<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Data Subject Access Requests — API Reference

## Register DSAR

```bash
node scripts/agent.js --action register \
  --right "access" --subject-id "USER_ID" --subject-email "user@example.com"
```

### Supported Rights

| Right | Article | Deadline |
|-------|---------|----------|
| access | Art. 15 | 1 month |
| rectification | Art. 16 | 1 month |
| erasure | Art. 17 | 1 month |
| restriction | Art. 18 | 1 month |
| portability | Art. 20 | 1 month |
| objection | Art. 21 | Without undue delay |
| automated_decision | Art. 22 | 1 month |

## Check Status

```bash
node scripts/agent.js --action status --dsar-id "DSAR-2026-001"
```

## Discover Data

```bash
node scripts/agent.js --action discover \
  --subject-id "USER_ID" --systems "crm,email,analytics,backups"
```

## Compile Response

```bash
node scripts/agent.js --action compile \
  --dsar-id "DSAR-2026-001" --data-sources /tmp/discovery.json
```

## DSAR Lifecycle

| State | Description | SLA |
|-------|-------------|-----|
| received | Request logged | Day 0 |
| verified | Identity confirmed | Day 1–3 |
| acknowledged | Confirmation sent | Day 1–5 |
| discovery | Data search | Day 5–20 |
| review | Legal review + redaction | Day 20–25 |
| response | Delivered to subject | Day 25–30 |
| closed | Audit trail finalized | Day 30 |

## Access Response Requirements (Art. 15)

| Information | Required |
|------------|----------|
| Categories of personal data | Yes |
| Purposes of processing | Yes |
| Recipients | Yes |
| Retention periods | Yes |
| Source of data | If not from subject |
| Automated decision-making | If applicable |
| Right to complain to SA | Yes |
