🎉 OneTrust 202610.1.0 Released!

We are excited to announce the following enhancements in the OneTrust Developer Portal as part of OneTrust 202610.1.0.

Assessment Automation

General Availability

• New Assessment Automation APIs
  Added the following APIs to support assessment navigation, workflow actions, child question response submission, unanswered question retrieval, attachment management, assigned assessment retrieval, linked assessment retrieval, and assessment search capabilities:

  • Get Assessment Question Section API
  • Perform Assessment Workflow Action API
  • Submit Child Question Responses API
  • Get Next Assessment Question API
  • Manage Assessment Question Attachments API
  • Get List of Assigned Assessments API
  • Get List of Linked Assessments by Entity ID API
  • Search Assessments API

• Enhancements to Assessment Automation APIs
  Updated the Assessment Automation APIs with the following enhancements:

  • Updated the Get Assessment API to support the include query parameter. This enhancement enables retrieval of additional assessment datasets, including information requests, notes, and stage history.

  • Updated the Get Assessment API and Get Assessment Record API to return additional assessment insights and review information, including information request metrics and records, flagged question counts and identifiers, and the questionResponseReviewStatus response object for AI and human review statuses.

  • Updated the Launch Assessment API to support the oneAgent query parameter for OneAgent-specific assessment launch scenarios.

  • Updated the Set Primary Record API to support the following custom entity types: MODELS, AISYSTEMS, AIAGENTS, DATASETS, PROJECTS.

Data Subject Rights (DSR) Automation

Fixed

• Resolved an issue with the format of the dropId parameter in the DROP Management APIs. The dropId parameter is now correctly documented as an alphanumeric string of up to 12 characters instead of an integer.
• Resolved an issue with the list of enums for the SubtaskStatus request parameter in the Get List of Subtasks by Criteria API. The Deleted enum value was removed to correctly reflect supported subtask statuses.

Existing Public Preview Features

• New DROP Management APIs
  Added the Create Data Subject Request for DROP Record API, Update DROP Record API, and Get List of DROP Records API to create, update, and retrieve Delete Request and Opt-out Platform (DROP) requests, respectively. These APIs support California-registered data brokers in managing DROP requests for deleting or opting out data subjects permanently.

Mobile App Consent

Existing Public Preview Features

• Consent Management Platform APIs
  The following APIs are available for retrieving the interface attributes needed to display the banner and preference center, retrieving active IAB and Google vendor information, logging consent interactions, and submitting global opt-out data subject access requests. These APIs enable developers to retrieve the data required for banner and preference center experiences, disclose vendor information to end users, capture consent preferences, and support Global Opt-Out workflows across devices and services.
  • Get Banner Data API
  • Get Preference Center Data API
  • Get IAB and Google Vendors API
  • Log Consent API
  • Get Universal Consent Purposes API
  • Submit Global Opt-Out Request API

Settings & Administration

General Availability

• Enhancements to Access Management APIs
  Updated the Access Management APIs to support granular OAuth scopes for organization, user group, and user management operations. These enhancements enable more precise access control by allowing integrations to request only the permissions required for specific read, write, and delete operations.

  • Added the ORGANIZATION_READ, ORGANIZATION_WRITE, and ORGANIZATION_DELETE OAuth scopes for the Organizations APIs.
  • Added the USER_GROUP_READ, USER_GROUP_WRITE, and USER_GROUP_DELETE OAuth scopes for the User Groups and User Groups V2 APIs.
  • Added the USER_READ, USER_WRITE, and USER_DELETE OAuth scopes for the Users V2 APIs.

• Enhancement to Documents APIs
  Updated the Upload File API to support the ATTACHMENT_WRITE OAuth scope in addition to the existing ATTACHMENT scope. This enhancement provides a more granular permission option for attachment upload operations.

Fixed

• Resolved API documentation issues to correct schema definitions, field requirements, response codes, and OAuth scope requirements across various SCIM APIs to align with actual SCIM API behavior.

Universal Consent & Preference Management

General Availability

• Enhancements to Bulk Export APIs
  Updated the Create Bulk Export API with the following enhancements:

  • Added support for the DATA_ELEMENT_BULK_ACTIONS export type to enable bulk management of data element values. This enhancement allows organizations to delete data elements from matching data subjects, delete data elements from all associated data subjects, and rename or remove multi-select option values through a bulk export workflow.

  • Added support for the REMOVE_PURPOSE action in the DATA_SUBJECTS_BULK_ACTIONS export type. This enhancement enables organizations to remove purposes from data subjects through bulk export operations.

Fixed

• Resolved an issue where the Get Data Subject Details V4 API returned outdated custom preference option names after an option was renamed.

Things to Know

• Updated the Get Data Subject's Preferences V2 API to return the ETag and Last-Modified response headers. These headers enable applications to determine whether preference data has changed since it was last retrieved, supporting more efficient caching and synchronization workflows.