Propose an effective privacy policy, exact reviewed notice content and purpose/recipient sharing rules
/privacy/policiesPrivacy staff write scope and authentication within five minutes required. Exact reviewed document SHA-256, disclosure-practices fingerprint, evidence references, future/effective date, configured opt-out period/methods and recipient/service/purpose/field grants are mandatory. No production legal copy is supplied. The next policy version is independently approved. Ordinary nonaffiliate grants require a revised-notice transition when changed; service_provider grants additionally require a reviewed use-restricting contract. Practices unchanged from a delivered notice plus exception-only disclosures are the only annual exception. No universal opt-out requirement is imposed on servicing, fraud prevention or legal-process exceptions.
Headers
Idempotency-KeystringRequiredSend on every write that creates or changes money or state; a replay with the same key returns the original result with 200.
Body parameters
change_kindstringRequiredInitial, revised_notice, annual_100_day, no_disclosure_change
contentstringRequiredcontent_refstringRequiredcontent_sha256stringRequireddisclosure_practices_sha256stringRequiredeffective_atstring · date-timeRequiredexpected_versionintegerRequiredopt_out_methodsarray of stringsRequiredopt_out_opportunity_daysintegerRequiredreasonstringRequiredreview_refstringRequiredrulesarray of objectsRequired12 child attributes
authority_refstringRequiredauthority_sha256stringRequiredbasisstringRequiredNonaffiliate, service_provider, servicing, fraud_prevention, legal_process
contract_refstringOptionalcontract_sha256stringOptionaldata_kindsarray of stringsOptionalfieldsarray of stringsRequiredhonor_opt_outbooleanRequiredA more restrictive bank/state policy may honor opt-outs under exceptions
idstringRequiredpurposestringRequiredrecipient_idstringRequiredservice_subjectstringRequiredReturns
200 OK
decided_atstring · date-time or nullOptionaldecided_bystringOptionalidstringRequiredpractices_sha256stringRequiredproposed_atstring · date-timeRequiredproposed_bystringRequiredrequestobjectRequired12 child attributes
change_kindstringRequiredInitial, revised_notice, annual_100_day, no_disclosure_change
contentstringRequiredcontent_refstringRequiredcontent_sha256stringRequireddisclosure_practices_sha256stringRequiredeffective_atstring · date-timeRequiredexpected_versionintegerRequiredopt_out_methodsarray of stringsRequiredopt_out_opportunity_daysintegerRequiredreasonstringRequiredreview_refstringRequiredrulesarray of objectsRequired12 child attributes
authority_refstringRequiredauthority_sha256stringRequiredbasisstringRequiredNonaffiliate, service_provider, servicing, fraud_prevention, legal_process
contract_refstringOptionalcontract_sha256stringOptionaldata_kindsarray of stringsOptionalfieldsarray of stringsRequiredhonor_opt_outbooleanRequiredA more restrictive bank/state policy may honor opt-outs under exceptions
idstringRequiredpurposestringRequiredrecipient_idstringRequiredservice_subjectstringRequiredstatusstringRequiredversionintegerRequiredErrors
Every error is a problem document with a stable code. See Errors.
400401403404409412413422424429500503