Corgi BankDocumentation
OpenAPI

Propose an effective privacy policy, exact reviewed notice content and purpose/recipient sharing rules

POST/privacy/policies

Privacy staff write scope and authentication within five minutes required. Exact reviewed document SHA-256, disclosure-practices fingerprint, evidence references, future/effective date, configured opt-out period/methods and recipient/service/purpose/field grants are mandatory. No production legal copy is supplied. The next policy version is independently approved. Ordinary nonaffiliate grants require a revised-notice transition when changed; service_provider grants additionally require a reviewed use-restricting contract. Practices unchanged from a delivered notice plus exception-only disclosures are the only annual exception. No universal opt-out requirement is imposed on servicing, fraud prevention or legal-process exceptions.

Headers

Idempotency-KeystringRequired

Send on every write that creates or changes money or state; a replay with the same key returns the original result with 200.

Body parameters

change_kindstringRequired

Initial, revised_notice, annual_100_day, no_disclosure_change

contentstringRequired
content_refstringRequired
content_sha256stringRequired
disclosure_practices_sha256stringRequired
effective_atstring · date-timeRequired
expected_versionintegerRequired
opt_out_methodsarray of stringsRequired
opt_out_opportunity_daysintegerRequired
reasonstringRequired
review_refstringRequired
rulesarray of objectsRequired
12 child attributes
authority_refstringRequired
authority_sha256stringRequired
basisstringRequired

Nonaffiliate, service_provider, servicing, fraud_prevention, legal_process

contract_refstringOptional
contract_sha256stringOptional
data_kindsarray of stringsOptional
fieldsarray of stringsRequired
honor_opt_outbooleanRequired

A more restrictive bank/state policy may honor opt-outs under exceptions

idstringRequired
purposestringRequired
recipient_idstringRequired
service_subjectstringRequired

Returns

200 OK

decided_atstring · date-time or nullOptional
decided_bystringOptional
idstringRequired
practices_sha256stringRequired
proposed_atstring · date-timeRequired
proposed_bystringRequired
requestobjectRequired
12 child attributes
change_kindstringRequired

Initial, revised_notice, annual_100_day, no_disclosure_change

contentstringRequired
content_refstringRequired
content_sha256stringRequired
disclosure_practices_sha256stringRequired
effective_atstring · date-timeRequired
expected_versionintegerRequired
opt_out_methodsarray of stringsRequired
opt_out_opportunity_daysintegerRequired
reasonstringRequired
review_refstringRequired
rulesarray of objectsRequired
12 child attributes
authority_refstringRequired
authority_sha256stringRequired
basisstringRequired

Nonaffiliate, service_provider, servicing, fraud_prevention, legal_process

contract_refstringOptional
contract_sha256stringOptional
data_kindsarray of stringsOptional
fieldsarray of stringsRequired
honor_opt_outbooleanRequired

A more restrictive bank/state policy may honor opt-outs under exceptions

idstringRequired
purposestringRequired
recipient_idstringRequired
service_subjectstringRequired
statusstringRequired
versionintegerRequired

Errors

Every error is a problem document with a stable code. See Errors.

400401403404409412413422424429500503

to move to open esc to close