> ## Documentation Index
> Fetch the complete documentation index at: https://docs.responsibleailabs.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# India DPDP: Overview

> The complete India DPDP Act 2023 compliance suite: seven endpoints for PII scanning, decision gating, event logging, regulatory timers, and audit evidence — with the full integration flow.

<Info>
  **Concept:** [India DPDP guide](/concepts/india-dpdp) | **SDK:** [Python DPDP](/sdk/python/dpdp) | **Frameworks:** [Compliance overview](/api-reference/compliance-overview)
</Info>

The India DPDP suite operationalizes the **Digital Personal Data Protection Act, 2023** for AI systems. Where a one-shot compliance check answers "is this text compliant right now?", the DPDP suite covers the full lifecycle of a data principal's journey: detect Indian personal data, gate decisions against the Act's obligations, record the events that prove compliance, track statutory deadlines, and produce audit-grade evidence on demand.

All seven endpoints sit under one base path and return the same envelope, so you can adopt them incrementally — start with `scan`, add `session` and `emit` when you need stateful tracking, and reach for `evidence` at audit time.

```
https://api.responsibleailabs.ai/railscore/v1/compliance/dpdp
```

## Two ways to run DPDP

RAIL ships the same DPDP capability on two paths with opposite data-flow guarantees. This page documents the **hosted** API.

<CardGroup cols={2}>
  <Card title="Hosted (this API)" icon="cloud">
    Your application sends content to `api.responsibleailabs.ai`. Multi-tenant, org-scoped, billed per call. Everything on this page runs here.
  </Card>

  <Card title="Enterprise self-hosted" icon="server">
    The RAIL agent runs inside your own VPC or air-gapped environment; content never leaves your infrastructure. The same seven endpoints are mirrored there for single-tenant, licensed deployments.
  </Card>
</CardGroup>

## The seven endpoints

| Endpoint                                    | Method | Credits | What it does                                                                                                                                            |
| ------------------------------------------- | ------ | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [`/scan`](/api-reference/dpdp-scan)         | POST   | 0.5     | Detect Indian PII (Aadhaar with Verhoeff checksum, PAN, UPI, mobile, and 6 more), child signals (S.9), and purpose drift (S.4). Detect, mask, or block. |
| [`/evaluate`](/api-reference/dpdp-evaluate) | POST   | 0.3     | Deterministic `allow` / `block` / `require_action` gate for an action, mapped to DPDP S.4–S.16.                                                         |
| [`/emit`](/api-reference/dpdp-emit)         | POST   | 0.1     | Record 1–50 compliance events (consent, notice, DSR, breach). Auto-starts regulatory timers.                                                            |
| [`/require`](/api-reference/dpdp-require)   | POST   | 0.3     | List the required actions for a given workflow step.                                                                                                    |
| [`/evidence`](/api-reference/dpdp-evidence) | POST   | 2.0     | Generate an audit-grade evidence packet (DSR response, breach notification, consent audit, SDF annual report). Pro+ plans.                              |
| [`/session`](/api-reference/dpdp-session)   | POST   | 0       | Create or retrieve a stateful compliance session for one data-principal journey.                                                                        |
| [`/timers`](/api-reference/dpdp-timers)     | GET    | 0       | List regulatory deadline timers, filtered by status, type, or how soon they are due.                                                                    |

<Tip>
  Billing on every DPDP route is **fire-and-forget by design** — a billing hiccup never blocks a compliance decision. Use [`/verify`](/api-reference/overview) for a pre-flight balance check when you need one. `session` and `timers` are always free.
</Tip>

## How the pieces fit together

A typical integration threads a single **session** through the user's journey. Events you `emit` mutate the session state and start the statutory timers; `scan` and `evaluate` make in-the-moment decisions; `evidence` reads the accumulated trail when an auditor or regulator asks.

```mermaid theme={null}
flowchart TD
    Start(["Data principal journey begins"]) --> Session["POST /session — create<br/>(purpose required)"]
    Session --> Notice["POST /emit — notice.shown"]
    Notice --> Consent["POST /emit — consent.granted"]
    Consent --> Scan["POST /scan — detect Indian PII<br/>+ child signals + purpose drift"]
    Scan --> Gate{"POST /evaluate<br/>allow / block / require_action?"}
    Gate -- "allow" --> Proceed["Process the data"]
    Gate -- "require_action" --> Require["POST /require — list obligations"]
    Gate -- "block" --> Stop["Halt and remediate"]
    Proceed --> DSR["POST /emit — dsr.received / breach.detected"]
    DSR --> Timers["GET /timers — track S.13 / breach deadlines"]
    Timers --> Evidence["POST /evidence — audit packet on demand"]
```

## Response envelope

Every endpoint returns the same two-key envelope. `result` holds the endpoint-specific payload; `credits_consumed` reports what the call cost.

```json theme={null}
{
  "result": { "...": "endpoint-specific" },
  "credits_consumed": 0.5
}
```

## Authentication

All routes require a Bearer token — an API key (`rail_...`) or a JWT. Pass it on every request:

```bash theme={null}
-H "Authorization: Bearer YOUR_RAIL_API_KEY"
```

## A complete walkthrough

The flow below tracks one loan-application journey end to end. It uses [curl](https://curl.se); the [Python SDK](/sdk/python/dpdp) mirrors every call as `client.dpdp.*`.

<Steps>
  <Step title="Open a session">
    A session ties events, scans, and timers to one data-principal journey. `config.purpose` is required.

    ```bash theme={null}
    curl -X POST https://api.responsibleailabs.ai/railscore/v1/compliance/dpdp/session \
      -H "Authorization: Bearer YOUR_RAIL_API_KEY" \
      -H "Content-Type: application/json" \
      -d '{
        "action": "create",
        "config": { "purpose": "loan_advisory", "entity_type": "data_fiduciary" }
      }'
    ```

    The response returns a `session_id` you reuse on later calls.
  </Step>

  <Step title="Record notice and consent">
    `emit` writes the events that later prove you met your notice (S.5) and consent (S.6) obligations.

    ```bash theme={null}
    curl -X POST https://api.responsibleailabs.ai/railscore/v1/compliance/dpdp/emit \
      -H "Authorization: Bearer YOUR_RAIL_API_KEY" \
      -H "Content-Type: application/json" \
      -d '{
        "session_id": "sess_1a2b3c",
        "events": [
          { "type": "notice.shown", "data": { "user_id": "u_42" } },
          { "type": "consent.granted", "data": { "user_id": "u_42", "purpose": "loan_advisory" } }
        ]
      }'
    ```
  </Step>

  <Step title="Scan content for Indian PII">
    Before storing or sending model output, scan it. `pii_action` can `detect`, `mask`, or `block`.

    ```bash theme={null}
    curl -X POST https://api.responsibleailabs.ai/railscore/v1/compliance/dpdp/scan \
      -H "Authorization: Bearer YOUR_RAIL_API_KEY" \
      -H "Content-Type: application/json" \
      -d '{
        "content": "Applicant PAN ABCDE1234F, mobile 9876543210.",
        "config": { "pii_action": "mask", "purpose": "loan_advisory" }
      }'
    ```
  </Step>

  <Step title="Gate the decision">
    `evaluate` returns a deterministic verdict for the action you are about to take.

    ```bash theme={null}
    curl -X POST https://api.responsibleailabs.ai/railscore/v1/compliance/dpdp/evaluate \
      -H "Authorization: Bearer YOUR_RAIL_API_KEY" \
      -H "Content-Type: application/json" \
      -d '{
        "action": "make_decision",
        "context": { "user_id": "u_42", "purpose": "loan_advisory" },
        "session_id": "sess_1a2b3c"
      }'
    ```

    A `verdict` of `require_action` tells you to call `/require` for the outstanding obligations.
  </Step>

  <Step title="Track deadlines and produce evidence">
    When a data principal exercises a right or a breach occurs, `emit` starts the statutory timer; `timers` lists what is approaching; `evidence` assembles the audit packet.

    ```bash theme={null}
    # A rights request starts the S.13 response clock
    curl -X POST https://api.responsibleailabs.ai/railscore/v1/compliance/dpdp/emit \
      -H "Authorization: Bearer YOUR_RAIL_API_KEY" \
      -H "Content-Type: application/json" \
      -d '{ "events": [ { "type": "dsr.received", "data": { "user_id": "u_42", "request_id": "r_9" } } ] }'

    # What is due in the next 30 days?
    curl "https://api.responsibleailabs.ai/railscore/v1/compliance/dpdp/timers?status=active&approaching_days=30" \
      -H "Authorization: Bearer YOUR_RAIL_API_KEY"
    ```
  </Step>
</Steps>

## Errors

DPDP routes use standard HTTP status codes. Validation problems return `400` with an `error` message; `evidence` on a plan below Pro returns `403` with `code: TIER_INSUFFICIENT`.

```json theme={null}
{ "error": "Evidence generation requires Pro+ tier.", "code": "TIER_INSUFFICIENT" }
```

<Warning>
  The DPDP suite never logs raw content or detected PII values — only a truncated, non-identifying snippet for analytics. Aadhaar, PAN, and other identifiers are masked or dropped before anything is written.
</Warning>

## Where to go next

<CardGroup cols={2}>
  <Card title="India DPDP guide" icon="book" href="/concepts/india-dpdp">
    The concepts behind the suite: obligations, lifecycle, and which endpoint maps to which section of the Act.
  </Card>

  <Card title="Python SDK: DPDP" icon="python" href="/sdk/python/dpdp">
    Every endpoint as a typed `client.dpdp.*` method, plus client-side PII scanning and the system audit.
  </Card>

  <Card title="Scan endpoint" icon="magnifying-glass-chart" href="/api-reference/dpdp-scan">
    Indian PII detection, child signals, and purpose drift in detail.
  </Card>

  <Card title="Evidence endpoint" icon="file-shield" href="/api-reference/dpdp-evidence">
    Audit-grade packets for DSR, breach, consent, and SDF reporting.
  </Card>
</CardGroup>