> ## Documentation Index
> Fetch the complete documentation index at: https://docs.responsibleailabs.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# DPDP: Session

> Create or retrieve DPDP compliance sessions. Track consent state, child flags, events, fulfilled obligations, and active timers across a user journey.

<Info>
  **Overview:** [India DPDP](/api-reference/dpdp-overview) | **Concept:** [India DPDP guide](/concepts/india-dpdp) | **SDK:** [Python DPDP](/sdk/python/dpdp) | **Credits:** 0 (free)
</Info>

Creates or retrieves a compliance session. Sessions track state across multiple API calls for a single user journey: consent state, child flags, events emitted, obligations fulfilled, and active timers.

```mermaid theme={null}
flowchart LR
    Create["action: create<br/>(purpose required)"] --> Sess(["session_id"])
    Sess --> Emit["/emit events<br/>mutate state + start timers"]
    Emit --> State["state: consent_status,<br/>child_session, events_count,<br/>open_timers, obligations"]
    State --> Get["action: get<br/>read current state"]
```

## Parameters

<ParamField body="action" type="string" required>
  `"create"` to start a new session or `"get"` to retrieve an existing one.
</ParamField>

<ParamField body="session_id" type="string">
  Required for `"get"`. The session ID to retrieve.
</ParamField>

<ParamField body="config.entity_type" type="string" default="data_fiduciary">
  `"data_fiduciary"` or `"significant_data_fiduciary"`. SDFs have additional obligations under the DPDP Act (DPIA, DPO appointment, annual reporting).
</ParamField>

<ParamField body="config.purpose" type="string">
  Required for `"create"`. Primary processing purpose (e.g., `"loan_advisory"`, `"healthcare"`).
</ParamField>

<ParamField body="config.sector" type="string">
  Industry sector (e.g., `"fintech"`, `"healthcare"`, `"ecommerce"`). Influences sector-specific guidance.
</ParamField>

<ParamField body="config.processes_children" type="boolean" default="false">
  Whether children's data may be processed. Enables S.9 checks from session start.
</ParamField>

<ParamField body="config.ttl_hours" type="integer" default="24">
  Session time-to-live in hours. Minimum 1.
</ParamField>

## Request: create

```bash theme={null}
curl -X POST https://api.responsibleailabs.ai/railscore/v1/compliance/dpdp/session \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_RAIL_API_KEY" \
  -d '{
    "action": "create",
    "config": {
      "entity_type": "data_fiduciary",
      "purpose": "loan_advisory",
      "sector": "fintech",
      "processes_children": true,
      "ttl_hours": 24
    }
  }'
```

## Request: get

```bash theme={null}
curl -X POST https://api.responsibleailabs.ai/railscore/v1/compliance/dpdp/session \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_RAIL_API_KEY" \
  -d '{
    "action": "get",
    "session_id": "sess_abc123def456"
  }'
```

## Response

```json theme={null}
{
  "result": {
    "session_id": "sess_abc123def456",
    "created_at": "2026-05-14T08:00:00+00:00",
    "config": {
      "entity_type": "data_fiduciary",
      "purpose": "loan_advisory",
      "sector": "fintech",
      "processes_children": true
    },
    "state": {
      "consent_status": {},
      "notice_shown": false,
      "child_session": false,
      "events_count": 0,
      "open_timers": [],
      "fulfilled_obligations": [],
      "pending_obligations": []
    }
  },
  "credits_consumed": 0
}
```

<ResponseField name="result.session_id" type="string">
  Unique session identifier (prefixed with `sess_`). Use this in subsequent `/scan`, `/evaluate`, `/emit`, and `/require` calls.
</ResponseField>

<ResponseField name="result.config" type="object">
  Session configuration as provided at creation.
</ResponseField>

<ResponseField name="result.state" type="object">
  Current compliance state. Updated automatically by events emitted via [`/emit`](/api-reference/dpdp-emit).
</ResponseField>

<ResponseField name="result.state.consent_status" type="object">
  Per-purpose consent state. Keys are purpose names, values are `"active"`, `"withdrawn"`, or `"refused"`.
</ResponseField>

<ResponseField name="result.state.fulfilled_obligations" type="string[]">
  Obligations completed in this session (e.g., `"notice_shown"`, `"consent_obtained"`, `"parental_consent_obtained"`).
</ResponseField>

<ResponseField name="result.state.open_timers" type="string[]">
  Active timer IDs associated with this session.
</ResponseField>