Legal / LGPD API 🟡 BETA

LGPD (Lei Geral de Proteção de Dados) compliance — consent management, cookie policy, legal document hosting, and GDPR data subject rights.

Base URL

/api/legal

Authentication

All endpoints require a valid session token via Authorization: Bearer <token> header. GDPR deletion/export endpoints require admin or data_officer role.

Endpoints

Consent Management

POST /api/legal/consent

Records a user’s consent for a specific purpose.

Request Body:

{
  "user_id": "usr_001",
  "purpose": "marketing",
  "granted": true,
  "consent_version": "2025-v2"
}

Response:

{
  "consent_id": "cns_abc123",
  "user_id": "usr_001",
  "purpose": "marketing",
  "granted": true,
  "consent_version": "2025-v2",
  "recorded_at": "2025-06-04T10:00:00Z",
  "ip_address": "192.168.1.50"
}

GET /api/legal/consent/:consent_id

Retrieves details of a specific consent record.

Response:

{
  "consent_id": "cns_abc123",
  "user_id": "usr_001",
  "purpose": "marketing",
  "granted": true,
  "consent_version": "2025-v2",
  "recorded_at": "2025-06-04T10:00:00Z",
  "ip_address": "192.168.1.50",
  "user_agent": "Mozilla/5.0 ...",
  "revoked_at": null
}

PUT /api/legal/consent/:consent_id

Updates (revokes or modifies) an existing consent record.

Request Body:

{
  "granted": false,
  "revocation_reason": "User no longer wishes to receive marketing"
}

Response:

{
  "consent_id": "cns_abc123",
  "granted": false,
  "revoked_at": "2025-06-04T12:00:00Z",
  "revocation_reason": "User no longer wishes to receive marketing"
}

Get Consent by Session

GET /api/legal/consent/session

Returns all consent records for the current session’s user.

Response:

{
  "user_id": "usr_001",
  "consents": [
    {
      "consent_id": "cns_abc123",
      "purpose": "analytics",
      "granted": true,
      "consent_version": "2025-v2",
      "recorded_at": "2025-06-01T08:00:00Z"
    },
    {
      "consent_id": "cns_def456",
      "purpose": "marketing",
      "granted": false,
      "consent_version": "2025-v2",
      "recorded_at": "2025-06-03T14:00:00Z",
      "revoked_at": "2025-06-04T10:00:00Z"
    }
  ]
}

Cookie Policy

GET /api/legal/cookies/policy

Returns the cookie policy configuration for the site.

Response:

{
  "policy_version": "2.1",
  "last_updated": "2025-05-15T00:00:00Z",
  "categories": [
    {
      "name": "Strictly Necessary",
      "required": true,
      "description": "Essential cookies for site functionality",
      "cookies": [
        {
          "name": "session_id",
          "purpose": "User session management",
          "duration": "Session",
          "type": "First-party"
        },
        {
          "name": "csrf_token",
          "purpose": "Cross-site request forgery protection",
          "duration": "Session",
          "type": "First-party"
        }
      ]
    },
    {
      "name": "Analytics",
      "required": false,
      "description": "Usage analytics and performance monitoring",
      "cookies": [
        {
          "name": "_ga",
          "purpose": "Google Analytics visitor tracking",
          "duration": "2 years",
          "type": "Third-party"
        }
      ]
    }
  ],
  "consent_required": ["Analytics", "Marketing", "Third-party Sharing"],
  "privacy_policy_url": "/legal/privacy",
  "contact_email": "dpo@company.com"
}

Legal Documents

GET /api/legal/documents

Lists available legal documents (privacy policy, terms of service, etc.).

Response:

{
  "documents": [
    {
      "slug": "privacy-policy",
      "title": "Política de Privacidade",
      "language": "pt-br",
      "version": "3.1",
      "effective_date": "2025-05-01",
      "published": true
    },
    {
      "slug": "terms-of-service",
      "title": "Termos de Serviço",
      "language": "pt-br",
      "version": "2.0",
      "effective_date": "2025-01-15",
      "published": true
    },
    {
      "slug": "cookie-policy",
      "title": "Política de Cookies",
      "language": "pt-br",
      "version": "2.1",
      "effective_date": "2025-05-15",
      "published": true
    }
  ]
}

POST /api/legal/documents

Creates a new legal document.

Request Body:

{
  "slug": "data-processing-agreement",
  "title": "Acordo de Tratamento de Dados",
  "content": "# Acordo de Tratamento de Dados\n\n## 1. Finalidade\n\n...",
  "language": "pt-br",
  "effective_date": "2025-07-01",
  "published": false
}

Response:

{
  "slug": "data-processing-agreement",
  "title": "Acordo de Tratamento de Dados",
  "version": "1.0",
  "created_at": "2025-06-04T10:00:00Z",
  "published": false
}

GET /api/legal/documents/:slug

Retrieves a specific legal document.

Response:

{
  "slug": "privacy-policy",
  "title": "Política de Privacidade",
  "language": "pt-br",
  "version": "3.1",
  "content": "# Política de Privacidade\n\n...",
  "effective_date": "2025-05-01",
  "published": true,
  "created_at": "2025-04-20T10:00:00Z",
  "updated_at": "2025-04-30T14:00:00Z"
}

PUT /api/legal/documents/:slug

Updates a legal document (creates a new version).

Request Body:

{
  "content": "# Política de Privacidade\n\nAtualizada em 2025...",
  "effective_date": "2025-08-01",
  "published": true
}

Response:

{
  "slug": "privacy-policy",
  "version": "3.2",
  "updated_at": "2025-06-04T11:00:00Z",
  "published": true
}

GDPR / Data Subject Rights

POST /api/legal/gdpr/delete/:user_id

Initiates a data deletion request (right to be forgotten).

Request Body:

{
  "reason": "User requested account deletion via email",
  "confirm": true
}

Response:

{
  "request_id": "gdpr_del_001",
  "user_id": "usr_001",
  "status": "pending",
  "created_at": "2025-06-04T12:00:00Z",
  "estimated_completion": "2025-07-04T12:00:00Z",
  "message": "Data deletion request submitted. Personal data will be anonymized within 30 days."
}

POST /api/legal/gdpr/export/:user_id

Exports all data for a user (right to data portability).

Request Body:

{
  "format": "json"
}

Response:

{
  "request_id": "gdpr_exp_001",
  "user_id": "usr_001",
  "status": "processing",
  "created_at": "2025-06-04T12:30:00Z",
  "download_url": null,
  "message": "Data export initiated. You will receive a download link when ready."
}

After processing:

{
  "request_id": "gdpr_exp_001",
  "user_id": "usr_001",
  "status": "completed",
  "download_url": "/api/legal/gdpr/export/gdpr_exp_001/download",
  "expires_at": "2025-06-11T12:30:00Z",
  "size_bytes": 245760
}

LGPD Legal Bases

Response Codes

See Also

• Compliance API — ISO 27001 compliance checks
• Security API — encryption and access controls
• Admin API — user management and audit trails