openapi: 3.2.0 info: title: Tech Risk & Compliance - Enterprise Policy Management… version: '1.0' contact: name: OneTrust Support url: https://my.onetrust.com/s/contactsupport license: name: Apache 2.0 url: https://www.apache.org/licenses/LICENSE-2.0 description: The Enterprise Policy Management APIs are used to integrate external systems and streamline the flow of data with Enterprise Policy Management in the OneTrust platform. servers: - url: https://{hostname}/api/enterprise-policy variables: hostname: default: hostname description: The OneTrust hostname such as app.onetrust.com, app-eu.onetrust.com, app-de.onetrust.com, app-uk.onetrust.com, app-apac.onetrust.com, trial.onetrust.com, or uat.onetrust.com. tags: - name: Documents description: The Documents APIs are used to manage document objects such as policies, standards, procedures, and privacy notices. externalDocs: description: OpenAPI 3.1.0 - Download Definition url: https://developer.onetrust.com/onetrust/openapi/tech-risk-compliance-enterprise-policy-management.json paths: /v1/{complianceType}/create: post: operationId: createPolicy summary: Create Document description: Use this API to create a policy, standard, procedure, or privacy notice. tags: - Documents x-onetrust: spec-label: https://developer.onetrust.com/onetrust/openapi/tech-risk-compliance-enterprise-policy-management.json parameters: - name: complianceType in: path description: The type of compliance document. required: true schema: type: string enum: - policies - standards - procedures - privacynotices example: policies requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/PolicyCreationApiRequest' example: defaultLanguageCode: it orgGroup: id: c1f58408-f575-403b-bc80-f707f9091264 name: Gilbert Hughes & Company name: Policy Name description: Policy Description effectiveDate: '2024-12-15' expirationDate: '2024-12-30' owners: - id: 27ad529a-afcc-4f22-a7ff-fafa6526edfb name: Owner Name email: owner@domain.com approvers: - id: 27ad529a-afcc-4f22-a7ff-fafa6526edfb name: Approver Name email: approver@domain.com responses: '201': description: Created content: '*/*': schema: type: string format: uuid '400': description: Bad Request '401': description: Unauthorized '403': description: Forbidden '429': description: "Too Many Requests. \nFor more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview)." headers: Retry-After: schema: description: The number of seconds after which requests will be allowed again. format: int32 ot-period: schema: description: The unit of time for which the rate limit applies enum: - HOUR - MINUTE ot-ratelimit-event-id: schema: description: The unique identifier for the rate-limiting event. format: uuid ot-request-made: schema: description: The number of requests made within the specified period. format: int32 ot-requests-allowed: schema: description: The number of requests allowed within the specified period. format: int32 '500': description: Internal Server Error security: - OAUTH2: - POLICY /v1/{complianceType}/list: get: operationId: getLatestPolicies summary: Get List of Documents description: Use this API to retrieve a list of policies, standards, procedures, or privacy notices by the specified compliance document type. tags: - Documents x-onetrust: spec-label: https://developer.onetrust.com/onetrust/openapi/tech-risk-compliance-enterprise-policy-management.json parameters: - name: page in: query description: The page number of the results. schema: type: integer default: 0 - name: size in: query description: The number of results per page. schema: type: integer default: 10 maximum: 2000 minimum: 1 - name: sort in: query description: The sort criteria that dictates the order of the results. schema: type: string default: createdDate,desc - name: complianceType in: path description: The type of compliance document. required: true schema: type: string enum: - policies - standards - procedures - privacynotices example: policies responses: '200': description: OK content: application/json: schema: type: array items: $ref: '#/components/schemas/PolicyListApiResponse' '400': description: Bad Request '401': description: Unauthorized '403': description: Forbidden '429': description: "Too Many Requests. \nFor more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview)." headers: Retry-After: schema: description: The number of seconds after which requests will be allowed again. format: int32 ot-period: schema: description: The unit of time for which the rate limit applies enum: - HOUR - MINUTE ot-ratelimit-event-id: schema: description: The unique identifier for the rate-limiting event. format: uuid ot-request-made: schema: description: The number of requests made within the specified period. format: int32 ot-requests-allowed: schema: description: The number of requests allowed within the specified period. format: int32 '500': description: Internal Server Error security: - OAUTH2: - POLICY - POLICY_READ /v1/{complianceType}/{id}/details: get: operationId: getPolicy summary: Get Document description: Use this API to retrieve details for the specified policy, standard, procedure, or privacy notice. tags: - Documents x-onetrust: spec-label: https://developer.onetrust.com/onetrust/openapi/tech-risk-compliance-enterprise-policy-management.json parameters: - name: complianceType in: path description: The type of compliance document. required: true schema: type: string enum: - policies - standards - procedures - privacynotices example: policies - name: id in: path description: The unique identifier of the policy, standard, procedure, or privacy notice. This value is obtained using the [Get List of Documents API](/onetrust/reference/getlatestpolicies). required: true schema: type: string format: uuid example: 6756206c-845c-4ecc-8826-0e25d12b0d0c responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/PolicyApiResponse' '400': description: Bad Request '401': description: Unauthorized '403': description: Forbidden '429': description: "Too Many Requests. \nFor more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview)." headers: Retry-After: schema: description: The number of seconds after which requests will be allowed again. format: int32 ot-period: schema: description: The unit of time for which the rate limit applies enum: - HOUR - MINUTE ot-ratelimit-event-id: schema: description: The unique identifier for the rate-limiting event. format: uuid ot-request-made: schema: description: The number of requests made within the specified period. format: int32 ot-requests-allowed: schema: description: The number of requests allowed within the specified period. format: int32 '500': description: Internal Server Error security: - OAUTH2: - POLICY - POLICY_READ /v1/{complianceType}/{id}/published-version: get: operationId: getPublishedPolicyVersion summary: Get Document Version description: Use this API to retrieve the last published version of a policy, standard, procedure, or privacy notice by the specified date. tags: - Documents x-onetrust: spec-label: https://developer.onetrust.com/onetrust/openapi/tech-risk-compliance-enterprise-policy-management.json parameters: - name: complianceType in: path description: The type of compliance document. required: true schema: type: string enum: - policies - standards - procedures - privacynotices example: policies - name: id in: path description: The unique identifier of the policy, standard, procedure, or privacy notice. This value is obtained using the [Get List of Documents API](/onetrust/reference/getlatestpolicies). required: true schema: type: string format: uuid example: 41955b71-e581-4187-ab6c-d00d1403350c - name: date in: query description: The date and time on which the policy, standard, procedure, or privacy notice was published. required: true schema: type: string pattern: ^\d{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])(T([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]))?$ example: '2024-12-13T23:59:59' responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/PolicyApiResponse' '400': description: Bad Request '401': description: Unauthorized '403': description: Forbidden '429': description: "Too Many Requests. \nFor more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview)." headers: Retry-After: schema: description: The number of seconds after which requests will be allowed again. format: int32 ot-period: schema: description: The unit of time for which the rate limit applies enum: - HOUR - MINUTE ot-ratelimit-event-id: schema: description: The unique identifier for the rate-limiting event. format: uuid ot-request-made: schema: description: The number of requests made within the specified period. format: int32 ot-requests-allowed: schema: description: The number of requests allowed within the specified period. format: int32 '500': description: Internal Server Error security: - OAUTH2: - POLICY - POLICY_READ /v1/{complianceType}/{policyId}/versions/create: post: operationId: createPolicyVersions summary: Create Document Version description: Use this API to create a new version of a policy, standard, or procedure. tags: - Documents x-onetrust: spec-label: https://developer.onetrust.com/onetrust/openapi/tech-risk-compliance-enterprise-policy-management.json parameters: - name: complianceType in: path description: The type of compliance document. required: true schema: type: string enum: - policies - standards - procedures example: policies - name: policyId in: path description: The unique identifier of the policy, standard, or procedure. This value is obtained using the [Get List of Documents API](/onetrust/reference/getlatestpolicies). required: true schema: type: string format: uuid example: 2039a744-6bd4-47a7-af11-1b4ad49c0c04 requestBody: required: true content: application/json: schema: type: array items: $ref: '#/components/schemas/PolicyVersionCreateApiRequest' example: "[\n {\n \"policyContentType\": \"PDF\",\n \"attachmentId\": \"bfdb6840-6e0a-4a3d-9385-a611dbbadca3\",\n \"publishVersionType\" : \"Minor\",\n \"versionSequence\" : 3,\n \"status\" : \"DRAFT\",\n \"descriptionOfChanges\" : null\n },\n {\n \"policyContentType\": \"PDF\",\n \"attachmentId\": \"bfdb6840-6e0a-4a3d-9385-a611dbbadca3\",\n \"publishVersionType\" : \"Major\",\n \"versionSequence\" : 2,\n \"status\" : \"PUBLISHED\",\n \"descriptionOfChanges\" : \"description version 2\"\n },\n {\n \"policyContentType\": \"PDF\",\n \"attachmentId\": \"bfdb6840-6e0a-4a3d-9385-a611dbbadca3\",\n \"versionSequence\" : 1,\n \"status\" : \"ARCHIVED\",\n }\n]" responses: '201': description: Created '400': description: Bad Request '401': description: Unauthorized '403': description: Forbidden '429': description: "Too Many Requests. \nFor more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview)." headers: Retry-After: schema: description: The number of seconds after which requests will be allowed again. format: int32 ot-period: schema: description: The unit of time for which the rate limit applies enum: - HOUR - MINUTE ot-ratelimit-event-id: schema: description: The unique identifier for the rate-limiting event. format: uuid ot-request-made: schema: description: The number of requests made within the specified period. format: int32 ot-requests-allowed: schema: description: The number of requests allowed within the specified period. format: int32 '500': description: Internal Server Error security: - OAUTH2: - POLICY components: schemas: ApproverResponse: type: object properties: id: description: The unique identifier of a policy, standard, procedure, or privacy notice approver. type: string format: uuid name: description: The name of a policy, standard, procedure, or privacy notice approver. type: string email: description: The email address of a policy, standard, procedure, or privacy notice approver. type: string format: email PolicyCreationApiRequest: type: object properties: orgGroup: description: The details of the organization responsible for the policy, standard, procedure, or privacy notice. $ref: '#/components/schemas/OrgGroupAssignmentRequest' name: description: The name of the policy, standard, procedure, or privacy notice. type: string maxLength: 200 minLength: 1 description: description: The description of the policy, standard, procedure, or privacy notice. type: string maxLength: 2000 minLength: 0 effectiveDate: description: The date on which the policy, standard, procedure, or privacy notice takes effect. type: string format: date example: '2024-12-13' expirationDate: description: The date on which the policy, standard, procedure, or privacy notice expires. type: string format: date example: '2024-12-31' approvers: description: The details of the user(s) responsible for approving all drafts and changes made to the policy, standard, procedure, or privacy notice. type: array items: $ref: '#/components/schemas/ApproverAssignmentRequest' owners: description: The details of the user(s) responsible for creating and updating the policy, standard, procedure, or privacy notice. type: array items: $ref: '#/components/schemas/OwnerAssignmentRequest' defaultLanguageCode: description: The default language of the policy, standard, procedure, or privacy notice. type: string pattern: ^[a-z]{2}(-[a-z]{2})?$ required: - approvers - defaultLanguageCode - name - orgGroup - owners ApproverAssignmentRequest: type: object properties: id: description: The unique identifier of the policy, standard, procedure, or privacy notice approver. This value is obtained using the [Get List of Users API](/onetrust/reference/getusers). type: string format: uuid required: - id PolicyVersionCreateApiRequest: type: object properties: policyContentType: description: The method used to build the policy, standard, or procedure. type: string enum: - PDF - MS_WOPI attachmentId: description: The unique identifier of the file attached to the policy, standard, or procedure. This value is obtained using the [Upload File API](/onetrust/reference/fileupload). type: string format: uuid publishVersionType: description: The version type of the policy, standard, or procedure. type: string enum: - Major - Minor versionSequence: description: The version number of the policy, standard, or procedure. The number should be incremented to the next major or minor version based on the `publishVersionType` parameter. type: integer format: int32 status: description: The publish status for the version of the policy, standard, or procedure. type: string enum: - DRAFT - PUBLISHED - ARCHIVED descriptionOfChanges: description: The description of changes made to the policy, standard, or procedure for the version. type: string maxLength: 10000 minLength: 0 required: - policyContentType - status - versionSequence OrgGroupAssignmentRequest: type: object properties: id: description: The unique identifier of the organization responsible for the policy, standard, procedure, or privacy notice.. This value is obtained using the [Get List of Organizations API](/onetrust/reference/organizationtreestructureusingget). type: string format: uuid name: description: The name of the organization responsible for the policy, standard, procedure, or privacy notice. type: string minLength: 1 required: - id - name PolicyVersionSectionResponse: type: object properties: name: description: The name of a section within a policy, standard, procedure, or privacy notice. type: string description: description: The description of a section within a policy, standard, procedure, or privacy notice. type: string content: description: The content of a section within a policy, standard, procedure, or privacy notice. type: string sectionType: description: The type of section within a policy, standard, procedure, or privacy notice. type: string enum: - PLAIN - TEMPLATE order: description: The numerical order in which a section appears within a policy, standard, procedure, or privacy notice. type: integer format: int32 PolicyApiResponse: type: object properties: guid: description: The unique identifier of the policy, standard, procedure, or privacy notice. type: string format: uuid name: description: The name of the policy, standard, procedure, or privacy notice. type: string description: description: The description of the policy, standard, procedure, or privacy notice. type: string orgGroup: description: The details of the organization responsible for the policy, standard, procedure, or privacy notice. $ref: '#/components/schemas/OrgGroupResponse' owners: description: The details of the user(s) responsible for creating and updating the policy, standard, procedure, or privacy notice. type: array items: $ref: '#/components/schemas/OwnerResponse' approvers: description: The details of the user(s) responsible for approving all drafts and changes made to the policy, standard, procedure, or privacy notice. type: array items: $ref: '#/components/schemas/ApproverResponse' effectiveDate: description: The date on which the policy, standard, procedure, or privacy notice takes effect. type: string format: date example: '2024-12-13' expirationDate: description: The date on which the policy, standard, procedure, or privacy notice expires. type: string format: date example: '2024-12-31' id: description: The unique identifier of the policy, standard, procedure, or privacy notice. type: integer format: int64 defaultLanguageCode: description: 'The default language of the policy, standard, procedure, or privacy notice. For more information, see [Supported Languages and HTML Language Codes.](https://developer.onetrust.com/onetrust/reference/supported-languages-and-html-language-codes-1)' type: string pattern: ^[a-z]{2}(-[a-z]{2})?$ versions: description: The details of the versions of the policy, standard, procedure, or privacy notice. type: array items: $ref: '#/components/schemas/PolicyVersionApiResponse' OwnerAssignmentRequest: type: object properties: id: description: The unique identifier of the policy, standard, procedure, or privacy notice owner. This value is obtained using the [Get List of Users API](/onetrust/reference/getusers). type: string format: uuid required: - id PolicyVersionApiResponse: type: object properties: id: description: The unique identifier for a specific version of a policy, standard, procedure, or privacy notice. type: string format: uuid attachmentId: description: The unique identifier of a file attached to a policy, standard, procedure, or privacy notice. type: string format: uuid descriptionOfChanges: description: The description of changes made to a policy, standard, procedure, or privacy notice for a version. type: string maxLength: 10000 minLength: 0 publishedDate: description: The date and time on which a version of a policy, standard, procedure, or privacy notice was published. type: string format: date-time createdDate: description: The date and time on which a version of a policy, standard, procedure, or privacy notice was created. type: string format: date-time versionStatus: description: The status of a policy, standard, procedure, or privacy notice version. type: string enum: - DRAFT - PUBLISHED - ARCHIVED policyContentType: description: The method used to build a policy, standard, procedure, or privacy notice. type: string enum: - ONETRUST - MS_WOPI - PDF sections: description: The sections of a policy, standard, procedure, or privacy notice. type: array items: $ref: '#/components/schemas/PolicyVersionSectionResponse' majorVersion: description: The number of major versions created for a policy, standard, procedure, or privacy notice. type: integer format: int64 minorVersion: description: The number of minor versions created for a policy, standard, procedure, or privacy notice. type: integer format: int64 PolicyListApiResponse: type: object properties: guid: description: The unique identifier of the policy, standard, procedure, or privacy notice. type: string format: uuid organizationName: description: The name of the organization responsible for the policy, standard, procedure, or privacy notice. type: string name: description: The name of the policy, standard, procedure, or privacy notice. type: string description: description: The description of the policy, standard, procedure, or privacy notice. type: string owners: description: The details of the user(s) responsible for creating and updating the policy, standard, procedure, or privacy notice. type: array items: $ref: '#/components/schemas/OwnerResponse' approvers: description: The details of the user(s) responsible for approving all drafts and changes made to the policy, standard, procedure, or privacy notice. type: array items: $ref: '#/components/schemas/ApproverResponse' effectiveDate: description: The date on which the policy, standard, procedure, or privacy notice takes effect. type: string format: date example: '2024-12-13' expirationDate: description: The date on which the policy, standard, procedure, or privacy notice expires. type: string format: date example: '2024-12-31' id: description: The unique identifier of the policy, standard, procedure, or privacy notice. type: integer format: int64 defaultLanguageCode: description: 'The default language of the policy, standard, procedure, or privacy notice. For more information, see [Supported Languages and HTML Language Codes.](https://developer.onetrust.com/onetrust/reference/supported-languages-and-html-language-codes-1)' type: string pattern: ^[a-z]{2}(-[a-z]{2})?$ createdDate: description: The date and time on which the policy, standard, procedure, or privacy notice was created. type: string format: date-time organizationId: description: The unique identifier of the organization responsible for the policy, standard, procedure, or privacy notice. type: string format: uuid OrgGroupResponse: type: object properties: id: description: The unique identifier of the organization responsible for the policy, standard, procedure, or privacy notice. type: string format: uuid name: description: The name of the organization responsible for the policy, standard, procedure, or privacy notice. type: string OwnerResponse: type: object properties: id: description: The unique identifier of a policy, standard, procedure, or privacy notice owner. type: string format: uuid name: description: The name of a policy, standard, procedure, or privacy notice owner. type: string email: description: The email address of a policy, standard, procedure, or privacy notice owner. type: string format: email securitySchemes: OAUTH2: type: oauth2 flows: clientCredentials: tokenUrl: https://{hostname}/api/access/v1/oauth/token scopes: POLICY: Policy scope for external systems. POLICY_READ: Policy read scope for external systems. x-onetrust: spec-label: OpenAPI 3.1.0 links: - '[{''Policy Management Knowledge Base'': ''https://my.onetrust.com/s/topic/0TO1Q000000bHfCWAU/policy-management''}]' x-readme: explorer-enabled: false proxy-enabled: false metrics-enabled: false