Digital Anumati

Developer Console

End-to-end setup: generate keys, install the SDK, wire up triggers, and handle webhooks — everything needed to take an application from zero to DPDP-compliant consent capture.

Overview

DPDPA compliant

Built around the requirements of India's Digital Personal Data Protection Act.

Real-time webhooks

Consent events reach your server within milliseconds of capture.

Multi-region in India

Run different consent banners per state or region.

Each registered application gets its own site key, a secret key for server calls, and a verified widget script — visible from the application's console page along with when it was last verified.

SDK setup

Client SDKs render the consent banner in the browser; server SDKs verify consent and handle webhook delivery. The web SDK is a single script tag with no build step — it supports React, Vue, Angular, Next.js, Nuxt, and plain HTML out of the box.

<!-- Digital Anumati Consent SDK -->
<script
  async
  src="https://demo.digitalanumati.com/anumati-dpdp-consent-v1.js"
  data-site-key="APP_your-app-key"
></script>

Load it inside <head> so the widget is ready before any trigger fires.

Key	Type	Used for
Site key (data-site-key)	Public — safe in browser	Identifies the app on every widget call, enforces the origin/domain allowlist, and namespaces its cookies.
Application secret key	Server-only	Signs outgoing webhooks (HMAC-SHA256) and authorizes server-side Consent API calls. Rotating it invalidates the previous value.

Never expose the secret key client-side

Treat it like a password — sign server-to-server requests with it, keep it out of browser bundles, mobile apps, and public repos.

Trigger attribute

Attach a da-trigger attribute to any element and the widget opens the matching consent notice on click — no extra JavaScript wiring required, even inside SPAs.

<button da-trigger="b8a1da40-1a39-41d2-82a3-88d3275b14a1">
  Submit
</button>

1
Get the process ID
Open the relevant process in the admin (e.g. a Data Collection Notice) and copy its public ID from Trigger Setup.
2
Add the attribute
Paste da-trigger="<processId>" onto the element that should fire the notice — button, link, or any tag.
3
Publish, no extra wiring
The widget scans on load and rebinds via MutationObserver, so SPA re-renders and late-mounted DOM are picked up automatically.
4
Consent capture suppresses re-fires
Once a visitor decides, the widget stops intercepting that element until consent expires or is revoked.

Webhooks & postbacks

A consent event fires webhook events to your registered server URL; for the events that matter, your server calls back a postback API to confirm what it did. That round trip is what closes the DPDP audit trail.

Event	Postback required	SLA	If missed
consent.created	No	—	—
consent.withdrawn	Yes	1 hour	at_risk → breach
consent.expiry.reminder	No	—	—
consent.expired	Yes	72 hours	at_risk → breach
consent.granted	No	—	—
data.deleted	Yes	24 hours	at_risk → unconfirmed_erasure

Your webhook handler must return HTTP 200 within 10 seconds and do the actual work afterward — a slow response is treated as a failed delivery and gets retried.

app.post('/webhook', async (req, res) => {
  res.status(200).json({ received: true }); // ack first

  const event = req.body;
  const dispatchId = req.headers['x-da-dispatch-id'];
  // process asynchronously, then call the postback endpoint
});

Postback call

Confirm processing by posting back to the consent action endpoint with the dispatch ID, what you did, and a risk rating.

POST https://uat-apis.digitalanumati.com/api/v1/server/consent/action
x-secret-key: da_sk_<your-app-secret-key>

{
  "dispatchId": "<from X-DA-Dispatch-ID header>",
  "referenceId": "DA-REF-XXXXXXXX",
  "status": "processed",
  "completedAt": "2026-06-24T10:45:00.000Z",
  "risk": "none",
  "tags": ["email_stopped", "crm_updated"],
  "actions": [
    { "type": "email_unsubscribed", "result": "success" }
  ],
  "remark": "All processing stopped within SLA"
}

complianceFlag	Meaning	Triggered by
ok	Confirmed done	processed/deleted + risk none/low
at_risk	Needs attention	failed/partial, or risk medium
breach	Serious violation	risk high, or past SLA
critical	Immediate action required	risk critical
unconfirmed_erasure	DPDP violation	30+ days with no data.deleted confirmation

Never skip a postback

Even on failure, send status: "failed" with a remark explaining why — silence reads as a compliance breach.

Consent Management API

A public REST API for managing consent transactions and records on a user's behalf. Calls from a whitelisted browser origin are authenticated by CORS; server-to-server calls use the secret key via an x-secret-key header.

Base URL: https://api.digitalanumati.com/api/public/consents

Method	Path	Purpose
GET	/my-transactions	List transactions
GET	/my-transactions/:transactionId	Get one transaction
POST	/my-transactions/:transactionId/grant	Grant a transaction
POST	/my-transactions/:transactionId/revoke	Revoke a transaction
POST	/my-transactions/:transactionId/erase	Erase a transaction
POST	/my-transactions/records/:recordId/grant	Grant a single record
POST	/my-transactions/records/:recordId/revoke	Revoke a single record
POST	/my-transactions/records/:recordId/erase	Erase a single record
POST	/my-transactions/bulk/revoke	Bulk revoke consents
POST	/my-transactions/bulk/erase	Bulk erase consents
POST	/my-transactions/bulk/grant	Bulk grant consents

Embed a full consent history and self-service management portal on your own site with one div — the widget script already on the page detects it and mounts the portal automatically.

// app/consent/dashboard/page.tsx
"use client";
import { useAuth } from "@/contexts/AuthContext";

export default function ConsentDashboardPage() {
  const { user } = useAuth();
  return (
    <div id="consent-detail-root" data-reference-id={user?.referenceId ?? ""} />
  );
}

referenceId (format DA-REF-XXXXXXXX) comes back in the webhook payload the first time a user grants consent — store it against your user record.

User Consent Portal

Consent notification emails — grant requests, expiry reminders, erasure acknowledgements — include a "Manage consent" link. Point it at the hosted Digital Anumati portal, or a custom URL on your own domain using the {referenceId} template variable.

https://yourapp.com/manage/{referenceId}/consent
→ resolves to: https://yourapp.com/manage/DA-REF-647660FC/consent

DPDP compliance checklist

Every application tracks a compliance checklist across seven areas, each item marked critical, important, or recommended before the app can go live:

Consent Collection & Notice

Notice wording, purposes, and capture flow.

Webhook Security & Delivery

Signature verification and reliable delivery.

Postback Compliance (SLA)

Meeting the 1h / 24h / 72h response windows.

Data Processing Controls

Stopping and resuming processing on consent state.

Principal Rights

Access, correction, deletion, grievance handling.

Security & Key Management

Key rotation and secret handling.

Monitoring & Audit Trail

Logging every webhook and postback for evidence.

Not legal advice

This checklist is a technical integration guide. DPDP compliance also needs a published privacy notice, a nominated grievance officer, processor agreements, and board-level accountability — consult your legal team before going live with personal data from Indian residents.

Was this page helpful?