{ "info": { "_postman_id": "3f02a837-dd0f-4b31-9afe-f3a0c0b28a95", "name": "Datrus API", "description": "La API pública de Datrus, la plataforma de cumplimiento de la Ley 21.719. Autentícate con `Authorization: Bearer `. Los errores siguen el RFC 9457 (`application/problem+json`) y traen un `requestId`. Manda un `Idempotency-Key` en cada POST que cree algo. Las listas se paginan con `limit` y un `cursor` opaco. Las rutas, los campos y los códigos de error están en inglés a propósito: son el contrato que escribes en tu código.\n\nVersión 2026-09-13 · 284 operaciones. Generada por scripts/api/postman.mjs — no editar a mano.\n\nAntes de empezar: elige el ambiente (local o producción) y pega tu llave en la variable `key`. La carpeta «00 · Recorrido guiado» se puede correr entera con Run collection.", "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json" }, "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{key}}", "type": "string" } ] }, "item": [ { "name": "00 · Recorrido guiado", "description": "Diez pasos encadenados por variables de ambiente. Córrelos en orden con Run collection.", "item": [ { "name": "1 · Quién soy", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/me", "host": [ "{{base}}" ], "path": [ "api", "v1", "me" ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200 o 201', () => pm.expect([200, 201]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }", "const j = pm.response.json(); pm.environment.set('company', j.company.legalName)" ] } } ] }, { "name": "2 · Los catálogos", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/catalogs/purposes", "host": [ "{{base}}" ], "path": [ "api", "v1", "catalogs", "purposes" ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200 o 201', () => pm.expect([200, 201]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }", "const j = pm.response.json(); pm.environment.set('purpose', j.data[0].key)" ] } } ] }, { "name": "2b · Categorías de datos", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/catalogs/data-categories", "host": [ "{{base}}" ], "path": [ "api", "v1", "catalogs", "data-categories" ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200 o 201', () => pm.expect([200, 201]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }", "const j = pm.response.json(); pm.environment.set('dataCategory', j.data[0].key)" ] } } ] }, { "name": "2c · Sistemas", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/catalogs/systems", "host": [ "{{base}}" ], "path": [ "api", "v1", "catalogs", "systems" ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200 o 201', () => pm.expect([200, 201]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }", "const j = pm.response.json(); pm.environment.set('system', j.data[0].key)" ] } } ] }, { "name": "2d · Titulares", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/catalogs/subject-kinds", "host": [ "{{base}}" ], "path": [ "api", "v1", "catalogs", "subject-kinds" ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200 o 201', () => pm.expect([200, 201]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }", "const j = pm.response.json(); pm.environment.set('subjectKind', j.data[0].key)" ] } } ] }, { "name": "3 · Crear un tratamiento del RAT", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "{{$guid}}" } ], "url": { "raw": "{{base}}/api/v1/processing-activities", "host": [ "{{base}}" ], "path": [ "api", "v1", "processing-activities" ] }, "body": { "mode": "raw", "raw": "{\n \"name\": \"[Postman] Tratamiento de prueba\",\n \"area\": \"Pruebas\",\n \"purpose\": \"{{purpose}}\",\n \"dataCategories\": [\n \"{{dataCategory}}\"\n ],\n \"subjectKinds\": [\n \"{{subjectKind}}\"\n ],\n \"systems\": [\n \"{{system}}\"\n ],\n \"legalBasis\": \"consent\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 201', () => pm.expect([201]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }", "const j = pm.response.json(); pm.environment.set('pa', j.id)" ] } } ] }, { "name": "4 · Leerlo con su id prefijado", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/processing-activities/{{{pa}}}", "host": [ "{{base}}" ], "path": [ "api", "v1", "processing-activities", "{{{pa}}}" ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200 o 201', () => pm.expect([200, 201]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "5 · Crear un documento de privacidad", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "{{$guid}}" } ], "url": { "raw": "{{base}}/api/v1/documents", "host": [ "{{base}}" ], "path": [ "api", "v1", "documents" ] }, "body": { "mode": "raw", "raw": "{\n \"key\": \"postman_{{$timestamp}}\",\n \"name\": \"[Postman] Política\",\n \"kind\": \"privacy_policy\",\n \"title\": \"Política de privacidad\",\n \"text\": \"Texto de prueba desde Postman.\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 201', () => pm.expect([201]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }", "const j = pm.response.json(); pm.environment.set('doc', j.document.id)" ] } } ] }, { "name": "6 · Agregar una tarea al plan", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "{{$guid}}" } ], "url": { "raw": "{{base}}/api/v1/tasks", "host": [ "{{base}}" ], "path": [ "api", "v1", "tasks" ] }, "body": { "mode": "raw", "raw": "{\n \"phase\": 1,\n \"title\": \"[Postman] Revisar la prueba\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 201', () => pm.expect([201]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }", "const j = pm.response.json(); pm.environment.set('tsk', j.id)" ] } } ] }, { "name": "7 · La bitácora encadenada", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/audit-log?limit=10", "host": [ "{{base}}" ], "path": [ "api", "v1", "audit-log?limit=10" ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200 o 201', () => pm.expect([200, 201]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "8 · Verificar la cadena", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/audit-log/verify", "host": [ "{{base}}" ], "path": [ "api", "v1", "audit-log", "verify" ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200 o 201', () => pm.expect([200, 201]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "9 · Un id de otro recurso se nombra (400)", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/documents/{{{tsk}}}", "host": [ "{{base}}" ], "path": [ "api", "v1", "documents", "{{{tsk}}}" ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 400', () => pm.expect([400]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "10 · Un recurso que no existe (404)", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/documents/doc_ffffffffffffffffffffffffffffffff", "host": [ "{{base}}" ], "path": [ "api", "v1", "documents", "doc_ffffffffffffffffffffffffffffffff" ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 404', () => pm.expect([404]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] } ] }, { "name": "Ajustes", "description": "Los ajustes de cada módulo.", "item": [ { "name": "GET /settings — Todos los ajustes de una vez", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/settings", "host": [ "{{base}}" ], "path": [ "api", "v1", "settings" ], "query": [] }, "description": "Las cuatro áreas juntas, para no hacer cuatro llamadas al arrancar. Para escribir, usa el endpoint de cada área." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /settings/consent — Ajustes de Consentimiento", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/settings/consent", "host": [ "{{base}}" ], "path": [ "api", "v1", "settings", "consent" ], "query": [] }, "description": "Ajustes de Consentimiento" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "PATCH /settings/consent — Cambiar los ajustes de Consentimiento", "request": { "method": "PATCH", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/settings/consent", "host": [ "{{base}}" ], "path": [ "api", "v1", "settings", "consent" ], "query": [] }, "description": "Pasa por la misma validación que la consola: un texto obligatorio con el dato de una persona adentro se rechaza, porque esos textos se muestran en todas tus plantillas.", "body": { "mode": "raw", "raw": "{\n \"allowedDomains\": [\n \"app.acme.cl\",\n \"*.acme.cl\"\n ],\n \"contactEmail\": \"datos@acme.cl\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /settings/data-subject-requests — Ajustes de Derechos", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/settings/data-subject-requests", "host": [ "{{base}}" ], "path": [ "api", "v1", "settings", "data-subject-requests" ], "query": [] }, "description": "Ajustes de Derechos" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "PATCH /settings/data-subject-requests — Cambiar los ajustes de Derechos", "request": { "method": "PATCH", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/settings/data-subject-requests", "host": [ "{{base}}" ], "path": [ "api", "v1", "settings", "data-subject-requests" ], "query": [] }, "description": "No puedes dejar cero derechos habilitados: una empresa que no recibe ninguno no está cumpliendo el art. 10, está apagando el módulo.", "body": { "mode": "raw", "raw": "{}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /settings/privacy-center — Ajustes del centro de privacidad", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/settings/privacy-center", "host": [ "{{base}}" ], "path": [ "api", "v1", "settings", "privacy-center" ], "query": [] }, "description": "Ajustes del centro de privacidad" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "PATCH /settings/privacy-center — Encender o apagar el centro de privacidad", "request": { "method": "PATCH", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/settings/privacy-center", "host": [ "{{base}}" ], "path": [ "api", "v1", "settings", "privacy-center" ], "query": [] }, "description": "Encendido, cualquier persona puede pedir el enlace a su portal desde tu sitio. Apagarlo no borra nada de lo ya registrado.", "body": { "mode": "raw", "raw": "{\n \"enabled\": true\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /settings/brand — La marca de tus páginas públicas", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/settings/brand", "host": [ "{{base}}" ], "path": [ "api", "v1", "settings", "brand" ], "query": [] }, "description": "La marca de tus páginas públicas" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "PATCH /settings/brand — Cambiar la marca", "request": { "method": "PATCH", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/settings/brand", "host": [ "{{base}}" ], "path": [ "api", "v1", "settings", "brand" ], "query": [] }, "description": "El contraste no se negocia: si el texto sobre la superficie o el color principal no alcanzan la razón que exige la WCAG, la respuesta es 400 con el número que dio. El logo se sube desde la consola, no por API.", "body": { "mode": "raw", "raw": "{\n \"logoHeight\": 32,\n \"primaryColor\": \"#202123\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /settings/data-subject-requests/notifications — Avisos de Derechos por evento", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/settings/data-subject-requests/notifications", "host": [ "{{base}}" ], "path": [ "api", "v1", "settings", "data-subject-requests", "notifications" ], "query": [] }, "description": "Avisos de Derechos por evento" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "PUT /settings/data-subject-requests/notifications — Cambiar los avisos de Derechos por evento", "request": { "method": "PUT", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/settings/data-subject-requests/notifications", "host": [ "{{base}}" ], "path": [ "api", "v1", "settings", "data-subject-requests", "notifications" ], "query": [] }, "description": "Manda sólo los eventos que quieres cambiar. Un correo mal formado se descarta; la lista tiene tope de 10 por evento.", "body": { "mode": "raw", "raw": "{}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /settings/data-subject-requests/assignment-rules — Reglas de asignación de Derechos", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/settings/data-subject-requests/assignment-rules", "host": [ "{{base}}" ], "path": [ "api", "v1", "settings", "data-subject-requests", "assignment-rules" ], "query": [] }, "description": "Reglas de asignación de Derechos" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "PUT /settings/data-subject-requests/assignment-rules — Reemplazar las reglas de asignación de Derechos", "request": { "method": "PUT", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/settings/data-subject-requests/assignment-rules", "host": [ "{{base}}" ], "path": [ "api", "v1", "settings", "data-subject-requests", "assignment-rules" ], "query": [] }, "description": "Se evalúan de arriba abajo al abrir cada solicitud, por cualquier canal; la primera activa que calza asigna. Toda persona tiene que ser de tu empresa y estar activa: si una no lo es, no se guarda ninguna.", "body": { "mode": "raw", "raw": "{\n \"rules\": [\n {\n \"name\": \"Erasure requests to Patricio\",\n \"rights\": [\n \"erasure\"\n ],\n \"channels\": [\n \"privacy_center\",\n \"hosted_page\"\n ],\n \"areas\": [\n \"Marketing\"\n ],\n \"userId\": \"usr_0104f9ae5df240be8a3a57c1d2e3f4a5\"\n }\n ]\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /settings/data-protection-center — El centro de protección de datos", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/settings/data-protection-center", "host": [ "{{base}}" ], "path": [ "api", "v1", "settings", "data-protection-center" ], "query": [] }, "description": "El centro de protección de datos" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "PUT /settings/data-protection-center — Encender, reemitir o apagar el centro y su canal de consultas", "request": { "method": "PUT", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/settings/data-protection-center", "host": [ "{{base}}" ], "path": [ "api", "v1", "settings", "data-protection-center" ], "query": [] }, "description": "`enabled: true` sobre un centro ya encendido REEMITE el enlace y el anterior deja de servir. Para conservar el enlace manda sólo `inquiriesEnabled`.", "body": { "mode": "raw", "raw": "{}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] } ] }, { "name": "Bitácora", "description": "La bitácora encadenada es también el flujo de eventos de todos los módulos. `verify` recomputa la cadena.", "item": [ { "name": "GET /audit-log — La bitácora encadenada", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/audit-log", "host": [ "{{base}}" ], "path": [ "api", "v1", "audit-log" ], "query": [ { "key": "limit", "value": "50", "disabled": true, "description": "" }, { "key": "cursor", "value": "eyJvZmZzZXQiOjUwfQ", "disabled": true, "description": "" }, { "key": "type", "value": "texto", "disabled": true, "description": "" }, { "key": "entity", "value": "texto", "disabled": true, "description": "" }, { "key": "window", "value": "500", "disabled": true, "description": "" } ] }, "description": "Del más nuevo al más viejo. Es también el flujo de eventos de todos los módulos: filtra por `type` o por `entity`." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /audit-log/verify — Recomputar la cadena", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/audit-log/verify", "host": [ "{{base}}" ], "path": [ "api", "v1", "audit-log", "verify" ], "query": [] }, "description": "Verifica la ventana de los últimos eventos con la misma regla que la pantalla de Evidencia. `partial` dice si la ventana no llega al primer evento de la empresa." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] } ] }, { "name": "Capacitación", "description": "Carga el padrón, sella el contenido, crea la difusión y ábrela: el conjunto convocado se congela ahí. Registra acuses propios o de un tercero con autor, y lee la cobertura.", "item": [ { "name": "GET /training/roster — El padrón activo", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/training/roster", "host": [ "{{base}}" ], "path": [ "api", "v1", "training", "roster" ], "query": [ { "key": "limit", "value": "50", "disabled": true, "description": "" }, { "key": "cursor", "value": "eyJvZmZzZXQiOjUwfQ", "disabled": true, "description": "" }, { "key": "area", "value": "texto", "disabled": true, "description": "" } ] }, "description": "El padrón activo" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /training/roster — Agregar una persona al padrón", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "{{$guid}}", "description": "Un valor nuevo por intento distinto; el mismo para reintentar la misma creación." } ], "url": { "raw": "{{base}}/api/v1/training/roster", "host": [ "{{base}}" ], "path": [ "api", "v1", "training", "roster" ], "query": [] }, "description": "Sólo lo que hace falta para convocar y acreditar: nombre, correo, área, cargo y vínculo. Nada más entra, a propósito.", "body": { "mode": "raw", "raw": "{\n \"name\": \"texto\",\n \"email\": \"texto\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 201', () => pm.expect([201]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /training/roster/{id} — Ver una persona del padrón", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/training/roster/{{id}}", "host": [ "{{base}}" ], "path": [ "api", "v1", "training", "roster", "{{id}}" ], "query": [] }, "description": "Ver una persona del padrón" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /training/roster/{id}/archive — Archivar a una persona", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/training/roster/{{id}}/archive", "host": [ "{{base}}" ], "path": [ "api", "v1", "training", "roster", "{{id}}", "archive" ], "query": [] }, "description": "Nunca se borra: sus acuses son evidencia y la citan." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /training/contents — Los contenidos de capacitación", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/training/contents", "host": [ "{{base}}" ], "path": [ "api", "v1", "training", "contents" ], "query": [] }, "description": "Los contenidos de capacitación" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /training/contents — Crear un contenido", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "{{$guid}}", "description": "Un valor nuevo por intento distinto; el mismo para reintentar la misma creación." } ], "url": { "raw": "{{base}}/api/v1/training/contents", "host": [ "{{base}}" ], "path": [ "api", "v1", "training", "contents" ], "query": [] }, "description": "Nace sin versión: el texto se sella aparte, y sólo lo sellado se difunde.", "body": { "mode": "raw", "raw": "{\n \"key\": \"induccion_datos_personales\",\n \"name\": \"texto\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 201', () => pm.expect([201]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /training/contents/{id} — Ver un contenido", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/training/contents/{{id}}", "host": [ "{{base}}" ], "path": [ "api", "v1", "training", "contents", "{{id}}" ], "query": [] }, "description": "Ver un contenido" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /training/contents/{id}/versions — Las versiones selladas", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/training/contents/{{id}}/versions", "host": [ "{{base}}" ], "path": [ "api", "v1", "training", "contents", "{{id}}", "versions" ], "query": [] }, "description": "Las versiones selladas" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /training/contents/{id}/versions — Sellar una versión del texto", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "{{$guid}}", "description": "Un valor nuevo por intento distinto; el mismo para reintentar la misma creación." } ], "url": { "raw": "{{base}}/api/v1/training/contents/{{id}}/versions", "host": [ "{{base}}" ], "path": [ "api", "v1", "training", "contents", "{{id}}", "versions" ], "query": [] }, "description": "El sello es lo que prueba qué recibió la gente. Una versión sellada no se edita ni se borra.", "body": { "mode": "raw", "raw": "{\n \"title\": \"texto\",\n \"body\": \"texto\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 201', () => pm.expect([201]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /training/campaigns — Las difusiones", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/training/campaigns", "host": [ "{{base}}" ], "path": [ "api", "v1", "training", "campaigns" ], "query": [ { "key": "limit", "value": "50", "disabled": true, "description": "" }, { "key": "cursor", "value": "eyJvZmZzZXQiOjUwfQ", "disabled": true, "description": "" }, { "key": "state", "value": "draft", "disabled": true, "description": "" } ] }, "description": "Las difusiones" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /training/campaigns — Crear una difusión", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "{{$guid}}", "description": "Un valor nuevo por intento distinto; el mismo para reintentar la misma creación." } ], "url": { "raw": "{{base}}/api/v1/training/campaigns", "host": [ "{{base}}" ], "path": [ "api", "v1", "training", "campaigns" ], "query": [] }, "description": "Lleva o una versión sellada de contenido propio o una publicación de un documento de privacidad: exactamente una. Nace en borrador; el conjunto convocado se congela al abrirla.", "body": { "mode": "raw", "raw": "{\n \"title\": \"texto\",\n \"documentPublicationId\": \"pub_0104f9ae5df240be8a3a57c1d2e3f4a5\",\n \"suggestedDeadline\": \"2026-12-31\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 201', () => pm.expect([201]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /training/campaigns/{id} — Ver una difusión", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/training/campaigns/{{id}}", "host": [ "{{base}}" ], "path": [ "api", "v1", "training", "campaigns", "{{id}}" ], "query": [] }, "description": "Ver una difusión" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /training/campaigns/{id}/open — Abrir: congela el conjunto convocado", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/training/campaigns/{{id}}/open", "host": [ "{{base}}" ], "path": [ "api", "v1", "training", "campaigns", "{{id}}", "open" ], "query": [] }, "description": "Copia quién estaba en el padrón activo en ese instante, opcionalmente de un área. Ése es el denominador de la cobertura y no se recalcula. Con el padrón vacío no se abre: no mediría nada.", "body": { "mode": "raw", "raw": "{}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /training/campaigns/{id}/close — Cerrar una difusión", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/training/campaigns/{{id}}/close", "host": [ "{{base}}" ], "path": [ "api", "v1", "training", "campaigns", "{{id}}", "close" ], "query": [] }, "description": "Cerrar una difusión" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /training/campaigns/{id}/attendees — El conjunto convocado", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/training/campaigns/{{id}}/attendees", "host": [ "{{base}}" ], "path": [ "api", "v1", "training", "campaigns", "{{id}}", "attendees" ], "query": [] }, "description": "Tal como quedó congelado al abrir, con el código de acuse de cada persona." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /training/campaigns/{id}/coverage — La cobertura", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/training/campaigns/{{id}}/coverage", "host": [ "{{base}}" ], "path": [ "api", "v1", "training", "campaigns", "{{id}}", "coverage" ], "query": [ { "key": "area", "value": "texto", "disabled": true, "description": "" } ] }, "description": "Contra el conjunto congelado. Una persona cuenta una vez y se queda con el acuse propio, que prueba más. Un acuse de fuera del conjunto se cuenta aparte y no sube el porcentaje. Cero convocados es «sin datos», no 0 %." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /training/campaigns/{id}/acknowledgements — Los acuses", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/training/campaigns/{{id}}/acknowledgements", "host": [ "{{base}}" ], "path": [ "api", "v1", "training", "campaigns", "{{id}}", "acknowledgements" ], "query": [] }, "description": "Dos tipos, y prueban cosas distintas. `self`: La persona entró por su propio enlace y confirmó haber recibido el contenido. El acto es suyo y queda con su instante. `third_party_record`: Alguien de la organización cargó la asistencia —una lista de un taller presencial, por ejemplo—. Vale como constancia, y dice quién la cargó: sobre la persona hay un testimonio, no un acto propio." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /training/campaigns/{id}/acknowledgements — Registrar un acuse", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "{{$guid}}", "description": "Un valor nuevo por intento distinto; el mismo para reintentar la misma creación." } ], "url": { "raw": "{{base}}/api/v1/training/campaigns/{{id}}/acknowledgements", "host": [ "{{base}}" ], "path": [ "api", "v1", "training", "campaigns", "{{id}}", "acknowledgements" ], "query": [] }, "description": "Sólo de una persona del conjunto convocado. Un `third_party_record` exige `registeredBy`: sobre la persona hay un testimonio, y el testimonio necesita autor. El acuse lleva un sello recomputable y no se borra.", "body": { "mode": "raw", "raw": "{\n \"personId\": \"ppl_0104f9ae5df240be8a3a57c1d2e3f4a5\",\n \"type\": \"self\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 201', () => pm.expect([201]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] } ] }, { "name": "Catálogos", "description": "Las claves que usan los tratamientos: finalidades, categorías de datos, titulares y sistemas.", "item": [ { "name": "GET /catalogs/{type} — Listar un catálogo", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/catalogs/{{type}}", "host": [ "{{base}}" ], "path": [ "api", "v1", "catalogs", "{{type}}" ], "query": [] }, "description": "El catálogo de Datrus más lo que agregó tu empresa, en el orden en que se ofrece al llenar un tratamiento." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /catalogs/{type} — Agregar una entrada propia", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "{{$guid}}", "description": "Un valor nuevo por intento distinto; el mismo para reintentar la misma creación." } ], "url": { "raw": "{{base}}/api/v1/catalogs/{{type}}", "host": [ "{{base}}" ], "path": [ "api", "v1", "catalogs", "{{type}}" ], "query": [] }, "description": "La clave se deriva del nombre y es la que quedará escrita en tus tratamientos. Si ya existe una entrada con esa clave —tuya o del catálogo de Datrus— la respuesta es 409.", "body": { "mode": "raw", "raw": "{\n \"name\": \"CRM de ventas\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 201', () => pm.expect([201]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "DELETE /catalogs/{type}/{id} — Desactivar una entrada propia", "request": { "method": "DELETE", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/catalogs/{{type}}/{{id}}", "host": [ "{{base}}" ], "path": [ "api", "v1", "catalogs", "{{type}}", "{{id}}" ], "query": [] }, "description": "Deja de ofrecerse al llenar un tratamiento, pero NO se borra: los tratamientos y los cortes sellados que ya la citan tienen que seguir leyéndose igual. Las entradas del catálogo de Datrus no se pueden desactivar." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 204', () => pm.expect([204]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] } ] }, { "name": "Centro de privacidad", "description": "Las sesiones al centro de privacidad de una persona conocida.", "item": [ { "name": "POST /privacy-center/sessions — Abrir el centro de privacidad de una persona conocida", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "{{$guid}}", "description": "Un valor nuevo por intento distinto; el mismo para reintentar la misma creación." } ], "url": { "raw": "{{base}}/api/v1/privacy-center/sessions", "host": [ "{{base}}" ], "path": [ "api", "v1", "privacy-center", "sessions" ], "query": [] }, "description": "El modo autenticado del centro de privacidad: tu aplicación ya sabe quién es la persona, pide el enlace y lo abre, sin que ella tenga que solicitarlo. El acceso vence como cualquier enlace del portal y queda registrado con actor `api`.", "body": { "mode": "raw", "raw": "{\n \"type\": \"email\",\n \"value\": \"ana@empresa.cl\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 201', () => pm.expect([201]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] } ] }, { "name": "Conectores", "description": "El camino sin credencial: exporta el catálogo de tu base con el script de sólo lectura, súbelo en `config.schema` de un conector `esquema_subido`, corre el descubrimiento y acepta las propuestas con una finalidad declarada.", "item": [ { "name": "GET /connectors/types — El catálogo de tipos de conector", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/connectors/types", "host": [ "{{base}}" ], "path": [ "api", "v1", "connectors", "types" ], "query": [] }, "description": "Con su familia, si está disponible, qué lee y qué permisos pide. `esquema_subido` es el camino sin credencial." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /connectors — Los conectores", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/connectors", "host": [ "{{base}}" ], "path": [ "api", "v1", "connectors" ], "query": [] }, "description": "Los conectores" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /connectors — Crear un conector", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "{{$guid}}", "description": "Un valor nuevo por intento distinto; el mismo para reintentar la misma creación." } ], "url": { "raw": "{{base}}/api/v1/connectors", "host": [ "{{base}}" ], "path": [ "api", "v1", "connectors" ], "query": [] }, "description": "Crear un conector", "body": { "mode": "raw", "raw": "{\n \"type\": \"esquema_subido\",\n \"name\": \"texto\",\n \"system\": \"crm\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 201', () => pm.expect([201]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /connectors/{id} — Ver un conector", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/connectors/{{id}}", "host": [ "{{base}}" ], "path": [ "api", "v1", "connectors", "{{id}}" ], "query": [] }, "description": "Ver un conector" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "PATCH /connectors/{id} — Editar un conector", "request": { "method": "PATCH", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/connectors/{{id}}", "host": [ "{{base}}" ], "path": [ "api", "v1", "connectors", "{{id}}" ], "query": [] }, "description": "Editar un conector", "body": { "mode": "raw", "raw": "{\n \"type\": \"esquema_subido\",\n \"system\": \"crm\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "DELETE /connectors/{id} — Borrar un conector", "request": { "method": "DELETE", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/connectors/{{id}}", "host": [ "{{base}}" ], "path": [ "api", "v1", "connectors", "{{id}}" ], "query": [] }, "description": "Se lleva sus propuestas PENDIENTES —preguntas sin contestar sobre un escaneo que ya no está—. Las decididas sobreviven: son la respuesta de una persona y pertenecen a la empresa." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /connectors/{id}/run — Correr el descubrimiento", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/connectors/{{id}}/run", "host": [ "{{base}}" ], "path": [ "api", "v1", "connectors", "{{id}}", "run" ], "query": [] }, "description": "Lee la estructura, clasifica los campos y deja propuestas. Nunca lee una fila. Si la fuente trae valores, se rechaza entera." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /connectors/{id}/runs — Las corridas", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/connectors/{{id}}/runs", "host": [ "{{base}}" ], "path": [ "api", "v1", "connectors", "{{id}}", "runs" ], "query": [] }, "description": "Las corridas" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /connectors/{id}/runs/{runId}/findings — Los hallazgos de una corrida", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/connectors/{{id}}/runs/{{runId}}/findings", "host": [ "{{base}}" ], "path": [ "api", "v1", "connectors", "{{id}}", "runs", "{{runId}}", "findings" ], "query": [] }, "description": "Campo por campo: qué se clasificó, con qué confianza y si ya se había visto. Nombres y tipos; nunca un valor." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /connectors/{id}/proposals — Las propuestas de tratamiento", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/connectors/{{id}}/proposals", "host": [ "{{base}}" ], "path": [ "api", "v1", "connectors", "{{id}}", "proposals" ], "query": [ { "key": "state", "value": "pending", "disabled": true, "description": "" } ] }, "description": "De todas las corridas del conector. Una propuesta es una pregunta: se acepta con una finalidad declarada, o se descarta." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /proposals/{id}/accept — Aceptar una propuesta: crea el tratamiento en borrador", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "{{$guid}}", "description": "Un valor nuevo por intento distinto; el mismo para reintentar la misma creación." } ], "url": { "raw": "{{base}}/api/v1/proposals/{{id}}/accept", "host": [ "{{base}}" ], "path": [ "api", "v1", "proposals", "{{id}}", "accept" ], "query": [] }, "description": "La finalidad la declara la persona: nunca se infiere de la estructura. El tratamiento nace en borrador, para que el inventario lo revise como a cualquier otro.", "body": { "mode": "raw", "raw": "{\n \"purpose\": \"texto\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 201', () => pm.expect([201]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /proposals/{id}/discard — Descartar una propuesta", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/proposals/{{id}}/discard", "host": [ "{{base}}" ], "path": [ "api", "v1", "proposals", "{{id}}", "discard" ], "query": [] }, "description": "Descartar una propuesta" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] } ] }, { "name": "Consentimiento", "description": "**Registro directo**: `POST /consents` con el `form` público, el identificador de la persona (viaja en el cuerpo, se hashea y se descarta) y los `scopes`. La respuesta trae el `agreement` y su evidencia sellada. **Pedir una decisión**: `POST /consent-requests` con la plantilla, el canal y el nivel; el enlace lo abre la persona. Corregir acota lo otorgado; retirarlo todo es una revocación.", "item": [ { "name": "GET /consent-templates — Listar las plantillas", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/consent-templates", "host": [ "{{base}}" ], "path": [ "api", "v1", "consent-templates" ], "query": [ { "key": "limit", "value": "50", "disabled": true, "description": "" }, { "key": "cursor", "value": "eyJvZmZzZXQiOjUwfQ", "disabled": true, "description": "" }, { "key": "state", "value": "draft", "disabled": true, "description": "" }, { "key": "kind", "value": "consent", "disabled": true, "description": "" } ] }, "description": "Listar las plantillas" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /consent-templates — Crear una plantilla", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "{{$guid}}", "description": "Un valor nuevo por intento distinto; el mismo para reintentar la misma creación." } ], "url": { "raw": "{{base}}/api/v1/consent-templates", "host": [ "{{base}}" ], "path": [ "api", "v1", "consent-templates" ], "query": [] }, "description": "Nace en borrador y con su primera versión publicada: el texto se resuelve contra los documentos de privacidad vigentes y se sella. Enlázala a un tratamiento con `/link` antes de activarla.", "body": { "mode": "raw", "raw": "{\n \"code\": \"PL-003\",\n \"name\": \"texto\",\n \"primaryUse\": \"texto\",\n \"legalBasis\": \"consent\",\n \"text\": \"texto\",\n \"scopes\": [\n {\n \"key\": \"newsletter\",\n \"dataCategories\": [\n \"contacto\"\n ],\n \"subjectKinds\": [\n \"clientes\"\n ]\n }\n ]\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 201', () => pm.expect([201]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /consent-templates/stats — Las cifras por plantilla", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/consent-templates/stats", "host": [ "{{base}}" ], "path": [ "api", "v1", "consent-templates", "stats" ], "query": [ { "key": "from", "value": "2026-01-01", "disabled": true, "description": "Fecha o instante ISO; se compara contra la creación del acto o la entrada." }, { "key": "to", "value": "2026-12-31", "disabled": true, "description": "" } ] }, "description": "Cómo rinde cada plantilla: cuántos otorgaron y cuántos retiraron (actos y personas distintas), cuántas entradas de formulario se iniciaron y se completaron, y las dos tasas. Las tasas se miden sobre PERSONAS y no sobre actos: una persona que otorga y retira cuenta una vez de cada lado. `null` en una tasa significa que no hay a quién medir, y no es 0. `partial` avisa si la lectura tocó el tope de filas y las cifras son parciales." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /consent-templates/{id}/stats — Las cifras de una plantilla", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/consent-templates/{{id}}/stats", "host": [ "{{base}}" ], "path": [ "api", "v1", "consent-templates", "{{id}}", "stats" ], "query": [ { "key": "from", "value": "2026-01-01", "disabled": true, "description": "Fecha o instante ISO; se compara contra la creación del acto o la entrada." }, { "key": "to", "value": "2026-12-31", "disabled": true, "description": "" } ] }, "description": "Lo mismo que `GET /consent-templates/stats`, para una sola plantilla. Una plantilla sin actos responde en cero, no 404." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /consent-templates/{id} — Ver una plantilla", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/consent-templates/{{id}}", "host": [ "{{base}}" ], "path": [ "api", "v1", "consent-templates", "{{id}}" ], "query": [] }, "description": "Ver una plantilla" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "PATCH /consent-templates/{id} — Editar una plantilla y publicar una versión nueva", "request": { "method": "PATCH", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/consent-templates/{{id}}", "host": [ "{{base}}" ], "path": [ "api", "v1", "consent-templates", "{{id}}" ], "query": [] }, "description": "Editar el texto o los alcances PUBLICA una versión: lo firmado con la versión anterior no cambia. Manda siempre `text` y `scopes` completos, que es lo que se sella.", "body": { "mode": "raw", "raw": "{\n \"text\": \"texto\",\n \"scopes\": [\n {\n \"key\": \"newsletter\",\n \"dataCategories\": [\n \"contacto\"\n ],\n \"subjectKinds\": [\n \"clientes\"\n ]\n }\n ]\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /consent-templates/{id}/versions — Las versiones publicadas", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/consent-templates/{{id}}/versions", "host": [ "{{base}}" ], "path": [ "api", "v1", "consent-templates", "{{id}}", "versions" ], "query": [] }, "description": "Cada solicitud cita una versión, no la plantilla: así lo que alguien autorizó ayer se lee igual aunque el texto cambie hoy." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /consent-templates/{id}/versions/{version} — Una versión publicada", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/consent-templates/{{id}}/versions/{{version}}", "host": [ "{{base}}" ], "path": [ "api", "v1", "consent-templates", "{{id}}", "versions", "{{version}}" ], "query": [] }, "description": "Una versión publicada" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /consent-templates/{id}/state — Activar, pausar o archivar", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/consent-templates/{{id}}/state", "host": [ "{{base}}" ], "path": [ "api", "v1", "consent-templates", "{{id}}", "state" ], "query": [] }, "description": "Sólo una plantilla `active` puede emitir solicitudes. Pausar no invalida nada de lo ya firmado; archivar la saca de circulación.", "body": { "mode": "raw", "raw": "{\n \"state\": \"draft\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /consent-templates/{id}/link — Enlazar la plantilla a un tratamiento", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/consent-templates/{{id}}/link", "host": [ "{{base}}" ], "path": [ "api", "v1", "consent-templates", "{{id}}", "link" ], "query": [] }, "description": "El enlace con el RAT es lo que mantiene honesto el consentimiento: la finalidad que lee la persona es la que declara el registro. Al enlazar, la plantilla puede heredar la finalidad y la base del tratamiento. Manda `null` para desenlazar.", "body": { "mode": "raw", "raw": "{\n \"processingActivityId\": null\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /consent-requests — Listar las solicitudes", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/consent-requests", "host": [ "{{base}}" ], "path": [ "api", "v1", "consent-requests" ], "query": [ { "key": "limit", "value": "50", "disabled": true, "description": "" }, { "key": "cursor", "value": "eyJvZmZzZXQiOjUwfQ", "disabled": true, "description": "" }, { "key": "state", "value": "issued", "disabled": true, "description": "" }, { "key": "agreementId", "value": "texto", "disabled": true, "description": "" } ] }, "description": "La bandeja. Lo vencido se marca al leerlo: no hay un proceso por detrás que lo haga." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /consent-requests — Pedirle a una persona que decida", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "{{$guid}}", "description": "Un valor nuevo por intento distinto; el mismo para reintentar la misma creación." } ], "url": { "raw": "{{base}}/api/v1/consent-requests", "host": [ "{{base}}" ], "path": [ "api", "v1", "consent-requests" ], "query": [] }, "description": "Emite el enlace y, si el canal manda mensajes, lo manda. La plantilla tiene que estar activa. Queda registrada como emitida por `api`. Manda un `Idempotency-Key`: reintentar no puede dejar a la misma persona con dos solicitudes vivas.", "body": { "mode": "raw", "raw": "{\n \"templateId\": \"tpl_0104f9ae5df240be8a3a57c1d2e3f4a5\",\n \"subject\": {\n \"type\": \"email\",\n \"value\": \"ana@empresa.cl\"\n },\n \"carrier\": \"email\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 201', () => pm.expect([201]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /consent-requests/stats — Cuántas hay en cada estado", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/consent-requests/stats", "host": [ "{{base}}" ], "path": [ "api", "v1", "consent-requests", "stats" ], "query": [] }, "description": "Todos los estados salen, aunque sea en cero." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /consent-requests/{id} — Ver una solicitud", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/consent-requests/{{id}}", "host": [ "{{base}}" ], "path": [ "api", "v1", "consent-requests", "{{id}}" ], "query": [] }, "description": "Ver una solicitud" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /consent-requests/{id}/cancel — Anular una solicitud", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/consent-requests/{{id}}/cancel", "host": [ "{{base}}" ], "path": [ "api", "v1", "consent-requests", "{{id}}", "cancel" ], "query": [] }, "description": "El enlace deja de servir. Sólo se anula lo que todavía no se decidió: una decisión tomada no se borra." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /consent-requests/{id}/deliveries — Qué pasó con los mensajes", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/consent-requests/{{id}}/deliveries", "host": [ "{{base}}" ], "path": [ "api", "v1", "consent-requests", "{{id}}", "deliveries" ], "query": [] }, "description": "Cada intento de entrega con su estado y su costo. Es lo que se mira cuando alguien dice que nunca le llegó." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /consent-requests/{id}/verifications — Cómo se verificó la identidad", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/consent-requests/{{id}}/verifications", "host": [ "{{base}}" ], "path": [ "api", "v1", "consent-requests", "{{id}}", "verifications" ], "query": [] }, "description": "Qué método se usó, en qué nivel y cómo terminó. Es la evidencia de que quien decidió era quien decía ser." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /agreements/{id} — Ver el acuerdo de una persona", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/agreements/{{id}}", "host": [ "{{base}}" ], "path": [ "api", "v1", "agreements", "{{id}}" ], "query": [] }, "description": "El registro de una persona con tu empresa. Estable en el tiempo: no cambia aunque decida otra cosa. Para llegar acá desde un correo o un RUT, usa `POST /data-subjects/lookup`." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /agreements/{id}/versions/{version}/evidence — Descargar la evidencia de una versión", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/agreements/{{id}}/versions/{{version}}/evidence", "host": [ "{{base}}" ], "path": [ "api", "v1", "agreements", "{{id}}", "versions", "{{version}}", "evidence" ], "query": [ { "key": "format", "value": "pdf", "disabled": true, "description": "" } ] }, "description": "La evidencia sellada de una versión del acuerdo, como archivo. `format=pdf` (por defecto) entrega el documento que se le muestra a un auditor; `format=json` entrega el sobre sellado, el mismo que acepta `POST /verify` sin cuenta. Si la evidencia ya no cuadra con su sello, no se exporta: 409." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /agreements/{id}/permissions — Qué puedes tratar hoy de esta persona", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/agreements/{{id}}/permissions", "host": [ "{{base}}" ], "path": [ "api", "v1", "agreements", "{{id}}", "permissions" ], "query": [] }, "description": "Se recomputa desde los actos, que son la fuente de verdad. Cada permiso vigente trae las plantillas que lo sostienen: un permiso vive mientras AL MENOS UNA lo sostenga, así que revocar una no se lleva por delante lo que otra requiere." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /agreements/{id}/dossier — El expediente completo", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/agreements/{{id}}/dossier", "host": [ "{{base}}" ], "path": [ "api", "v1", "agreements", "{{id}}", "dossier" ], "query": [] }, "description": "Todo lo que pasó con esta persona: qué autorizó, cuándo, por dónde, cómo se verificó su identidad y con qué sello quedó cada acto. Es lo que se entrega cuando alguien pregunta cómo se obtuvo un consentimiento." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /agreements/{id}/revocation-preview — Qué pasaría si se revocara esto", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/agreements/{{id}}/revocation-preview", "host": [ "{{base}}" ], "path": [ "api", "v1", "agreements", "{{id}}", "revocation-preview" ], "query": [] }, "description": "NO escribe nada, y ése es el punto: es lo que se le muestra a alguien antes de apretar el botón. Devuelve las dos fotos, el diff y qué permisos sobreviven porque otra plantilla los sostiene. Sin `scopes` se previsualiza la plantilla entera.", "body": { "mode": "raw", "raw": "{\n \"templateId\": \"texto\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /consents/stats — Las cifras del módulo", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/consents/stats", "host": [ "{{base}}" ], "path": [ "api", "v1", "consents", "stats" ], "query": [] }, "description": "Cuántas personas tienen registro, cuántas con autorización vigente, cuántas quedaron pendientes de reconsentir tras cambiar una plantilla, y cómo van las solicitudes." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /consent-activity — Quién hizo qué en el módulo", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/consent-activity", "host": [ "{{base}}" ], "path": [ "api", "v1", "consent-activity" ], "query": [ { "key": "actor", "value": "texto", "disabled": true, "description": "" }, { "key": "type", "value": "consentimiento.plantilla.publicada", "disabled": true, "description": "" }, { "key": "from", "value": "texto", "disabled": true, "description": "Fecha o instante ISO." }, { "key": "to", "value": "texto", "disabled": true, "description": "" }, { "key": "limit", "value": "100", "disabled": true, "description": "" } ] }, "description": "El registro de acciones de Consentimiento: quién publicó una plantilla, quién emitió una solicitud, quién corrigió un registro. Nunca lleva el identificador de un titular; una reja lo comprueba antes de entregar la lista." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /third-party-roles — Los cuatro roles de un tercero", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/third-party-roles", "host": [ "{{base}}" ], "path": [ "api", "v1", "third-party-roles" ], "query": [] }, "description": "Catálogo cerrado. El rol decide qué se le avisa a cada tercero cuando alguien revoca." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /third-parties — Listar los terceros", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/third-parties", "host": [ "{{base}}" ], "path": [ "api", "v1", "third-parties" ], "query": [ { "key": "includeArchived", "value": "true", "disabled": true, "description": "" } ] }, "description": "Listar los terceros" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /third-parties — Registrar un tercero", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "{{$guid}}", "description": "Un valor nuevo por intento distinto; el mismo para reintentar la misma creación." } ], "url": { "raw": "{{base}}/api/v1/third-parties", "host": [ "{{base}}" ], "path": [ "api", "v1", "third-parties" ], "query": [] }, "description": "La razón social no puede traer el dato de una persona: un tercero es una empresa, y ese nombre termina en un CSV, en el PDF de una evidencia y en la pantalla del socio.", "body": { "mode": "raw", "raw": "{\n \"code\": \"retail_austral\",\n \"name\": \"texto\",\n \"role\": \"processor\",\n \"country\": \"CL\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 201', () => pm.expect([201]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /third-parties/{id} — Ver un tercero", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/third-parties/{{id}}", "host": [ "{{base}}" ], "path": [ "api", "v1", "third-parties", "{{id}}" ], "query": [] }, "description": "Ver un tercero" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "PATCH /third-parties/{id} — Editar un tercero", "request": { "method": "PATCH", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/third-parties/{{id}}", "host": [ "{{base}}" ], "path": [ "api", "v1", "third-parties", "{{id}}" ], "query": [] }, "description": "El `code` es estable y no se cambia: es lo que quedó sellado en las evidencias. El nombre sí, porque una empresa se puede renombrar.", "body": { "mode": "raw", "raw": "{\n \"code\": \"retail_austral\",\n \"name\": \"texto\",\n \"role\": \"processor\",\n \"country\": \"CL\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /third-parties/{id}/state — Archivar o reactivar un tercero", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/third-parties/{{id}}/state", "host": [ "{{base}}" ], "path": [ "api", "v1", "third-parties", "{{id}}", "state" ], "query": [] }, "description": "Archivar es la baja, y significa algo: un tercero archivado NO se puede enlazar a una plantilla. Lo ya sellado no cambia.", "body": { "mode": "raw", "raw": "{\n \"state\": \"active\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /consent-templates/{id}/third-parties — Con quién comparte datos esta plantilla", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/consent-templates/{{id}}/third-parties", "host": [ "{{base}}" ], "path": [ "api", "v1", "consent-templates", "{{id}}", "third-parties" ], "query": [] }, "description": "Lo que el titular ve declarado al consentir, y lo que se sella con cada acto." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "PUT /consent-templates/{id}/third-parties — Fijar con quién comparte datos esta plantilla", "request": { "method": "PUT", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/consent-templates/{{id}}/third-parties", "host": [ "{{base}}" ], "path": [ "api", "v1", "consent-templates", "{{id}}", "third-parties" ], "query": [] }, "description": "Reemplaza el conjunto completo: lo que mandes es lo que queda. Un tercero archivado no se puede enlazar. Cambiar esto no altera lo ya sellado; rige desde la próxima versión que se publique.", "body": { "mode": "raw", "raw": "{\n \"thirdPartyIds\": [\n \"texto\"\n ]\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /consent-revocations — Revocar un consentimiento por decisión de la empresa", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "{{$guid}}", "description": "Un valor nuevo por intento distinto; el mismo para reintentar la misma creación." } ], "url": { "raw": "{{base}}/api/v1/consent-revocations", "host": [ "{{base}}" ], "path": [ "api", "v1", "consent-revocations" ], "query": [] }, "description": "La empresa retira lo que ella misma sostenía: sin `scopes` se retira la plantilla entera. Pasa por el mismo motor que una revocación del titular, así que deja la misma evidencia sellada. Manda `sourceEvent` para que reintentar no selle dos veces.", "body": { "mode": "raw", "raw": "{\n \"agreementId\": \"texto\",\n \"templateId\": \"texto\",\n \"reasonCode\": \"solicitud_del_titular\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 201', () => pm.expect([201]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /consent-corrections/preview — Qué haría esta corrección", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/consent-corrections/preview", "host": [ "{{base}}" ], "path": [ "api", "v1", "consent-corrections", "preview" ], "query": [] }, "description": "No escribe nada. Dice qué alcances se retirarían, cuáles se ampliarían —si amplía, no es una corrección— y si es estrecha, que es la condición para poder aplicarla.", "body": { "mode": "raw", "raw": "{\n \"agreementId\": \"texto\",\n \"templateId\": \"texto\",\n \"scopes\": [\n \"texto\"\n ]\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /consent-corrections — Corregir lo que quedó registrado", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "{{$guid}}", "description": "Un valor nuevo por intento distinto; el mismo para reintentar la misma creación." } ], "url": { "raw": "{{base}}/api/v1/consent-corrections", "host": [ "{{base}}" ], "path": [ "api", "v1", "consent-corrections" ], "query": [] }, "description": "«Esto es lo que debió quedar otorgado». Sólo ACOTA: si lo que mandas ampliaría lo que la persona autorizó, se rechaza — no se puede otorgar por cuenta de nadie. Previsualiza primero con `/preview`.", "body": { "mode": "raw", "raw": "{\n \"agreementId\": \"texto\",\n \"templateId\": \"texto\",\n \"scopes\": [\n \"texto\"\n ],\n \"reasonCode\": \"solicitud_del_titular\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 201', () => pm.expect([201]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /consent-corrections/{id}/rollback — Revertir una corrección", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/consent-corrections/{{id}}/rollback", "host": [ "{{base}}" ], "path": [ "api", "v1", "consent-corrections", "{{id}}", "rollback" ], "query": [] }, "description": "Restaura lo que esa plantilla sostenía antes. La reversión ES un acto y queda en el expediente; pedirla dos veces no sella una versión más.", "body": { "mode": "raw", "raw": "{\n \"reasonCode\": \"solicitud_del_titular\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /consent-import-templates — Contra qué plantillas se puede importar", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/consent-import-templates", "host": [ "{{base}}" ], "path": [ "api", "v1", "consent-import-templates" ], "query": [] }, "description": "Las que tienen una versión publicada y no están archivadas, con sus claves de alcance. Una archivada la rechaza el motor y una en borrador no tiene alcances contra los que validar." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /consent-imports — Importar consentimientos históricos", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/consent-imports", "host": [ "{{base}}" ], "path": [ "api", "v1", "consent-imports" ], "query": [] }, "description": "Cada fila es UN ACTO del motor, no una fila insertada a mano: versión del acuerdo, diff, evidencia sellada y evento encadenado. Por eso un consentimiento importado produce exactamente la misma evidencia que uno capturado en pantalla. Se procesa de a 20 registros: manda `from` con el índice siguiente para continuar. El archivo NO se guarda en ninguna parte.", "body": { "mode": "raw", "raw": "{\n \"data\": \"texto\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /consent-forms — Listar los formularios alojados", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/consent-forms", "host": [ "{{base}}" ], "path": [ "api", "v1", "consent-forms" ], "query": [ { "key": "limit", "value": "50", "disabled": true, "description": "" }, { "key": "cursor", "value": "eyJvZmZzZXQiOjUwfQ", "disabled": true, "description": "" }, { "key": "state", "value": "draft", "disabled": true, "description": "" } ] }, "description": "Con su token público y los alcances que ofrecen: es de acá de donde sacas lo que necesitas para registrar un consentimiento por API." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /consent-forms — Crear un formulario alojado", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "{{$guid}}", "description": "Un valor nuevo por intento distinto; el mismo para reintentar la misma creación." } ], "url": { "raw": "{{base}}/api/v1/consent-forms", "host": [ "{{base}}" ], "path": [ "api", "v1", "consent-forms" ], "query": [] }, "description": "Nace en borrador, sin token: el enlace público se emite al publicar. Los tres campos legales pueden quedar pendientes mientras es borrador.", "body": { "mode": "raw", "raw": "{\n \"code\": \"FO-001\",\n \"name\": \"texto\",\n \"templateId\": \"texto\",\n \"schema\": {\n \"title\": \"texto\",\n \"introduction\": \"texto\",\n \"identifierType\": \"email\",\n \"identifierLabel\": \"Tu correo\",\n \"scopes\": [\n {\n \"key\": \"newsletter\",\n \"label\": \"Quiero recibir novedades\",\n \"mandatory\": true,\n \"checked\": true\n }\n ],\n \"channels\": [\n \"digital\"\n ],\n \"buttonText\": \"texto\",\n \"thanksText\": \"texto\"\n }\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 201', () => pm.expect([201]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /consent-forms/{id} — Ver un formulario", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/consent-forms/{{id}}", "host": [ "{{base}}" ], "path": [ "api", "v1", "consent-forms", "{{id}}" ], "query": [] }, "description": "Ver un formulario" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "PATCH /consent-forms/{id} — Editar un formulario y publicar una versión del esquema", "request": { "method": "PATCH", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/consent-forms/{{id}}", "host": [ "{{base}}" ], "path": [ "api", "v1", "consent-forms", "{{id}}" ], "query": [] }, "description": "La versión sellada anterior se queda: la pantalla que una persona leyó es evidencia y no se reescribe.", "body": { "mode": "raw", "raw": "{\n \"schema\": {\n \"title\": \"texto\",\n \"introduction\": \"texto\",\n \"identifierType\": \"email\",\n \"identifierLabel\": \"Tu correo\",\n \"scopes\": [\n {\n \"key\": \"newsletter\",\n \"label\": \"Quiero recibir novedades\",\n \"mandatory\": true,\n \"checked\": true\n }\n ],\n \"channels\": [\n \"digital\"\n ],\n \"buttonText\": \"texto\",\n \"thanksText\": \"texto\"\n }\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /consent-forms/{id}/versions — Las versiones selladas del esquema", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/consent-forms/{{id}}/versions", "host": [ "{{base}}" ], "path": [ "api", "v1", "consent-forms", "{{id}}", "versions" ], "query": [] }, "description": "Las versiones selladas del esquema" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /consent-forms/{id}/publish — Publicar el formulario", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/consent-forms/{{id}}/publish", "host": [ "{{base}}" ], "path": [ "api", "v1", "consent-forms", "{{id}}", "publish" ], "query": [] }, "description": "Emite el token público y deja la página en línea. Exige los tres campos que la ley pide junto al «sí»: dónde está la política, a quién se le reclama y cuánto duran los datos." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /consent-forms/{id}/close — Cerrar el formulario", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/consent-forms/{{id}}/close", "host": [ "{{base}}" ], "path": [ "api", "v1", "consent-forms", "{{id}}", "close" ], "query": [] }, "description": "El enlace deja de recibir. Lo ya registrado por él no se toca: sigue siendo evidencia válida." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /consent-forms/{id}/entries — Quiénes pasaron por el formulario", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/consent-forms/{{id}}/entries", "host": [ "{{base}}" ], "path": [ "api", "v1", "consent-forms", "{{id}}", "entries" ], "query": [ { "key": "state", "value": "started", "disabled": true, "description": "" } ] }, "description": "Cada apertura con en qué quedó. Nunca el identificador en claro: esta tabla no lo guarda, sólo su pista." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /consents — Registrar un consentimiento o un retiro (registro directo)", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "{{$guid}}", "description": "Un valor nuevo por intento distinto; el mismo para reintentar la misma creación." } ], "url": { "raw": "{{base}}/api/v1/consents", "host": [ "{{base}}" ], "path": [ "api", "v1", "consents" ], "query": [] }, "description": "Registra lo que una persona decidió, desde tus propios sistemas, contra un formulario publicado. Pasa por el mismo motor y deja la misma evidencia sellada que el formulario alojado; lo que cambia es que la evidencia deja constancia de que la captura la hizo el responsable. Manda un `Idempotency-Key`.", "body": { "mode": "raw", "raw": "{\n \"form\": \"5eyx6jehtwd7j0r4er6g41\",\n \"identifier\": {\n \"value\": \"ana@empresa.cl\"\n },\n \"scopes\": [\n \"service\",\n \"newsletter\"\n ],\n \"witness\": \"SUC-01\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 201', () => pm.expect([201]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] } ] }, { "name": "Controles y riesgos", "description": "", "item": [ { "name": "GET /controls — Los controles con su evidencia", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/controls", "host": [ "{{base}}" ], "path": [ "api", "v1", "controls" ], "query": [] }, "description": "Los controles con su evidencia" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /controls — Crear un control", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "{{$guid}}", "description": "Un valor nuevo por intento distinto; el mismo para reintentar la misma creación." } ], "url": { "raw": "{{base}}/api/v1/controls", "host": [ "{{base}}" ], "path": [ "api", "v1", "controls" ], "query": [] }, "description": "Crear un control", "body": { "mode": "raw", "raw": "{\n \"name\": \"texto\",\n \"origin\": \"datrus_catalog\",\n \"ownerId\": \"usr_0104f9ae5df240be8a3a57c1d2e3f4a5\",\n \"reviewPeriod\": \"once\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 201', () => pm.expect([201]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /controls/catalog — El catálogo de controles de Datrus", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/controls/catalog", "host": [ "{{base}}" ], "path": [ "api", "v1", "controls", "catalog" ], "query": [] }, "description": "Twenty controls an auditor expects first (ISO 27001 Annex A and Art. 14 quinquies). A Datrus criterion, not a list from the law." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /controls/adopt — Adoptar controles del catálogo", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/controls/adopt", "host": [ "{{base}}" ], "path": [ "api", "v1", "controls", "adopt" ], "query": [] }, "description": "Copies the chosen catalog controls to the company with their reference. Already adopted keys are skipped, never duplicated.", "body": { "mode": "raw", "raw": "{\n \"keys\": [\n \"texto\"\n ]\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /controls/{id} — Ver un control", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/controls/{{id}}", "host": [ "{{base}}" ], "path": [ "api", "v1", "controls", "{{id}}" ], "query": [] }, "description": "Ver un control" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "PATCH /controls/{id} — Editar un control", "request": { "method": "PATCH", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/controls/{{id}}", "host": [ "{{base}}" ], "path": [ "api", "v1", "controls", "{{id}}" ], "query": [] }, "description": "Editar un control", "body": { "mode": "raw", "raw": "{\n \"ownerId\": \"usr_0104f9ae5df240be8a3a57c1d2e3f4a5\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /controls/{id}/evidence — Registrar evidencia de un control", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "{{$guid}}", "description": "Un valor nuevo por intento distinto; el mismo para reintentar la misma creación." } ], "url": { "raw": "{{base}}/api/v1/controls/{{id}}/evidence", "host": [ "{{base}}" ], "path": [ "api", "v1", "controls", "{{id}}", "evidence" ], "query": [] }, "description": "A description, where the proof lives and an optional sha256. Never the file nor personal data. Without `validUntil`, the expiry is suggested from the review period.", "body": { "mode": "raw", "raw": "{\n \"description\": \"texto\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 201', () => pm.expect([201]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /risks — El registro de riesgos", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/risks", "host": [ "{{base}}" ], "path": [ "api", "v1", "risks" ], "query": [] }, "description": "El registro de riesgos" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /risks — Registrar un riesgo", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "{{$guid}}", "description": "Un valor nuevo por intento distinto; el mismo para reintentar la misma creación." } ], "url": { "raw": "{{base}}/api/v1/risks", "host": [ "{{base}}" ], "path": [ "api", "v1", "risks" ], "query": [] }, "description": "Measured with the current matrix: `impact` and `likelihood` go from 1 to the matrix scale; the level is computed and frozen with the matrix version. A `declaredLevel` requires its rationale.", "body": { "mode": "raw", "raw": "{\n \"description\": \"texto\",\n \"origin\": \"dpia\",\n \"impact\": 1,\n \"likelihood\": 1,\n \"ownerId\": \"usr_0104f9ae5df240be8a3a57c1d2e3f4a5\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 201', () => pm.expect([201]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /risks/adopt-dpia-risk — Adoptar un riesgo de una EIPD", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/risks/adopt-dpia-risk", "host": [ "{{base}}" ], "path": [ "api", "v1", "risks", "adopt-dpia-risk" ], "query": [] }, "description": "Brings a DPIA risk into the register (the DPIA is untouched), translating its four words to the current matrix scale. Adopting twice returns the existing one.", "body": { "mode": "raw", "raw": "{\n \"dpiaRiskId\": \"dpr_0104f9ae5df240be8a3a57c1d2e3f4a5\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /risks/{id} — Ver un riesgo", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/risks/{{id}}", "host": [ "{{base}}" ], "path": [ "api", "v1", "risks", "{{id}}" ], "query": [] }, "description": "Ver un riesgo" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "PATCH /risks/{id} — Editar un riesgo", "request": { "method": "PATCH", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/risks/{{id}}", "host": [ "{{base}}" ], "path": [ "api", "v1", "risks", "{{id}}" ], "query": [] }, "description": "The origin does not change. New impact or likelihood are measured again with the current matrix.", "body": { "mode": "raw", "raw": "{\n \"ownerId\": \"usr_0104f9ae5df240be8a3a57c1d2e3f4a5\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "PUT /risks/{id}/controls — Vincular los controles que mitigan un riesgo", "request": { "method": "PUT", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/risks/{{id}}/controls", "host": [ "{{base}}" ], "path": [ "api", "v1", "risks", "{{id}}", "controls" ], "query": [] }, "description": "Replaces the whole set.", "body": { "mode": "raw", "raw": "{\n \"controlIds\": [\n \"ctl_0104f9ae5df240be8a3a57c1d2e3f4a5\"\n ]\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 204', () => pm.expect([204]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] } ] }, { "name": "Cuenta", "description": "Empieza por `GET /me`: te dice qué empresa eres, qué permisos tiene tu llave y qué módulos están encendidos. Una llave `dtr_test_` lee todo y sólo escribe donde hay modo prueba.", "item": [ { "name": "GET /me — Quién soy", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/me", "host": [ "{{base}}" ], "path": [ "api", "v1", "me" ], "query": [] }, "description": "La empresa detrás de la llave, la llave misma con sus permisos, los productos contratados y el estado de cada módulo. Es la primera llamada que conviene hacer." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /modules — Los módulos y su estado", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/modules", "host": [ "{{base}}" ], "path": [ "api", "v1", "modules" ], "query": [] }, "description": "Un módulo `off` está apagado para tu empresa: sus endpoints responden 403 `module_disabled` antes de mirar los permisos." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /permissions — El catálogo de permisos", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/permissions", "host": [ "{{base}}" ], "path": [ "api", "v1", "permissions" ], "query": [] }, "description": "`admin` incluye `write`, que incluye `read`. `*` da todo; `:*` da un recurso entero. Dale a cada llave sólo lo que ese sistema necesita." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /roles — Los roles y lo que puede cada uno", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/roles", "host": [ "{{base}}" ], "path": [ "api", "v1", "roles" ], "query": [] }, "description": "La matriz de permisos de la consola, tal como la aplica Datrus. Es de sólo lectura: los roles no se inventan por empresa." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] } ] }, { "name": "Derechos", "description": "**Alta de una solicitud que llegó por otro canal**: `POST /data-subject-requests` con la fecha de recepción real; el plazo legal de 30 días corridos se calcula desde ahí, no desde hoy. Después `acknowledge`, `assign`, resolver derecho por derecho en `/processes/{id}/resolve` y, si hace falta, una única prórroga en `/extend`. Una denegación va fundada.", "item": [ { "name": "GET /data-subject-requests/track/{code} — Seguir una solicitud por su código, sin cuenta", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/data-subject-requests/track/{{code}}", "host": [ "{{base}}" ], "path": [ "api", "v1", "data-subject-requests", "track", "{{code}}" ], "query": [] }, "description": "Lo mismo que ve la persona en la página pública de derechos: el estado, los derechos pedidos, las fechas y una pista enmascarada de su identificador. Público: no pide llave. Límite: 30 consultas por minuto por dirección IP. Un código que no existe y uno de otra empresa se ven igual.", "auth": { "type": "noauth" } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /data-subject-requests — Listar las solicitudes de derechos", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/data-subject-requests", "host": [ "{{base}}" ], "path": [ "api", "v1", "data-subject-requests" ], "query": [ { "key": "limit", "value": "50", "disabled": true, "description": "" }, { "key": "cursor", "value": "eyJvZmZzZXQiOjUwfQ", "disabled": true, "description": "" }, { "key": "state", "value": "awaiting_verification", "disabled": true, "description": "" }, { "key": "area", "value": "texto", "disabled": true, "description": "" }, { "key": "assignedTo", "value": "texto", "disabled": true, "description": "El id de la persona a cargo." } ] }, "description": "La bandeja, con el plazo de cada una ya calculado: `daysLeft` negativo es una solicitud vencida." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /data-subject-requests — Registrar una solicitud", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "{{$guid}}", "description": "Un valor nuevo por intento distinto; el mismo para reintentar la misma creación." } ], "url": { "raw": "{{base}}/api/v1/data-subject-requests", "host": [ "{{base}}" ], "path": [ "api", "v1", "data-subject-requests" ], "query": [] }, "description": "Para cargar la que llegó por otro canal —un correo, una carta, el mesón— sin perder el plazo: manda `receivedAt` con la fecha real y el reloj corre desde ahí. Cada derecho pedido abre su propio proceso.", "body": { "mode": "raw", "raw": "{\n \"rights\": [\n \"access\"\n ],\n \"subject\": null\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 201', () => pm.expect([201]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /data-subject-requests/stats — Cómo va el módulo", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/data-subject-requests/stats", "host": [ "{{base}}" ], "path": [ "api", "v1", "data-subject-requests", "stats" ], "query": [] }, "description": "Abiertas, por vencer, vencidas y resueltas en los últimos 30 días. La lista viene seudonimizada." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /data-subject-requests/{id} — Ver una solicitud", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/data-subject-requests/{{id}}", "host": [ "{{base}}" ], "path": [ "api", "v1", "data-subject-requests", "{{id}}" ], "query": [] }, "description": "Ver una solicitud" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /data-subject-requests/{id}/processes — Los derechos pedidos, uno por uno", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/data-subject-requests/{{id}}/processes", "host": [ "{{base}}" ], "path": [ "api", "v1", "data-subject-requests", "{{id}}", "processes" ], "query": [] }, "description": "Cada derecho es su propio proceso: la supresión se puede rechazar mientras el acceso se concede, y el expediente tiene que decir las dos cosas." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /data-subject-requests/{id}/acknowledge — Acusar recibo", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/data-subject-requests/{{id}}/acknowledge", "host": [ "{{base}}" ], "path": [ "api", "v1", "data-subject-requests", "{{id}}", "acknowledge" ], "query": [] }, "description": "Deja constancia de que la solicitud se recibió. Acusar dos veces responde lo mismo y no escribe: el acuse es uno solo." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /data-subject-requests/{id}/extend — Prorrogar el plazo", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/data-subject-requests/{{id}}/extend", "host": [ "{{base}}" ], "path": [ "api", "v1", "data-subject-requests", "{{id}}", "extend" ], "query": [] }, "description": "La ley admite UNA prórroga de 30 días corridos, y exige justificarla. Pedir una segunda se rechaza: el plazo no es negociable dos veces.", "body": { "mode": "raw", "raw": "{\n \"reason\": \"texto\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /data-subject-requests/{id}/assign — Asignar a una persona", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/data-subject-requests/{{id}}/assign", "host": [ "{{base}}" ], "path": [ "api", "v1", "data-subject-requests", "{{id}}", "assign" ], "query": [] }, "description": "Manda `userId: null` para dejarla sin dueño.", "body": { "mode": "raw", "raw": "{\n \"userId\": null\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 204', () => pm.expect([204]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /data-subject-requests/{id}/blocking-order — Ordenar el bloqueo provisional", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/data-subject-requests/{{id}}/blocking-order", "host": [ "{{base}}" ], "path": [ "api", "v1", "data-subject-requests", "{{id}}", "blocking-order" ], "query": [] }, "description": "El art. 8 ter: mientras se resuelve una rectificación, una supresión o una oposición, los datos se bloquean. Sólo procede con uno de esos tres derechos en trámite, y exige justificación.", "body": { "mode": "raw", "raw": "{\n \"reason\": \"texto\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /data-subject-requests/{id}/processes/{processId}/resolve — Resolver un derecho", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/data-subject-requests/{{id}}/processes/{{processId}}/resolve", "host": [ "{{base}}" ], "path": [ "api", "v1", "data-subject-requests", "{{id}}", "processes", "{{processId}}", "resolve" ], "query": [] }, "description": "Concede o rechaza UN derecho de la solicitud. Rechazar exige el motivo: el art. 11 obliga a fundar la negativa. Cuando se resuelve el último proceso abierto, la solicitud se cierra sola y queda su desenlace.", "body": { "mode": "raw", "raw": "{\n \"state\": \"granted\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /data-subject-requests/{id}/evidence — Los archivos del expediente", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/data-subject-requests/{{id}}/evidence", "host": [ "{{base}}" ], "path": [ "api", "v1", "data-subject-requests", "{{id}}", "evidence" ], "query": [] }, "description": "La cédula que aportó la persona, el poder de representación, el acta del mesón, el respaldo de la respuesta. Se listan sus fichas y su sello; el CUERPO del archivo se borra solo a los 30 días del cierre, y `purgedAt` dice cuándo se vació." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /data-subject-requests/{id}/evidence — Adjuntar un archivo al expediente", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "{{$guid}}", "description": "Un valor nuevo por intento distinto; el mismo para reintentar la misma creación." } ], "url": { "raw": "{{base}}/api/v1/data-subject-requests/{{id}}/evidence", "host": [ "{{base}}" ], "path": [ "api", "v1", "data-subject-requests", "{{id}}", "evidence" ], "query": [] }, "description": "Sube el acta del mesón o el respaldo de la respuesta. Idempotente por contenido: el mismo archivo dos veces devuelve la ficha que ya estaba, y no ensucia el sello del expediente. El nombre del archivo no se guarda: sólo la etiqueta y el sha256 del contenido. El cuerpo se borra solo a los 30 días del cierre.", "body": { "mode": "raw", "raw": "{\n \"label\": \"response_attachment\",\n \"content\": \"texto\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 201', () => pm.expect([201]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /data-subject-requests/{id}/evidence/{evidenceId} — Descargar un archivo del expediente", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/data-subject-requests/{{id}}/evidence/{{evidenceId}}", "host": [ "{{base}}" ], "path": [ "api", "v1", "data-subject-requests", "{{id}}", "evidence", "{{evidenceId}}" ], "query": [] }, "description": "El cuerpo del archivo, con su tipo real. Un archivo ya purgado responde 404: la ficha se queda en la lista, el cuerpo no." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /dpo-inquiries — Las consultas al delegado", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/dpo-inquiries", "host": [ "{{base}}" ], "path": [ "api", "v1", "dpo-inquiries" ], "query": [] }, "description": "Las consultas al delegado" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /dpo-inquiries/{id}/answer — Responder una consulta al delegado", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/dpo-inquiries/{{id}}/answer", "host": [ "{{base}}" ], "path": [ "api", "v1", "dpo-inquiries", "{{id}}", "answer" ], "query": [] }, "description": "La respuesta se registra y, si el correo de la persona no se purgó todavía, sale por correo con la marca de la empresa. `emailed` dice si salió.", "body": { "mode": "raw", "raw": "{\n \"answer\": \"texto\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /rights-portal/sessions — Abrir el portal de derechos para una persona conocida", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "{{$guid}}", "description": "Un valor nuevo por intento distinto; el mismo para reintentar la misma creación." } ], "url": { "raw": "{{base}}/api/v1/rights-portal/sessions", "host": [ "{{base}}" ], "path": [ "api", "v1", "rights-portal", "sessions" ], "query": [] }, "description": "The authenticated mode of the rights portal: your app already verified the person, so it opens her portal session for that identifier with the level you declare, and she does not have to request a code. The portal must be turned on (ARCO rights › Settings). The session lasts what the company configured and is recorded with provider `api:`; requests opened from it inherit that level in their case file.", "body": { "mode": "raw", "raw": "{\n \"identifier\": {\n \"type\": \"phone\",\n \"value\": \"+56 9 1234 5678\"\n }\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 201', () => pm.expect([201]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] } ] }, { "name": "Documentos", "description": "Crea la política con `POST /documents`, edita (cada edición sella una versión), aprueba la versión y publícala con las letras del art. 14 ter que cubre. `effective-at` contesta qué versión regía en una fecha.", "item": [ { "name": "GET /documents/article-14-ter — Las doce letras del art. 14 ter", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/documents/article-14-ter", "host": [ "{{base}}" ], "path": [ "api", "v1", "documents", "article-14-ter" ], "query": [] }, "description": "Lo que la ley obliga a decir en una política de privacidad, letra por letra, con qué módulo contesta cada una. Verificado contra el Diario Oficial N° 44.023 del 13-12-2024." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /documents — Listar los documentos", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/documents", "host": [ "{{base}}" ], "path": [ "api", "v1", "documents" ], "query": [ { "key": "limit", "value": "50", "disabled": true, "description": "" }, { "key": "cursor", "value": "eyJvZmZzZXQiOjUwfQ", "disabled": true, "description": "" }, { "key": "kind", "value": "privacy_policy", "disabled": true, "description": "" }, { "key": "includeArchived", "value": "false", "disabled": true, "description": "" } ] }, "description": "Listar los documentos" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /documents — Crear un documento", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "{{$guid}}", "description": "Un valor nuevo por intento distinto; el mismo para reintentar la misma creación." } ], "url": { "raw": "{{base}}/api/v1/documents", "host": [ "{{base}}" ], "path": [ "api", "v1", "documents" ], "query": [] }, "description": "Nace en borrador con su versión 1 sellada. La `key` es lo que las plantillas de consentimiento citan entre llaves; es estable y no se cambia.", "body": { "mode": "raw", "raw": "{\n \"key\": \"politica_privacidad\",\n \"name\": \"texto\",\n \"title\": \"texto\",\n \"text\": \"texto\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 201', () => pm.expect([201]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /documents/{id} — Ver un documento", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/documents/{{id}}", "host": [ "{{base}}" ], "path": [ "api", "v1", "documents", "{{id}}" ], "query": [] }, "description": "Ver un documento" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "PATCH /documents/{id} — Editar y sellar una versión nueva", "request": { "method": "PATCH", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/documents/{{id}}", "host": [ "{{base}}" ], "path": [ "api", "v1", "documents", "{{id}}" ], "query": [] }, "description": "Editar el texto SELLA una versión: la anterior se queda, porque puede haber estado publicada y eso es evidencia.", "body": { "mode": "raw", "raw": "{\n \"title\": \"texto\",\n \"text\": \"texto\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /documents/{id}/versions — Las versiones selladas", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/documents/{{id}}/versions", "host": [ "{{base}}" ], "path": [ "api", "v1", "documents", "{{id}}", "versions" ], "query": [] }, "description": "Las versiones selladas" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /documents/{id}/versions/{version}/approve — Aprobar una versión", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/documents/{{id}}/versions/{{version}}/approve", "host": [ "{{base}}" ], "path": [ "api", "v1", "documents", "{{id}}", "versions", "{{version}}", "approve" ], "query": [] }, "description": "Aprobar es ADOPTAR el texto. Es el paso previo y obligatorio para publicar: el art. 14 ter manda publicar lo que la empresa adoptó." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /documents/{id}/publish — Publicar una versión aprobada", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "{{$guid}}", "description": "Un valor nuevo por intento distinto; el mismo para reintentar la misma creación." } ], "url": { "raw": "{{base}}/api/v1/documents/{{id}}/publish", "host": [ "{{base}}" ], "path": [ "api", "v1", "documents", "{{id}}", "publish" ], "query": [] }, "description": "Abre el período de vigencia y cierra el anterior en el MISMO instante, para que no quede un hueco en el que ninguna versión regía. Exige que la versión esté aprobada y sellada. `coveredLetters` congela qué letras del art. 14 ter cubría al publicar.", "body": { "mode": "raw", "raw": "{\n \"version\": 1,\n \"declaredUrl\": \"https://www.acme.cl/privacidad\",\n \"coveredLetters\": [\n \"a\",\n \"b\",\n \"c\"\n ]\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 201', () => pm.expect([201]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /documents/{id}/unpublish — Despublicar", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/documents/{{id}}/unpublish", "host": [ "{{base}}" ], "path": [ "api", "v1", "documents", "{{id}}", "unpublish" ], "query": [] }, "description": "Cierra el período vigente. Lo que estuvo publicado sigue constando: despublicar no borra la historia, la cierra." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /documents/{id}/publications — Los períodos de vigencia", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/documents/{{id}}/publications", "host": [ "{{base}}" ], "path": [ "api", "v1", "documents", "{{id}}", "publications" ], "query": [] }, "description": "Cada publicación con su intervalo `[from, to)` y las letras que cubría. Es lo que responde «qué decía tu política el 3 de marzo»." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /documents/{id}/effective-at — Qué versión regía en una fecha", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/documents/{{id}}/effective-at", "host": [ "{{base}}" ], "path": [ "api", "v1", "documents", "{{id}}", "effective-at" ], "query": [ { "key": "at", "value": "2026-03-03T12:00:00Z", "disabled": false, "description": "" } ] }, "description": "Tres respuestas posibles, y `no_publication` es legítima: una fecha anterior a la primera publicación, o caída en un hueco, no tiene versión vigente. Devolver la más antigua sería afirmar sobre esa fecha algo que nadie publicó." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /documents/{id}/coverage — Qué letras del art. 14 ter cubre hoy", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/documents/{{id}}/coverage", "host": [ "{{base}}" ], "path": [ "api", "v1", "documents", "{{id}}", "coverage" ], "query": [] }, "description": "Según su publicación vigente. Sin publicación vigente no hay cobertura que declarar: la respuesta lo dice en vez de inventar un número." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] } ] }, { "name": "EIPD", "description": "Apila una plantilla, abre la evaluación sobre tratamientos del RAT (el disparador del inc. 2 se congela), completa las cinco piezas, registra riesgos, decide sobre consultar a la Agencia y aprueba, que sella. Y la evaluación de riesgo por tratamiento: la matriz de la organización, el mapa, cada evaluación con sus factores y su sello, y la exportación para el modelo de prevención.", "item": [ { "name": "GET /dpias/triggers — Los cuatro supuestos del art. 15 ter inc. 2", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/dpias/triggers", "host": [ "{{base}}" ], "path": [ "api", "v1", "dpias", "triggers" ], "query": [] }, "description": "Los cuatro supuestos del art. 15 ter inc. 2" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /dpias/template — La plantilla de evaluación", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/dpias/template", "host": [ "{{base}}" ], "path": [ "api", "v1", "dpias", "template" ], "query": [] }, "description": "Las plantillas se apilan y nunca se editan: cuando la Agencia publique sus orientaciones se apila una con `agency_guidance`, y las evaluaciones ya selladas conservan la suya. `current` es `null` si nunca se cargó: no se cae a una por defecto invisible." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "PUT /dpias/template — Apilar una plantilla", "request": { "method": "PUT", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/dpias/template", "host": [ "{{base}}" ], "path": [ "api", "v1", "dpias", "template" ], "query": [] }, "description": "Apilar una plantilla", "body": { "mode": "raw", "raw": "{\n \"effectiveFrom\": \"2026-01-01\",\n \"note\": \"texto\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 201', () => pm.expect([201]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /dpias — Listar las evaluaciones", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/dpias", "host": [ "{{base}}" ], "path": [ "api", "v1", "dpias" ], "query": [ { "key": "limit", "value": "50", "disabled": true, "description": "" }, { "key": "cursor", "value": "eyJvZmZzZXQiOjUwfQ", "disabled": true, "description": "" }, { "key": "state", "value": "draft", "disabled": true, "description": "" } ] }, "description": "Listar las evaluaciones" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /dpias — Abrir una evaluación", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "{{$guid}}", "description": "Un valor nuevo por intento distinto; el mismo para reintentar la misma creación." } ], "url": { "raw": "{{base}}/api/v1/dpias", "host": [ "{{base}}" ], "path": [ "api", "v1", "dpias" ], "query": [] }, "description": "Sobre uno o más tratamientos del RAT. El disparador del inc. 2 se deriva del registro y se CONGELA; la descripción de operaciones y la finalidad nacen del RAT. `significantLegalEffects` es lo único que el RAT no puede contestar: si lo omites, la letra a) queda sin declarar y la exigencia dirá `cannot_tell` cuando corresponda.", "body": { "mode": "raw", "raw": "{\n \"name\": \"texto\",\n \"activityIds\": [\n \"pa_0104f9ae5df240be8a3a57c1d2e3f4a5\"\n ]\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 201', () => pm.expect([201]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /dpias/{id} — Ver una evaluación", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/dpias/{{id}}", "host": [ "{{base}}" ], "path": [ "api", "v1", "dpias", "{{id}}" ], "query": [] }, "description": "Ver una evaluación" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "PATCH /dpias/{id} — Editar el contenido y la decisión del inc. 1", "request": { "method": "PATCH", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/dpias/{{id}}", "host": [ "{{base}}" ], "path": [ "api", "v1", "dpias", "{{id}}" ], "query": [] }, "description": "Las cinco piezas del inc. 3 y la decisión del inc. 1 con su razón. La razón es obligatoria en las dos salidas: la positiva también hay que poder fecharla, porque es lo que prueba que la evaluación fue previa. Una evaluación aprobada no se edita.", "body": { "mode": "raw", "raw": "{}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /dpias/{id}/trigger — Recalcular el disparador desde el RAT", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/dpias/{{id}}/trigger", "host": [ "{{base}}" ], "path": [ "api", "v1", "dpias", "{{id}}", "trigger" ], "query": [] }, "description": "Vuelve a leer los tratamientos y congela el resultado de nuevo. El adjetivo «significativos» de la letra a) lo contesta una persona.", "body": { "mode": "raw", "raw": "{\n \"significantLegalEffects\": \"unknown\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /dpias/{id}/risks — Los riesgos identificados", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/dpias/{{id}}/risks", "host": [ "{{base}}" ], "path": [ "api", "v1", "dpias", "{{id}}", "risks" ], "query": [] }, "description": "Sin puntaje: `summary` cuenta por residual, y `highResidual` mira SÓLO el residual. Un riesgo muy probable y muy grave que la persona declaró aceptado no enciende nada." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /dpias/{id}/risks — Agregar un riesgo", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "{{$guid}}", "description": "Un valor nuevo por intento distinto; el mismo para reintentar la misma creación." } ], "url": { "raw": "{{base}}/api/v1/dpias/{{id}}/risks", "host": [ "{{base}}" ], "path": [ "api", "v1", "dpias", "{{id}}", "risks" ], "query": [] }, "description": "Agregar un riesgo", "body": { "mode": "raw", "raw": "{\n \"description\": \"texto\",\n \"affectedRight\": \"texto\",\n \"probability\": \"remote\",\n \"gravity\": \"limited\",\n \"residual\": \"accepted\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 201', () => pm.expect([201]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "PATCH /dpias/{id}/risks/{riskId} — Editar un riesgo", "request": { "method": "PATCH", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/dpias/{{id}}/risks/{{riskId}}", "host": [ "{{base}}" ], "path": [ "api", "v1", "dpias", "{{id}}", "risks", "{{riskId}}" ], "query": [] }, "description": "Editar un riesgo", "body": { "mode": "raw", "raw": "{\n \"description\": \"texto\",\n \"affectedRight\": \"texto\",\n \"probability\": \"remote\",\n \"gravity\": \"limited\",\n \"residual\": \"accepted\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "DELETE /dpias/{id}/risks/{riskId} — Quitar un riesgo", "request": { "method": "DELETE", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/dpias/{{id}}/risks/{{riskId}}", "host": [ "{{base}}" ], "path": [ "api", "v1", "dpias", "{{id}}", "risks", "{{riskId}}" ], "query": [] }, "description": "Quitar un riesgo" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /dpias/{id}/consultation — Las decisiones sobre consultar a la Agencia", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/dpias/{{id}}/consultation", "host": [ "{{base}}" ], "path": [ "api", "v1", "dpias", "{{id}}", "consultation" ], "query": [] }, "description": "Art. 15 ter inc. final: consultar es una FACULTAD para obtener recomendaciones, no una autorización que esperar. Se apilan las dos decisiones con su razón; la que habrá que defender es la de no consultar." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /dpias/{id}/consultation — Registrar la decisión de consultar o no", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "{{$guid}}", "description": "Un valor nuevo por intento distinto; el mismo para reintentar la misma creación." } ], "url": { "raw": "{{base}}/api/v1/dpias/{{id}}/consultation", "host": [ "{{base}}" ], "path": [ "api", "v1", "dpias", "{{id}}", "consultation" ], "query": [] }, "description": "Se apila, nunca se edita. Congela si en ese momento había riesgo residual alto: si mañana alguien baja el residual, la decisión de ayer se sigue explicando con lo que se sabía ayer.", "body": { "mode": "raw", "raw": "{\n \"decision\": \"consult\",\n \"reason\": \"texto\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 201', () => pm.expect([201]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /dpias/{id}/approve — Aprobar y sellar", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/dpias/{{id}}/approve", "host": [ "{{base}}" ], "path": [ "api", "v1", "dpias", "{{id}}", "approve" ], "query": [] }, "description": "La única regla dura del módulo: no se aprueba una evaluación incompleta. No bloquea el RAT ni el tratamiento; bloquea el acto de declarar aprobado lo que después se exhibe ante la Agencia. Aprobar sella una versión." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /risk-matrix — La matriz de riesgo de la organización", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/risk-matrix", "host": [ "{{base}}" ], "path": [ "api", "v1", "risk-matrix" ], "query": [] }, "description": "Escala, etiquetas, umbrales y pesos vigentes. `version` 0 significa que todavía rige la matriz de referencia de Datrus (4×4, umbrales 4/8/12) sin que la organización haya sellado la suya." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "PUT /risk-matrix — Sellar una versión de la matriz", "request": { "method": "PUT", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/risk-matrix", "host": [ "{{base}}" ], "path": [ "api", "v1", "risk-matrix" ], "query": [] }, "description": "Guardar es versionar: queda una versión sellada con su sha256 y la nota. Las evaluaciones ya selladas conservan la versión con que se calcularon.", "body": { "mode": "raw", "raw": "{\n \"name\": \"texto\",\n \"scale\": 3,\n \"impactLabels\": [\n \"texto\"\n ],\n \"likelihoodLabels\": [\n \"texto\"\n ],\n \"thresholds\": {\n \"moderate\": 1,\n \"high\": 1,\n \"critical\": 1\n },\n \"note\": \"texto\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 201', () => pm.expect([201]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /risk-matrix/rules — Las reglas de sugerencia", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/risk-matrix/rules", "host": [ "{{base}}" ], "path": [ "api", "v1", "risk-matrix", "rules" ], "query": [] }, "description": "Las claves que aceptan `weights` en `PUT /risk-matrix`. Cada regla suma a un eje cuando el registro declara lo que la activa; su frase y su artículo salen en `factors` de cada evaluación." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /risk-assessments — El mapa de riesgo", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/risk-assessments", "host": [ "{{base}}" ], "path": [ "api", "v1", "risk-assessments" ], "query": [ { "key": "limit", "value": "50", "disabled": true, "description": "" }, { "key": "cursor", "value": "eyJvZmZzZXQiOjUwfQ", "disabled": true, "description": "" }, { "key": "state", "value": "not_assessed", "disabled": true, "description": "" }, { "key": "level", "value": "low", "disabled": true, "description": "" } ] }, "description": "Una fila por tratamiento vigente. En los `not_assessed`, `impact` y `likelihood` son la sugerencia de Datrus, no una decisión; sólo lo sellado vale como evaluación." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /risk-assessments — Evaluar un tratamiento", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/risk-assessments", "host": [ "{{base}}" ], "path": [ "api", "v1", "risk-assessments" ], "query": [] }, "description": "Crea o actualiza el borrador de la evaluación del tratamiento. Omite `impact` y `likelihood` para aceptar la sugerencia; si cambias uno, `reason` es obligatoria. `significantLegalEffects` sólo importa si el tratamiento toma decisiones automatizadas. Una evaluación sellada vuelve a borrador hasta el próximo sello.", "body": { "mode": "raw", "raw": "{\n \"activityId\": \"pa_0104f9ae5df240be8a3a57c1d2e3f4a5\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /risk-assessments/export — Exportar para el modelo de prevención (CSV)", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/risk-assessments/export", "host": [ "{{base}}" ], "path": [ "api", "v1", "risk-assessments", "export" ], "query": [] }, "description": "La lista de actividades con su riesgo para la letra d) del art. 49: una fila por tratamiento vigente, con nivel, recomendación, factores, razón y el sello de cada evaluación. Separador `;`." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /risk-assessments/{id} — Ver una evaluación de riesgo", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/risk-assessments/{{id}}", "host": [ "{{base}}" ], "path": [ "api", "v1", "risk-assessments", "{{id}}" ], "query": [] }, "description": "Ver una evaluación de riesgo" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /risk-assessments/{id}/seal — Sellar la evaluación", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/risk-assessments/{{id}}/seal", "host": [ "{{base}}" ], "path": [ "api", "v1", "risk-assessments", "{{id}}", "seal" ], "query": [] }, "description": "Escribe la versión append-only con su sha256 y deja el evento en la bitácora. Se verifica en la página pública con la foto sellada." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] } ] }, { "name": "Empresa", "description": "La identidad legal del responsable.", "item": [ { "name": "GET /company — La identidad de tu empresa", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/company", "host": [ "{{base}}" ], "path": [ "api", "v1", "company" ], "query": [] }, "description": "Lo que encabeza tu RAT exportado y tus documentos de privacidad." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "PATCH /company — Cambiar la identidad de tu empresa", "request": { "method": "PATCH", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/company", "host": [ "{{base}}" ], "path": [ "api", "v1", "company" ], "query": [] }, "description": "Sólo lo que mandes. No se puede cambiar por API el identificador de la empresa, los productos contratados ni el estado de los módulos: eso lo administra Datrus con tu contrato.", "body": { "mode": "raw", "raw": "{}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] } ] }, { "name": "Exportaciones", "description": "Los mismos archivos que produce la consola, confrontados contra su sello antes de entregarse.", "item": [ { "name": "GET /exports/register-snapshots/{number} — Un corte sellado del RAT, como archivo", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/exports/register-snapshots/{{number}}", "host": [ "{{base}}" ], "path": [ "api", "v1", "exports", "register-snapshots", "{{number}}" ], "query": [ { "key": "format", "value": "csv", "disabled": true, "description": "" } ] }, "description": "CSV, JSON o PDF. Confronta el sello antes de entregar: un corte cuyo contenido ya no cuadra con su hash raíz no se exporta como evidencia, y el 409 lo dice." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /exports/data-subject-requests/{id} — El expediente de una solicitud de derechos", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/exports/data-subject-requests/{{id}}", "host": [ "{{base}}" ], "path": [ "api", "v1", "exports", "data-subject-requests", "{{id}}" ], "query": [ { "key": "format", "value": "json", "disabled": true, "description": "" } ] }, "description": "PDF o JSON, confrontado contra la bitácora antes de entregar." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /exports/incidents.csv — El registro de incidentes del art. 14 sexies inc. 2, en CSV", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/exports/incidents.csv", "host": [ "{{base}}" ], "path": [ "api", "v1", "exports", "incidents.csv" ], "query": [] }, "description": "El registro de incidentes del art. 14 sexies inc. 2, en CSV" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] } ] }, { "name": "Gobernanza IA", "description": "", "item": [ { "name": "GET /ai-systems — Los sistemas de IA de la empresa", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/ai-systems", "host": [ "{{base}}" ], "path": [ "api", "v1", "ai-systems" ], "query": [] }, "description": "Los sistemas de IA de la empresa" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /ai-systems — Registrar un sistema de IA", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "{{$guid}}", "description": "Un valor nuevo por intento distinto; el mismo para reintentar la misma creación." } ], "url": { "raw": "{{base}}/api/v1/ai-systems", "host": [ "{{base}}" ], "path": [ "api", "v1", "ai-systems" ], "query": [] }, "description": "Un sistema `third_party` exige `vendorId`. `risk` distinto de `unclassified` exige `riskRationale`: la clasificación es un criterio de Datrus y la razón es lo que se muestra.", "body": { "mode": "raw", "raw": "{\n \"name\": \"texto\",\n \"type\": \"in_house\",\n \"vendorId\": \"prc_0104f9ae5df240be8a3a57c1d2e3f4a5\",\n \"ownerId\": \"usr_0104f9ae5df240be8a3a57c1d2e3f4a5\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 201', () => pm.expect([201]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /ai-systems/{id} — Ver un sistema de IA", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/ai-systems/{{id}}", "host": [ "{{base}}" ], "path": [ "api", "v1", "ai-systems", "{{id}}" ], "query": [] }, "description": "Ver un sistema de IA" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "PATCH /ai-systems/{id} — Editar un sistema de IA", "request": { "method": "PATCH", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/ai-systems/{{id}}", "host": [ "{{base}}" ], "path": [ "api", "v1", "ai-systems", "{{id}}" ], "query": [] }, "description": "Editar un sistema de IA", "body": { "mode": "raw", "raw": "{\n \"vendorId\": \"prc_0104f9ae5df240be8a3a57c1d2e3f4a5\",\n \"ownerId\": \"usr_0104f9ae5df240be8a3a57c1d2e3f4a5\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /ai-systems/{id}/state — Cambiar el estado", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/ai-systems/{{id}}/state", "host": [ "{{base}}" ], "path": [ "api", "v1", "ai-systems", "{{id}}", "state" ], "query": [] }, "description": "Cambiar el estado", "body": { "mode": "raw", "raw": "{\n \"state\": \"draft\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 204', () => pm.expect([204]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /ai-systems/{id}/assessment — La evaluación de impacto algorítmico", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/ai-systems/{{id}}/assessment", "host": [ "{{base}}" ], "path": [ "api", "v1", "ai-systems", "{{id}}", "assessment" ], "query": [] }, "description": "La evaluación de impacto algorítmico" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "PUT /ai-systems/{id}/assessment — Guardar el borrador de la evaluación", "request": { "method": "PUT", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/ai-systems/{{id}}/assessment", "host": [ "{{base}}" ], "path": [ "api", "v1", "ai-systems", "{{id}}", "assessment" ], "query": [] }, "description": "Ocho secciones (criterio de Datrus sobre la plantilla de EIPD). Aprobada, no se edita.", "body": { "mode": "raw", "raw": "{\n \"sections\": {}\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /ai-systems/{id}/assessment/approve — Aprobar y sellar la evaluación", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/ai-systems/{{id}}/assessment/approve", "host": [ "{{base}}" ], "path": [ "api", "v1", "ai-systems", "{{id}}", "assessment", "approve" ], "query": [] }, "description": "Sólo completa. Queda sellada con hash e inmutable." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /ai-systems/{id}/seal — Sellar una versión del sistema", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/ai-systems/{{id}}/seal", "host": [ "{{base}}" ], "path": [ "api", "v1", "ai-systems", "{{id}}", "seal" ], "query": [] }, "description": "Congela la ficha con su hash. Sin cambios desde la última versión no sella otra vez." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] } ] }, { "name": "Incidentes", "description": "Fija el objetivo interno de reporte una vez (`PUT /incidents/reporting-objective`). Abre el expediente con la fecha de detección, vincula el alcance, llena el registro del inc. 2, mira `/assessment`, decide en `/decisions` y deja constancia de la comunicación en `/notifications`. La API no envía nada a la Agencia.", "item": [ { "name": "GET /incidents/event-types — Los hechos del art. 14 sexies", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/incidents/event-types", "host": [ "{{base}}" ], "path": [ "api", "v1", "incidents", "event-types" ], "query": [] }, "description": "Los hechos del art. 14 sexies" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /incidents/reporting-objective — El objetivo interno de reporte", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/incidents/reporting-objective", "host": [ "{{base}}" ], "path": [ "api", "v1", "incidents", "reporting-objective" ], "query": [] }, "description": "La ley no fija horas: «sin dilaciones indebidas». El objetivo lo define la empresa, y cada cambio se apila con su vigencia y su nota. `current` es el vigente hoy; `null` si nunca se cargó." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "PUT /incidents/reporting-objective — Apilar un objetivo de reporte", "request": { "method": "PUT", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/incidents/reporting-objective", "host": [ "{{base}}" ], "path": [ "api", "v1", "incidents", "reporting-objective" ], "query": [] }, "description": "No reemplaza: apila. El día que alguien pregunte por qué el objetivo bajó a 24 horas, la `note` es la única respuesta que va a existir.", "body": { "mode": "raw", "raw": "{\n \"hours\": 72,\n \"effectiveFrom\": \"2026-01-01\",\n \"note\": \"texto\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 201', () => pm.expect([201]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /incidents — Listar los expedientes", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/incidents", "host": [ "{{base}}" ], "path": [ "api", "v1", "incidents" ], "query": [ { "key": "limit", "value": "50", "disabled": true, "description": "" }, { "key": "cursor", "value": "eyJvZmZzZXQiOjUwfQ", "disabled": true, "description": "" }, { "key": "state", "value": "open", "disabled": true, "description": "" } ] }, "description": "Listar los expedientes" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /incidents — Abrir un expediente", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "{{$guid}}", "description": "Un valor nuevo por intento distinto; el mismo para reintentar la misma creación." } ], "url": { "raw": "{{base}}/api/v1/incidents", "host": [ "{{base}}" ], "path": [ "api", "v1", "incidents" ], "query": [] }, "description": "Exige que exista un objetivo de reporte vigente: sin él no hay reloj contra el cual medir. El folio lo asigna la base.", "body": { "mode": "raw", "raw": "{\n \"title\": \"texto\",\n \"eventTypes\": [\n \"destruction\"\n ],\n \"detectedAt\": \"2026-09-13T10:00:00Z\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 201', () => pm.expect([201]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /incidents/{id} — Ver un expediente", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/incidents/{{id}}", "host": [ "{{base}}" ], "path": [ "api", "v1", "incidents", "{{id}}" ], "query": [] }, "description": "Ver un expediente" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "PATCH /incidents/{id} — Editar un expediente", "request": { "method": "PATCH", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/incidents/{{id}}", "host": [ "{{base}}" ], "path": [ "api", "v1", "incidents", "{{id}}" ], "query": [] }, "description": "Editar un expediente", "body": { "mode": "raw", "raw": "{\n \"title\": \"texto\",\n \"eventTypes\": [\n \"destruction\"\n ],\n \"detectedAt\": \"2026-09-13T10:00:00Z\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "PATCH /incidents/{id}/state — Cambiar el estado", "request": { "method": "PATCH", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/incidents/{{id}}/state", "host": [ "{{base}}" ], "path": [ "api", "v1", "incidents", "{{id}}", "state" ], "query": [] }, "description": "Cambiar el estado", "body": { "mode": "raw", "raw": "{\n \"state\": \"open\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /incidents/{id}/processing-activities — El alcance en el RAT", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/incidents/{{id}}/processing-activities", "host": [ "{{base}}" ], "path": [ "api", "v1", "incidents", "{{id}}", "processing-activities" ], "query": [] }, "description": "Los tratamientos alcanzados, y lo que de ellos se deriva: categorías de datos, si hay sensibles del art. 2 g), si hay menores de 14. Es lo que decide a quién hay que avisar." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /incidents/{id}/processing-activities — Vincular un tratamiento al alcance", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/incidents/{{id}}/processing-activities", "host": [ "{{base}}" ], "path": [ "api", "v1", "incidents", "{{id}}", "processing-activities" ], "query": [] }, "description": "Vincular un tratamiento al alcance", "body": { "mode": "raw", "raw": "{\n \"activityId\": \"pa_0104f9ae5df240be8a3a57c1d2e3f4a5\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "DELETE /incidents/{id}/processing-activities/{activityId} — Sacar un tratamiento del alcance", "request": { "method": "DELETE", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/incidents/{{id}}/processing-activities/{{activityId}}", "host": [ "{{base}}" ], "path": [ "api", "v1", "incidents", "{{id}}", "processing-activities", "{{activityId}}" ], "query": [] }, "description": "Sacar un tratamiento del alcance" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /incidents/{id}/register — El registro del art. 14 sexies inc. 2", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/incidents/{{id}}/register", "host": [ "{{base}}" ], "path": [ "api", "v1", "incidents", "{{id}}", "register" ], "query": [] }, "description": "Naturaleza, efectos, categorías, número APROXIMADO de titulares con su método, y medidas. `missing` dice qué falta. El número de titulares se completa de tres maneras y ninguna es una cifra suelta: una cifra sin método no completa." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "PUT /incidents/{id}/register — Guardar el registro del inc. 2", "request": { "method": "PUT", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/incidents/{{id}}/register", "host": [ "{{base}}" ], "path": [ "api", "v1", "incidents", "{{id}}", "register" ], "query": [] }, "description": "Guardar el registro del inc. 2", "body": { "mode": "raw", "raw": "{}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /incidents/{id}/assessment — Los hechos que mira la Agencia, sin puntaje", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/incidents/{{id}}/assessment", "host": [ "{{base}}" ], "path": [ "api", "v1", "incidents", "{{id}}", "assessment" ], "query": [ { "key": "economicObligations", "value": "false", "disabled": true, "description": "" } ] }, "description": "No hay severidad ni riesgo calculado: el «riesgo razonable» del inc. 1 no se computa. Se devuelven los factores del régimen sancionatorio con su artículo, y las causales tasadas del inc. 3 que obligan a avisar a los titulares. `economicObligations` lo declara quien pregunta: el RAT no lo sabe." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /incidents/{id}/decisions — Las decisiones tomadas", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/incidents/{{id}}/decisions", "host": [ "{{base}}" ], "path": [ "api", "v1", "incidents", "{{id}}", "decisions" ], "query": [] }, "description": "Las decisiones tomadas" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /incidents/{id}/decisions — Registrar una decisión", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "{{$guid}}", "description": "Un valor nuevo por intento distinto; el mismo para reintentar la misma creación." } ], "url": { "raw": "{{base}}/api/v1/incidents/{{id}}/decisions", "host": [ "{{base}}" ], "path": [ "api", "v1", "incidents", "{{id}}", "decisions" ], "query": [] }, "description": "Decidir es un acto humano. `do_not_notify` exige una razón de fondo de al menos veinte caracteres: es lo que el art. 14 quinquies inc. final obliga a poder acreditar, y lo que el art. 34 quáter f) mira cuando pregunta si la omisión fue deliberada. La razón no puede identificar a nadie.", "body": { "mode": "raw", "raw": "{\n \"recipient\": \"agency\",\n \"outcome\": \"notify\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 201', () => pm.expect([201]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /incidents/{id}/notifications — Las comunicaciones del expediente", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/incidents/{{id}}/notifications", "host": [ "{{base}}" ], "path": [ "api", "v1", "incidents", "{{id}}", "notifications" ], "query": [] }, "description": "Las comunicaciones del expediente" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /incidents/{id}/notifications — Crear el borrador de una comunicación", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "{{$guid}}", "description": "Un valor nuevo por intento distinto; el mismo para reintentar la misma creación." } ], "url": { "raw": "{{base}}/api/v1/incidents/{{id}}/notifications", "host": [ "{{base}}" ], "path": [ "api", "v1", "incidents", "{{id}}", "notifications" ], "query": [] }, "description": "La API no manda nada: deja constancia. `public_notice` es la salida de segunda del inc. 3 —«a cada titular afectado y, si ello no fuere posible…»— y sin `channelJustification` se rechaza: dejar pasar el diario con el campo en blanco convierte la salida de segunda en la salida cómoda.", "body": { "mode": "raw", "raw": "{\n \"recipient\": \"agency\",\n \"channel\": \"individual\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 201', () => pm.expect([201]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /incidents/{id}/notifications/{notificationId}/sent — Dejar constancia de que se envió", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/incidents/{{id}}/notifications/{{notificationId}}/sent", "host": [ "{{base}}" ], "path": [ "api", "v1", "incidents", "{{id}}", "notifications", "{{notificationId}}", "sent" ], "query": [] }, "description": "Es el acto que detiene el reloj cuando el destinatario es la Agencia.", "body": { "mode": "raw", "raw": "{\n \"sentAt\": \"2026-09-13T15:00:00Z\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /incidents/{id}/notifications/{notificationId}/acknowledgement — Anotar el acuse de recibo", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/incidents/{{id}}/notifications/{{notificationId}}/acknowledgement", "host": [ "{{base}}" ], "path": [ "api", "v1", "incidents", "{{id}}", "notifications", "{{notificationId}}", "acknowledgement" ], "query": [] }, "description": "Anotar el acuse de recibo", "body": { "mode": "raw", "raw": "{\n \"acknowledgedAt\": \"texto\",\n \"reference\": \"texto\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /incidents/{id}/seal — Sellar una versión del expediente", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/incidents/{{id}}/seal", "host": [ "{{base}}" ], "path": [ "api", "v1", "incidents", "{{id}}", "seal" ], "query": [] }, "description": "Congela el expediente con su alcance —tratamientos, categorías y sistemas— y un sello recomputable. Sin cambios desde la última versión no sella otra vez." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /incidents/{id}/seal — La última versión sellada", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/incidents/{{id}}/seal", "host": [ "{{base}}" ], "path": [ "api", "v1", "incidents", "{{id}}", "seal" ], "query": [] }, "description": "La última versión sellada" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /incidents/{id}/notifications/{notificationId}/mass-notices — Los envíos del aviso a titulares hechos desde Datrus", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/incidents/{{id}}/notifications/{{notificationId}}/mass-notices", "host": [ "{{base}}" ], "path": [ "api", "v1", "incidents", "{{id}}", "notifications", "{{notificationId}}", "mass-notices" ], "query": [] }, "description": "Los envíos del aviso a titulares hechos desde Datrus" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /incidents/{id}/notifications/{notificationId}/mass-notices — Enviar el aviso a cada titular desde Datrus", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "{{$guid}}", "description": "Un valor nuevo por intento distinto; el mismo para reintentar la misma creación." } ], "url": { "raw": "{{base}}/api/v1/incidents/{{id}}/notifications/{{notificationId}}/mass-notices", "host": [ "{{base}}" ], "path": [ "api", "v1", "incidents", "{{id}}", "notifications", "{{notificationId}}", "mass-notices" ], "query": [] }, "description": "Manda la nómina y Datrus despacha el aviso del art. 14 sexies inc. 3º correo por correo, nunca en copia. Lo que queda es la cantidad, el hash de la lista y, por persona, el correo cifrado con la llave de tu empresa hasta que se purga. Hasta 20.000 direcciones por envío; las que no tienen forma de correo vuelven en `rejected` con su posición.", "body": { "mode": "raw", "raw": "{\n \"recipients\": [\n \"ana@example.com\"\n ]\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 201', () => pm.expect([201]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "GET /incidents/{id}/public-notices — Los avisos públicos del expediente", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/incidents/{{id}}/public-notices", "host": [ "{{base}}" ], "path": [ "api", "v1", "incidents", "{{id}}", "public-notices" ], "query": [] }, "description": "Los avisos públicos del expediente" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /incidents/{id}/notifications/{notificationId}/public-notice — Publicar el aviso público con la marca de la empresa", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Idempotency-Key", "value": "{{$guid}}", "description": "Un valor nuevo por intento distinto; el mismo para reintentar la misma creación." } ], "url": { "raw": "{{base}}/api/v1/incidents/{{id}}/notifications/{{notificationId}}/public-notice", "host": [ "{{base}}" ], "path": [ "api", "v1", "incidents", "{{id}}", "notifications", "{{notificationId}}", "public-notice" ], "query": [] }, "description": "Sólo para una comunicación con `channel: public_notice` («si ello no fuere posible»). Publica los cuatro elementos tasados y el contacto en una página de Datrus con tu marca, sellada por hash." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 201', () => pm.expect([201]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "DELETE /incidents/{id}/public-notices/{publicNoticeId} — Retirar un aviso público", "request": { "method": "DELETE", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/incidents/{{id}}/public-notices/{{publicNoticeId}}", "host": [ "{{base}}" ], "path": [ "api", "v1", "incidents", "{{id}}", "public-notices", "{{publicNoticeId}}" ], "query": [] }, "description": "La página deja de servir; la fila queda con la fecha y quién lo retiró." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 204', () => pm.expect([204]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] } ] }, { "name": "Integrables", "description": "El catálogo de piezas para tu sitio y el fragmento de una línea, idéntico al de la consola.", "item": [ { "name": "GET /integrations/pieces — El catálogo de piezas integrables", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/integrations/pieces", "host": [ "{{base}}" ], "path": [ "api", "v1", "integrations", "pieces" ], "query": [] }, "description": "El catálogo de piezas integrables" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('trae X-Request-Id', () => pm.expect(pm.response.headers.get('X-Request-Id')).to.be.a('string'))", "pm.test('estado 200', () => pm.expect([200]).to.include(pm.response.code))", "if (pm.response.code >= 400) { const p = pm.response.json(); pm.test('error RFC 9457 con requestId', () => { pm.expect(p.type).to.be.a('string'); pm.expect(p.requestId).to.be.a('string') }) }" ] } } ] }, { "name": "POST /integrations/snippet — El fragmento de una línea para tu sitio", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base}}/api/v1/integrations/snippet", "host": [ "{{base}}" ], "path": [ "api", "v1", "integrations", "snippet" ], "query": [] }, "description": "Compone el `