` matches the requester, phone, email or R-number.

Access: Signed-in members only (web or Android session) — not for API keys. Permission privacy.requests.

Parameters

viewquery: "open" | "overdue" | "closed" | "all"
statusquery: RightsStatus
kindquery: RightsKind
qquery: string
cursorquery: string
Opaque cursor from the previous page (`meta.next_cursor`).
limitquery: integer
Page size, 1–200.

Response · 200

datarequired: array of RightsRequestListItem
metarequired: object
meta.next_cursorrequired: string or null
Opaque cursor of the next page; null on the last page.
meta.has_morerequired: boolean
meta.summaryrequired: object
meta.summary.openrequired: number
meta.summary.overduerequired: number
meta.summary.due_soonrequired: number
meta.summary.closed_90drequired: number

Request

curl -X GET 'https://api.propzolo.com/v1/privacy/requests' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": [
    {
      "id": "cmusrceel0000q7kaafxqi1om",
      "ref": "string",
      "number": 0,
      "kind": "string",
      "status": "string",
      "requester_name": "string",
      "phone": "string",
      "email": "string",
      "received_at": "2026-10-06T05:30:00.000Z",
      "due_at": "2026-10-06T05:30:00.000Z",
      "sla": "on_track",
      "days_left": 0,
      "assignee": {
        "id": "cmusrceel0000q7kaafxqi1om",
        "name": "string"
      },
      "contact_count": 0,
      "action_status": "string"
    }
  ],
  "meta": {
    "next_cursor": "string",
    "has_more": true,
    "summary": {
      "open": 0,
      "overdue": 0,
      "due_soon": 0,
      "closed_90d": 0
    }
  }
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

POST/v1/privacy/requests

Record a request received offline

For requests by phone, letter or in person; note how the person’s identity was checked.

Access: Signed-in members only (web or Android session) — not for API keys. Permission privacy.requests.

Request body

kindrequired: RightsKind
requester_namerequired: string
phone: string or null
email: string or null
details: string or null
nominee: object or null
nominee.namerequired: string
nominee.relationship: string or null
nominee.contact: string or null
identity_noterequired: string

Response · 201

datarequired: RightsRequest
metarequired: object

Request

curl -X POST 'https://api.propzolo.com/v1/privacy/requests' \
  -H 'Authorization: Bearer pz_live_…' \
  -H 'Content-Type: application/json' \
  -d '{"kind":"access","requester_name":"string","phone":"string","email":"string","details":"string","nominee":{"name":"string","relationship":"string","contact":"string"},"identity_note":"string"}'

Response example

{
  "data": {
    "id": "cmusrceel0000q7kaafxqi1om",
    "ref": "string",
    "number": 0,
    "kind": "string",
    "status": "string",
    "requester_name": "string",
    "phone": "string",
    "email": "string",
    "received_at": "2026-10-06T05:30:00.000Z",
    "due_at": "2026-10-06T05:30:00.000Z",
    "sla": "on_track",
    "days_left": 0,
    "assignee": {
      "id": "cmusrceel0000q7kaafxqi1om",
      "name": "string"
    },
    "contact_count": 0,
    "action_status": "string",
    "channel": "string",
    "verified_via": "string",
    "verified_at": "2026-10-06T05:30:00.000Z",
    "language": "string",
    "details": "string",
    "payload": {},
    "contacts": [
      {
        "id": "cmusrceel0000q7kaafxqi1om",
        "name": "string",
        "erased": true,
        "held": true
      }
    ],
    "report_ready_at": "2026-10-06T05:30:00.000Z",
    "has_report": true,
    "outcome": {},
    "resolution": "string",
    "timeline": [
      {
        "at": "string",
        "kind": "received",
        "by": "string",
        "by_name": "string",
        "text": "string"
      }
    ],
    "closed_at": "2026-10-06T05:30:00.000Z",
    "closed_by": "string"
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
409 A unique value already exists, a concurrent change won, or the Idempotency-Key is still in use or was sent with a different request.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

GET/v1/privacy/requests/intake

The public request link and its QR code

Access: Signed-in members only (web or Android session) — not for API keys. Permission privacy.requests.

Response · 200

datarequired: object
data.urlrequired: string
data.notice_urlrequired: string
data.qr_svgrequired: string
data:image/svg+xml URL of the QR code.
metarequired: object

Request

curl -X GET 'https://api.propzolo.com/v1/privacy/requests/intake' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": {
    "url": "string",
    "notice_url": "string",
    "qr_svg": "string"
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

GET/v1/privacy/requests/{id}

A rights request with its timeline

Access: Signed-in members only (web or Android session) — not for API keys. Permission privacy.requests.

Parameters

idpathrequired: Id
Opaque record id.

Response · 200

datarequired: RightsRequest
metarequired: object

Request

curl -X GET 'https://api.propzolo.com/v1/privacy/requests/{id}' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": {
    "id": "cmusrceel0000q7kaafxqi1om",
    "ref": "string",
    "number": 0,
    "kind": "string",
    "status": "string",
    "requester_name": "string",
    "phone": "string",
    "email": "string",
    "received_at": "2026-10-06T05:30:00.000Z",
    "due_at": "2026-10-06T05:30:00.000Z",
    "sla": "on_track",
    "days_left": 0,
    "assignee": {
      "id": "cmusrceel0000q7kaafxqi1om",
      "name": "string"
    },
    "contact_count": 0,
    "action_status": "string",
    "channel": "string",
    "verified_via": "string",
    "verified_at": "2026-10-06T05:30:00.000Z",
    "language": "string",
    "details": "string",
    "payload": {},
    "contacts": [
      {
        "id": "cmusrceel0000q7kaafxqi1om",
        "name": "string",
        "erased": true,
        "held": true
      }
    ],
    "report_ready_at": "2026-10-06T05:30:00.000Z",
    "has_report": true,
    "outcome": {},
    "resolution": "string",
    "timeline": [
      {
        "at": "string",
        "kind": "received",
        "by": "string",
        "by_name": "string",
        "text": "string"
      }
    ],
    "closed_at": "2026-10-06T05:30:00.000Z",
    "closed_by": "string"
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
404 Not found — records of another company are reported the same way.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

PATCH/v1/privacy/requests/{id}

Assign, confirm contacts, answer or close a request

Closing (completed / rejected) needs a resolution — the answer given to the person.

Access: Signed-in members only (web or Android session) — not for API keys. Permission privacy.requests.

Parameters

idpathrequired: Id
Opaque record id.

Request body

status: RightsStatus
assignee_id: Id or null
Opaque record id.
resolution: string or null
contact_ids: array of Id
Opaque record id.
subprocessor: object
subprocessor.keyrequired: string
subprocessor.donerequired: boolean

Response · 200

datarequired: RightsRequest
metarequired: object

Request

curl -X PATCH 'https://api.propzolo.com/v1/privacy/requests/{id}' \
  -H 'Authorization: Bearer pz_live_…' \
  -H 'Content-Type: application/json' \
  -d '{"status":"open","assignee_id":"cmusrceel0000q7kaafxqi1om","resolution":"string","contact_ids":["cmusrceel0000q7kaafxqi1om"],"subprocessor":{"key":"string","done":true}}'

Response example

{
  "data": {
    "id": "cmusrceel0000q7kaafxqi1om",
    "ref": "string",
    "number": 0,
    "kind": "string",
    "status": "string",
    "requester_name": "string",
    "phone": "string",
    "email": "string",
    "received_at": "2026-10-06T05:30:00.000Z",
    "due_at": "2026-10-06T05:30:00.000Z",
    "sla": "on_track",
    "days_left": 0,
    "assignee": {
      "id": "cmusrceel0000q7kaafxqi1om",
      "name": "string"
    },
    "contact_count": 0,
    "action_status": "string",
    "channel": "string",
    "verified_via": "string",
    "verified_at": "2026-10-06T05:30:00.000Z",
    "language": "string",
    "details": "string",
    "payload": {},
    "contacts": [
      {
        "id": "cmusrceel0000q7kaafxqi1om",
        "name": "string",
        "erased": true,
        "held": true
      }
    ],
    "report_ready_at": "2026-10-06T05:30:00.000Z",
    "has_report": true,
    "outcome": {},
    "resolution": "string",
    "timeline": [
      {
        "at": "string",
        "kind": "received",
        "by": "string",
        "by_name": "string",
        "text": "string"
      }
    ],
    "closed_at": "2026-10-06T05:30:00.000Z",
    "closed_by": "string"
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
404 Not found — records of another company are reported the same way.
409 A unique value already exists, a concurrent change won, or the Idempotency-Key is still in use or was sent with a different request.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

GET/v1/privacy/requests/{id}/access-report

Download the access report

Redirects (302) to a 5-minute link; with `Accept: application/json` the link comes back instead.

Access: Signed-in members only (web or Android session) — not for API keys. Permission privacy.requests.

Parameters

idpathrequired: Id
Opaque record id.

Response · 200

datarequired: object
data.urlrequired: string
data.expires_atrequired: DateTime
Instant in ISO 8601, e.g. 2026-10-03T04:30:00.000Z.
data.filenamerequired: string
metarequired: object

Request

curl -X GET 'https://api.propzolo.com/v1/privacy/requests/{id}/access-report' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": {
    "url": "string",
    "expires_at": "2026-10-06T05:30:00.000Z",
    "filename": "string"
  },
  "meta": {}
}

Errors

302 Redirect to the report.
401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
404 Not found — records of another company are reported the same way.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

POST/v1/privacy/requests/{id}/access-report

Generate the access report

Queued; the handler is notified when the JSON report is ready.

Access: Signed-in members only (web or Android session) — not for API keys. Permission privacy.requests.

Parameters

idpathrequired: Id
Opaque record id.

Response · 202

datarequired: RightsRequest
metarequired: object

Request

curl -X POST 'https://api.propzolo.com/v1/privacy/requests/{id}/access-report' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": {
    "id": "cmusrceel0000q7kaafxqi1om",
    "ref": "string",
    "number": 0,
    "kind": "string",
    "status": "string",
    "requester_name": "string",
    "phone": "string",
    "email": "string",
    "received_at": "2026-10-06T05:30:00.000Z",
    "due_at": "2026-10-06T05:30:00.000Z",
    "sla": "on_track",
    "days_left": 0,
    "assignee": {
      "id": "cmusrceel0000q7kaafxqi1om",
      "name": "string"
    },
    "contact_count": 0,
    "action_status": "string",
    "channel": "string",
    "verified_via": "string",
    "verified_at": "2026-10-06T05:30:00.000Z",
    "language": "string",
    "details": "string",
    "payload": {},
    "contacts": [
      {
        "id": "cmusrceel0000q7kaafxqi1om",
        "name": "string",
        "erased": true,
        "held": true
      }
    ],
    "report_ready_at": "2026-10-06T05:30:00.000Z",
    "has_report": true,
    "outcome": {},
    "resolution": "string",
    "timeline": [
      {
        "at": "string",
        "kind": "received",
        "by": "string",
        "by_name": "string",
        "text": "string"
      }
    ],
    "closed_at": "2026-10-06T05:30:00.000Z",
    "closed_by": "string"
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
404 Not found — records of another company are reported the same way.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

POST/v1/privacy/requests/{id}/correction

Apply a correction to a contact

Before / after values go to the audit log. Phones are changed on the contact page.

Access: Signed-in members only (web or Android session) — not for API keys. Permission privacy.requests.

Parameters

idpathrequired: Id
Opaque record id.

Request body

contact_idrequired: Id
Opaque record id.
changesrequired: object
changes.name: string or null
changes.first_name: string or null
changes.last_name: string or null
changes.email: string or null
changes.alt_email: string or null
changes.city: string or null
changes.address: string or null
changes.pincode: string or null
changes.occupation: string or null
changes.employer: string or null
changes.designation: string or null
changes.language: string or null

Response · 200

datarequired: RightsRequest
metarequired: object

Request

curl -X POST 'https://api.propzolo.com/v1/privacy/requests/{id}/correction' \
  -H 'Authorization: Bearer pz_live_…' \
  -H 'Content-Type: application/json' \
  -d '{"contact_id":"cmusrceel0000q7kaafxqi1om","changes":{"name":"string","first_name":"string","last_name":"string","email":"string","alt_email":"string","city":"string","address":"string","pincode":"string","occupation":"string","employer":"string","designation":"string","language":"string"}}'

Response example

{
  "data": {
    "id": "cmusrceel0000q7kaafxqi1om",
    "ref": "string",
    "number": 0,
    "kind": "string",
    "status": "string",
    "requester_name": "string",
    "phone": "string",
    "email": "string",
    "received_at": "2026-10-06T05:30:00.000Z",
    "due_at": "2026-10-06T05:30:00.000Z",
    "sla": "on_track",
    "days_left": 0,
    "assignee": {
      "id": "cmusrceel0000q7kaafxqi1om",
      "name": "string"
    },
    "contact_count": 0,
    "action_status": "string",
    "channel": "string",
    "verified_via": "string",
    "verified_at": "2026-10-06T05:30:00.000Z",
    "language": "string",
    "details": "string",
    "payload": {},
    "contacts": [
      {
        "id": "cmusrceel0000q7kaafxqi1om",
        "name": "string",
        "erased": true,
        "held": true
      }
    ],
    "report_ready_at": "2026-10-06T05:30:00.000Z",
    "has_report": true,
    "outcome": {},
    "resolution": "string",
    "timeline": [
      {
        "at": "string",
        "kind": "received",
        "by": "string",
        "by_name": "string",
        "text": "string"
      }
    ],
    "closed_at": "2026-10-06T05:30:00.000Z",
    "closed_by": "string"
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
404 Not found — records of another company are reported the same way.
409 A unique value already exists, a concurrent change won, or the Idempotency-Key is still in use or was sent with a different request.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

POST/v1/privacy/requests/{id}/erase

Queues the erasure cascade (contacts, leads, message bodies, media, AI links, storage objects); statutory records are kept with personal fields masked, the addresses are suppressed and a tombstone is recorded. Refused (409) while a legal hold covers the person.

Access: Signed-in members only (web or Android session) — not for API keys. Permission privacy.requests.

Parameters

idpathrequired: Id
Opaque record id.

Response · 202

datarequired: RightsRequest
metarequired: object

Request

curl -X POST 'https://api.propzolo.com/v1/privacy/requests/{id}/erase' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": {
    "id": "cmusrceel0000q7kaafxqi1om",
    "ref": "string",
    "number": 0,
    "kind": "string",
    "status": "string",
    "requester_name": "string",
    "phone": "string",
    "email": "string",
    "received_at": "2026-10-06T05:30:00.000Z",
    "due_at": "2026-10-06T05:30:00.000Z",
    "sla": "on_track",
    "days_left": 0,
    "assignee": {
      "id": "cmusrceel0000q7kaafxqi1om",
      "name": "string"
    },
    "contact_count": 0,
    "action_status": "string",
    "channel": "string",
    "verified_via": "string",
    "verified_at": "2026-10-06T05:30:00.000Z",
    "language": "string",
    "details": "string",
    "payload": {},
    "contacts": [
      {
        "id": "cmusrceel0000q7kaafxqi1om",
        "name": "string",
        "erased": true,
        "held": true
      }
    ],
    "report_ready_at": "2026-10-06T05:30:00.000Z",
    "has_report": true,
    "outcome": {},
    "resolution": "string",
    "timeline": [
      {
        "at": "string",
        "kind": "received",
        "by": "string",
        "by_name": "string",
        "text": "string"
      }
    ],
    "closed_at": "2026-10-06T05:30:00.000Z",
    "closed_by": "string"
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
404 Not found — records of another company are reported the same way.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

POST/v1/privacy/requests/{id}/notes

Add a case note

Access: Signed-in members only (web or Android session) — not for API keys. Permission privacy.requests.

Parameters

idpathrequired: Id
Opaque record id.

Request body

textrequired: string

Response · 201

datarequired: RightsRequest
metarequired: object

Request

curl -X POST 'https://api.propzolo.com/v1/privacy/requests/{id}/notes' \
  -H 'Authorization: Bearer pz_live_…' \
  -H 'Content-Type: application/json' \
  -d '{"text":"string"}'

Response example

{
  "data": {
    "id": "cmusrceel0000q7kaafxqi1om",
    "ref": "string",
    "number": 0,
    "kind": "string",
    "status": "string",
    "requester_name": "string",
    "phone": "string",
    "email": "string",
    "received_at": "2026-10-06T05:30:00.000Z",
    "due_at": "2026-10-06T05:30:00.000Z",
    "sla": "on_track",
    "days_left": 0,
    "assignee": {
      "id": "cmusrceel0000q7kaafxqi1om",
      "name": "string"
    },
    "contact_count": 0,
    "action_status": "string",
    "channel": "string",
    "verified_via": "string",
    "verified_at": "2026-10-06T05:30:00.000Z",
    "language": "string",
    "details": "string",
    "payload": {},
    "contacts": [
      {
        "id": "cmusrceel0000q7kaafxqi1om",
        "name": "string",
        "erased": true,
        "held": true
      }
    ],
    "report_ready_at": "2026-10-06T05:30:00.000Z",
    "has_report": true,
    "outcome": {},
    "resolution": "string",
    "timeline": [
      {
        "at": "string",
        "kind": "received",
        "by": "string",
        "by_name": "string",
        "text": "string"
      }
    ],
    "closed_at": "2026-10-06T05:30:00.000Z",
    "closed_by": "string"
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
404 Not found — records of another company are reported the same way.
409 A unique value already exists, a concurrent change won, or the Idempotency-Key is still in use or was sent with a different request.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

GET/v1/privacy/retention

Retention policies

Access: Signed-in members only (web or Android session) — not for API keys. Permission privacy.retention.

Response · 200

datarequired: array of RetentionPolicy
metarequired: object

Request

curl -X GET 'https://api.propzolo.com/v1/privacy/retention' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": [
    {
      "kind": "invalid_leads",
      "label": "string",
      "description": "string",
      "unit": "days",
      "min_days": 0,
      "max_days": 0,
      "keep_days": 0,
      "enabled": true,
      "last_run_at": "2026-10-06T05:30:00.000Z",
      "last_run": {},
      "updated_by": "string",
      "updated_at": "2026-10-06T05:30:00.000Z"
    }
  ],
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

PUT/v1/privacy/retention

Set retention periods and switch policies on or off

Access: Signed-in members only (web or Android session) — not for API keys. Permission privacy.retention.

Request body

policiesrequired: array of object
policies[].kindrequired: RetentionKind
policies[].keep_daysrequired: integer
policies[].enabledrequired: boolean

Response · 200

datarequired: array of RetentionPolicy
metarequired: object

Request

curl -X PUT 'https://api.propzolo.com/v1/privacy/retention' \
  -H 'Authorization: Bearer pz_live_…' \
  -H 'Content-Type: application/json' \
  -d '{"policies":[{"kind":"invalid_leads","keep_days":0,"enabled":true}]}'

Response example

{
  "data": [
    {
      "kind": "invalid_leads",
      "label": "string",
      "description": "string",
      "unit": "days",
      "min_days": 0,
      "max_days": 0,
      "keep_days": 0,
      "enabled": true,
      "last_run_at": "2026-10-06T05:30:00.000Z",
      "last_run": {},
      "updated_by": "string",
      "updated_at": "2026-10-06T05:30:00.000Z"
    }
  ],
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
409 A unique value already exists, a concurrent change won, or the Idempotency-Key is still in use or was sent with a different request.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

GET/v1/privacy/retention/preview

Dry run: what each policy would purge now

Optional `<kind>=<days>` query values preview periods before saving them.

Access: Signed-in members only (web or Android session) — not for API keys. Permission privacy.retention.

Parameters

invalid_leadsquery: integer
lost_leadsquery: integer
message_bodiesquery: integer
call_recordingsquery: integer
ingest_payloadsquery: integer
synced_emailsquery: integer
field_locationsquery: integer
attendance_selfiesquery: integer
inventory_messagesquery: integer
debrief_audioquery: integer
kyc_artifactsquery: integer

Response · 200

datarequired: array of RetentionPreview
metarequired: object

Request

curl -X GET 'https://api.propzolo.com/v1/privacy/retention/preview' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": [
    {
      "kind": "invalid_leads",
      "keep_days": 0,
      "cutoff": "2026-10-06T05:30:00.000Z",
      "due": 0,
      "held": 0
    }
  ],
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

POST/v1/privacy/retention/run

Run the enabled policies now

Queued; the purge runs in batches and each policy keeps its last run report.

Access: Signed-in members only (web or Android session) — not for API keys. Permission privacy.retention.

Response · 202

datarequired: object
data.queuedrequired: true
metarequired: object

Request

curl -X POST 'https://api.propzolo.com/v1/privacy/retention/run' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": {
    "queued": true
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.