@dpdpguard/react-native 1.3.0 → 2.1.0

package/src/generated/api-types.ts

@@ -15,8 +15,7 @@ export interface paths {
         put?: never;
         /**
          * Record a new consent on behalf of a known data principal.
-         * @description Requires the `dpdp_cm_api_enabled` flag; while it is off, this route
-         *     behaves as if it doesn't exist (404). Blocks tracking/marketing/
+         * @description Blocks tracking/marketing/
          *     targeting purposes for verified minors when the organization has
          *     `disableTrackingForMinors` set (403).
          */
@@ -55,10 +54,7 @@ export interface paths {
             path?: never;
             cookie?: never;
         };
-        /**
-         * Resolve an organization by slug (public).
-         * @description Requires the `dpdp_mobile_api_enabled` flag; while it is off, this route behaves as if it doesn't exist (404).
-         */
+        /** Resolve an organization by slug (public). */
         get: operations["getOrgBySlug"];
         put?: never;
         post?: never;
@@ -131,7 +127,7 @@ export interface paths {
         };
         /**
          * Resolve org, notice, and banner styling for the no-React embeddable widget script in one round trip (public).
-         * @description Requires the `dpdp_mobile_api_enabled` flag; while it is off, this route behaves as if it doesn't exist (404). Powers the no-React embeddable widget script's single config call: given the domain-group id its script tag was generated with (`?id=`) and the embedding page's hostname (`?domain=`), resolves the organization, the notice that applies to that domain group (its own if published, else the org's default), and the domain group's banner styling. Strict domain check: a `domainGroupId` whose organization has no matching registered `domains` row for the given hostname resolves to 404, mirroring the same trust boundary as fetching a published notice.
+         * @description Powers the no-React embeddable widget script's single config call: given the domain-group id its script tag was generated with (`?id=`) and the embedding page's hostname (`?domain=`), resolves the organization, the notice that applies to that domain group (its own if published, else the org's default), and the domain group's banner styling. Strict domain check: a `domainGroupId` whose organization has no matching registered `domains` row for the given hostname resolves to 404, mirroring the same trust boundary as fetching a published notice.
          */
         get: operations["getWidgetConfig"];
         put?: never;
@@ -173,7 +169,7 @@ export interface paths {
         put?: never;
         /**
          * Government CM API Bridge — receive an inbound consent signal from a registered third-party Consent Manager.
-         * @description Requires the `dpdp_cm_inbound_signals_enabled` flag; while it is off, this route behaves as if it doesn't exist (404). Authenticated with the same org-scoped API key as `/cm/v1/consent` (never a brokered principal token) — the reverse direction of that flow: here a third-party Consent Manager pushes a signal on behalf of one of its Data Principals, rather than the fiduciary recording its own consent. MeitY's registered-CM interoperability spec isn't published yet, so every signal lands `mappingStatus: "unresolved"` unless it exactly repeats a signal already recorded, in which case it lands `"duplicate"` — CM webhooks are expected to retry, so a repeat delivery still returns 201 rather than erroring.
+         * @description Authenticated with the same org-scoped API key as `/cm/v1/consent` (never a brokered principal token) — the reverse direction of that flow: here a third-party Consent Manager pushes a signal on behalf of one of its Data Principals, rather than the fiduciary recording its own consent. MeitY's registered-CM interoperability spec isn't published yet, so every signal lands `mappingStatus: "unresolved"` unless it exactly repeats a signal already recorded, in which case it lands `"duplicate"` — CM webhooks are expected to retry, so a repeat delivery still returns 201 rather than erroring.
          *     **Known gap:** unlike every other `/api/v1` endpoint, this route's error responses use the free-text-only `Error` shape, not `ApiError` — it predates this API's error-catalog rollout to `/api/v1` and hasn't been migrated yet. Treat this as a documented inconsistency, not a schema-design choice to imitate for new endpoints.
          */
         post: operations["receiveCmSignal"];
@@ -223,6 +219,46 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v1/consents/anonymous/withdraw": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Withdraw a guest's consent for one or more purposes.
+         * @description Unauthenticated public write, authorised by possession of the client-generated `anonymousId` that recorded the consent. Rate-limited. Idempotent: purposes with no active consent are not counted. Notifies connected processors, as an authenticated withdrawal does.
+         */
+        post: operations["withdrawConsentAnonymous"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/consents/{consentId}/withdrawal-acknowledgement": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Report that a connected processor acted on a `consent.withdrawn` notification (research/2026-08-30-dpdp-research.md, §5-P1).
+         * @description `processorNotificationLogs` (see `convex/webhooks.ts`) only ever records whether the outbound `consent.withdrawn` webhook delivery reached the processor, never whether the processor actually stopped processing. A connected processor calls this endpoint to report what it did, closing the loop the same way `/api/v1/dsr/{requestId}/processor-confirmation` does for erasure requests.
+         */
+        post: operations["acknowledgeConsentWithdrawal"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/v1/dsr": {
         parameters: {
             query?: never;
@@ -319,7 +355,7 @@ export interface paths {
         };
         /**
          * List the organization's data principals past their retention window (docs/specs/crm-backend-integration-blockers.md, B1).
-         * @description Read-only: returns active (not yet cancelled/executed) `scheduledErasures` rows whose window has already elapsed, so a fiduciary's server integration can trigger its own erasure automation instead of a human watching the dpdpbot dashboard. Requires the `dpdp_retention_due_api_enabled` flag; while it is off, this route behaves as if it doesn't exist (404). Write access to retention policies and scheduled erasures stays dashboard-only (ADR-007 D3) — there is no corresponding write route.
+         * @description Read-only: returns active (not yet cancelled/executed) `scheduledErasures` rows whose window has already elapsed, so a fiduciary's server integration can trigger its own erasure automation instead of a human watching the dpdpbot dashboard. Write access to retention policies and scheduled erasures stays dashboard-only (ADR-007 D3) — there is no corresponding write route.
          */
         get: operations["listDueRetentions"];
         put?: never;
@@ -339,7 +375,7 @@ export interface paths {
         };
         /**
          * Look up an org's per-purpose consent state by email (docs/specs/ecommerce-cms-plugins.md, §4).
-         * @description Read-only: a WooCommerce/Shopify plugin's only fact about a customer is an email address from its own storefront — every other consent-reading route requires a dpdpbot-internal consent id or a brokered principal token. This resolves an email to the calling organization's own current per-purpose consent grants, so a plugin can gate a marketing sync in real time. `found: false` (not a 404) means the identifier is not yet a customer of record for this organization — distinct from "known, with no active consent", which is `found: true` and an empty or all-opted-out `purposes` array. Requires the `dpdp_consent_status_lookup_enabled` flag; while it is off, this route behaves as if it doesn't exist (404). Write access to consent stays `POST`/`DELETE /cm/v1/consent` — there is no corresponding write route here (ADR-007 D3).
+         * @description Read-only: a WooCommerce/Shopify plugin's only fact about a customer is an email address from its own storefront — every other consent-reading route requires a dpdpbot-internal consent id or a brokered principal token. This resolves an email to the calling organization's own current per-purpose consent grants, so a plugin can gate a marketing sync in real time. `found: false` (not a 404) means the identifier is not yet a customer of record for this organization — distinct from "known, with no active consent", which is `found: true` and an empty or all-opted-out `purposes` array. Write access to consent stays `POST`/`DELETE /cm/v1/consent` — there is no corresponding write route here (ADR-007 D3).
          */
         get: operations["getConsentStatus"];
         put?: never;
@@ -350,6 +386,86 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v1/dsr/{requestId}/processor-confirmation": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Report what a connected processor actually did about an erasure request (docs/specs/ecommerce-cms-plugins.md, §7).
+         * @description `dsr.completed` (§2) tells a plugin an erasure was approved on dpdpbot's side; store-side erasure is rarely total deletion (an order record may be anonymized rather than deleted for tax/accounting retention, or a downstream API call may fail). This is the inbound record of what each connected system actually did, surfaced on the DSR detail view so a DPO auditing an erasure can see more than "dpdpbot marked this complete". Additive and read-mostly from dpdpbot's perspective — it does not reopen or alter the DSR's own status.
+         */
+        post: operations["recordDsrProcessorConfirmation"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/withdrawals/{propagationId}/ack": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Confirm that a consent withdrawal took effect at this destination (research/2026-08-30-dpdp-research.md, §5-P1).
+         * @description The public half of the withdrawal-propagation acknowledgement ledger: `suppressionList` proves a withdrawal was *registered*, and this closes the loop the same way `/api/v1/dsr/{requestId}/processor-confirmation` does for erasure requests — a downstream destination reports for itself that it actually stopped processing, rather than a DPO taking dpdpbot's word for it. Idempotent: acknowledging an already-acknowledged row succeeds without changing its `acknowledgedAt`, because a retried confirmation must never fail.
+         */
+        post: operations["acknowledgeWithdrawalPropagation"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/withdrawals/{suppressionId}/propagations": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Poll "N of M systems confirmed" for a withdrawal (research/2026-08-30-dpdp-research.md, §5-P1, §6.2).
+         * @description The read-side counterpart to `/api/v1/consents/{consentId}/withdrawal-acknowledgement`: lets a connected plugin poll how many downstream destinations have confirmed a withdrawal it caused, the same way `/api/v1/suppression-list` lets it poll the suppression list itself, rather than requiring a DPO to check the console.
+         */
+        get: operations["getWithdrawalPropagationStatus"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/suppression-list": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Incrementally pull identifiers to stop marketing to (docs/specs/ecommerce-cms-plugins.md, §5).
+         * @description Read-only, cursor-by-`suppressedAt`: the reconciliation half of the webhook + poll pattern — a plugin's fallback sweep for when a `consent.withdrawn` webhook delivery failed, since delivery is at-least-once-attempted but not guaranteed. Populated whenever a withdrawing consent's principal has a known email; an anonymous/guest consent has nothing to suppress. Write access is withdrawal/erasure-triggered only — there is no manual write route.
+         */
+        get: operations["listSuppressionList"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/v1/breaches": {
         parameters: {
             query?: never;
@@ -359,7 +475,7 @@ export interface paths {
         };
         /**
          * List the organization's breach register (docs/specs/crm-backend-integration-blockers.md, B1).
-         * @description Read-only: returns the organization's breach register (s.8(6)), so a fiduciary's server integration can trigger its own containment-erasure automation off a reported breach instead of a human watching the dpdpbot dashboard. Simulated breaches from the Breach Drill Simulator are excluded. Requires the `dpdp_breach_register_api_enabled` flag; while it is off, this route behaves as if it doesn't exist (404). Write access to the breach register stays dashboard-only (ADR-007 D3) — there is no corresponding write route.
+         * @description Read-only: returns the organization's breach register (s.8(6)), so a fiduciary's server integration can trigger its own containment-erasure automation off a reported breach instead of a human watching the dpdpbot dashboard. Simulated breaches from the Breach Drill Simulator are excluded. Write access to the breach register stays dashboard-only (ADR-007 D3) — there is no corresponding write route.
          */
         get: operations["listBreaches"];
         put?: never;
@@ -370,6 +486,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v1/consent-portability/exports/{exportId}/manifest": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Read a signed consent-portability export's manifest (research/2026-09-27-dpdp-research.md, Idea P0 "you can leave with your evidence").
+         * @description The certificate, not the cargo: schema version, scope, record counters, the running SHA-256 digest folded over every exported record, and its platform HMAC signature — never the record payloads themselves (those stay on the in-console `pageExportRecords` query, unreachable from this surface). Lets a fiduciary's own server integration, or the receiving party on a change of Consent Manager (Indian Bank RFP GEM/2026/B/7823086 §1.6.1(e)), fetch a signed manifest without a human in a browser. Authenticated with the same org-scoped API key as `/api/v1/breaches`.
+         */
+        get: operations["getConsentPortabilityManifest"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/v1/consent/verify": {
         parameters: {
             query?: never;
@@ -394,13 +530,9 @@ export interface paths {
          *     calling key's org.
          *
          *     Withdrawal itself stays `DELETE /cm/v1/consent/{consentId}`'s job —
-         *     this route never mutates the consent record. It may append an
-         *     immutable decision row to the org's Consent Gate audit log when
-         *     `dpdp_consent_gate_decision_audit_enabled` is on; that log is read
-         *     from the dashboard, not from this API.
-         *
-         *     Requires the `dpdp_consent_gate_api_enabled` flag; while it is off,
-         *     this route behaves as if it doesn't exist (404).
+         *     this route never mutates the consent record. It appends an
+         *     immutable decision row to the org's Consent Gate audit log; that log
+         *     is read from the dashboard, not from this API.
          */
         post: operations["verifyConsentGate"];
         delete?: never;
@@ -429,12 +561,8 @@ export interface paths {
          *     what it was told. The log is append-only: `verifyForApiKey` is the
          *     only writer and there is no corresponding write route (ADR-007 D3).
          *
-         *     Requires the `dpdp_consent_gate_audit_api_enabled` flag; while it is
-         *     off, this route behaves as if it doesn't exist (404). That flag is
-         *     *transport* only and is not a way around
-         *     `dpdp_consent_gate_decision_audit_enabled`, which gates the
-         *     recording itself — while that flag is off nothing is written, so
-         *     this route returns an empty `decisions` array rather than an error.
+         *     Returns an empty `decisions` array rather than an error when nothing
+         *     has been recorded.
          */
         get: operations["listConsentGateDecisions"];
         put?: never;
@@ -469,13 +597,9 @@ export interface paths {
          *     as `/api/v1/consent/verify` (ADR-004 D2). Derived entirely from the
          *     decision log — it stores nothing of its own and mutates nothing.
          *
-         *     Requires the `dpdp_consent_gate_audit_api_enabled` flag; while it is
-         *     off, this route behaves as if it doesn't exist (404). That flag is
-         *     *transport* only and is not a way around
-         *     `dpdp_consent_gate_bypass_alerts_enabled`, which gates the detection
-         *     itself — while that flag is off this route returns an empty `alerts`
-         *     array (with `windowMs`/`denyThreshold` still populated) rather than
-         *     an error.
+         *     Returns an empty `alerts` array (with `windowMs`/`denyThreshold`
+         *     still populated) rather than an error when no bypass pattern is
+         *     detected.
          */
         get: operations["listConsentGateBypassAlerts"];
         put?: never;
@@ -495,7 +619,7 @@ export interface paths {
         };
         /**
          * List the organization's cross-border transfer register (docs/specs/crm-backend-integration-blockers.md, B1).
-         * @description Read-only: returns the organization's RoPA (`processingActivities`) entries declared as crossing borders (s.16), so a fiduciary's server integration can act on that register programmatically instead of a human reading it off the RoPA Builder dashboard. Archived activities are excluded. Requires the `dpdp_cross_border_transfers_api_enabled` flag; while it is off, this route behaves as if it doesn't exist (404). Write access to the RoPA stays dashboard-only (ADR-007 D3) — there is no corresponding write route.
+         * @description Read-only: returns the organization's RoPA (`processingActivities`) entries declared as crossing borders (s.16), so a fiduciary's server integration can act on that register programmatically instead of a human reading it off the RoPA Builder dashboard. Archived activities are excluded. Write access to the RoPA stays dashboard-only (ADR-007 D3) — there is no corresponding write route.
          */
         get: operations["listCrossBorderTransfers"];
         put?: never;
@@ -506,6 +630,30 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v1/discovery/manifest": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Ingest a column manifest for a data discovery source (research/2026-09-06-dpdp-research.md, §5-P0).
+         * @description The connector half of Data Discovery & Classification. Run a read-only `information_schema` (or equivalent) query against your own database replica, inside your own network, and POST the resulting column list here on whatever schedule you choose. The platform never holds your database credentials — nothing here is a connection string, and there is nothing for an attacker who breaches this platform to steal but a schema you can already see in the console.
+         *     Each column is classified against the India-specific personal-data taxonomy (Aadhaar, PAN, IFSC, UPI VPA, Voter ID, ABHA, guardian indicators) and reconciled against what is already on file: a column already known is re-classified in place, keeping any review recorded against it, rather than duplicated. A nightly run keeps the source inside its 90-day re-scan horizon without anyone opening a browser.
+         *     `sampleValues` is accepted only for a source whose owner has explicitly opted it in from the console. Values are matched against the patterns above and discarded inside the request; nothing stores them. Sending them for a source that has not opted in is a 400, not a silent drop.
+         *     Listing a table in `reconcileTablePaths` asserts that this manifest describes it in full: any column on file under it and absent here is marked as dropped from your schema and stops counting toward your coverage gaps (it stays readable, because an evidence bundle may already attest to it). A table named there but carrying no column in `columns` is a 400 — otherwise one mis-pasted manifest would retire an entire inventory.
+         *     Writes are narrow by design: this route can add to and reclassify one source's columns and retire columns in tables you reconcile. Creating or archiving a source, reviewing a field, and changing the sample-value opt-in all stay decisions someone makes in the console, signed in as themselves.
+         */
+        post: operations["ingestDiscoveryManifest"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/v1/offline-consent/links": {
         parameters: {
             query?: never;
@@ -517,7 +665,7 @@ export interface paths {
         put?: never;
         /**
          * Generate an offline/QR consent link (docs/specs/offline-consent-capture.md, Problem Statement gap 6 — "no integration surface").
-         * @description Creates the same `offlineConsentLinks` row the dashboard's "Offline consent link" generator does, so a fiduciary's server integration (HIS, POS terminal, CBS) can mint one without a human using the React admin page. The returned `token` resolves at `/offline-consent/{token}` on the fiduciary's own dpdpbot app origin — turn that URL into a QR code for a branch counter, agent desk, or POS terminal. Requires the `dpdp_offline_consent_link_api_enabled` flag; while it is off, this route behaves as if it doesn't exist (404). The link is only redeemable once `dpdp_offline_consent_bridge_enabled` is also on.
+         * @description Creates the same `offlineConsentLinks` row the dashboard's "Offline consent link" generator does, so a fiduciary's server integration (HIS, POS terminal, CBS) can mint one without a human using the React admin page. The returned `token` resolves at `/offline-consent/{token}` on the fiduciary's own dpdpbot app origin — turn that URL into a QR code for a branch counter, agent desk, or POS terminal.
          */
         post: operations["createOfflineConsentLink"];
         delete?: never;
@@ -539,7 +687,7 @@ export interface paths {
          * Sync a batch of offline capture sessions (docs/specs/offline-consent-capture.md 4.4).
          * @description An enrolled field device — or the HIS/CBS/POS server fronting a fleet of them — pushes queued capture sessions here when connectivity returns. Each session carries an ECDSA P-256 signature produced in the device's secure element over the canonical string defined in `conformance/audit-hash-spec.md` (Cryptographic Consent Artifact); the server recomputes that string and verifies it against the enrolled `agentDevices` public key.
          *
-         *     Every session is processed independently, so **partial success is normal**: one forged or stale session never fails the others in the batch. `clientSessionId` is the idempotency key — replaying a batch that already committed returns the original per-session results and writes nothing. A session that fails verification is *quarantined* with a reason and retained as evidence, never silently dropped and never silently accepted. Requires the `dpdp_offline_agent_capture_enabled` flag; 404s while it is off.
+         *     Every session is processed independently, so **partial success is normal**: one forged or stale session never fails the others in the batch. `clientSessionId` is the idempotency key — replaying a batch that already committed returns the original per-session results and writes nothing. A session that fails verification is *quarantined* with a reason and retained as evidence, never silently dropped and never silently accepted.
          */
         post: operations["syncOfflineCaptures"];
         delete?: never;
@@ -561,7 +709,7 @@ export interface paths {
          * Raise an asynchronous consent request from a POS terminal (docs/specs/offline-consent-capture.md 6.4).
          * @description Called by a till when a phone number is keyed in. Returns immediately with a token the receipt can render as a short link or QR code; the customer reviews the notice and confirms on their own device afterwards at `/consent/{token}`.
          *
-         *     **The response is not a consent.** No `consents` row exists until the principal affirmatively confirms — processing must not begin on the strength of a raised request. Unanswered requests expire after 72 hours into the fiduciary's DPO queue. The submitted `phone` is HMAC'd per-organization before storage and is never persisted in the clear. Requires the `dpdp_offline_async_consent_enabled` flag.
+         *     **The response is not a consent.** No `consents` row exists until the principal affirmatively confirms — processing must not begin on the strength of a raised request. Unanswered requests expire after 72 hours into the fiduciary's DPO queue. The submitted `phone` is HMAC'd per-organization before storage and is never persisted in the clear.
          */
         post: operations["createPosConsentRequest"];
         delete?: never;
@@ -583,7 +731,7 @@ export interface paths {
          * Submit the artefact of a completed IVR consent call (docs/specs/offline-consent-capture.md 6.3).
          * @description dpdpbot defines this adapter contract but does not build telephony. A partner gateway posts what a completed call produced; the **audio recording is the affirmative-action evidence**, so `audioRecordingUri` is required — a DTMF digit alone proves a key was pressed, not that a notice was read out first.
          *
-         *     A `dtmfSequence` beginning with `1` is treated as acceptance and materialises an audited `consents` row with `source: offline_ivr`; anything else records the artefact without creating a consent, so a refusal is retained as evidence rather than discarded. `partnerSignature` is stored verbatim as an assertion of origin — dpdpbot cannot verify a key it does not hold and does not claim to. Requires the `dpdp_offline_async_consent_enabled` flag.
+         *     A `dtmfSequence` beginning with `1` is treated as acceptance and materialises an audited `consents` row with `source: offline_ivr`; anything else records the artefact without creating a consent, so a refusal is retained as evidence rather than discarded. `partnerSignature` is stored verbatim as an assertion of origin — dpdpbot cannot verify a key it does not hold and does not claim to.
          */
         post: operations["recordIvrConsentArtifact"];
         delete?: never;
@@ -592,6 +740,28 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v1/offline/sms-withdraw": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * SMS/WhatsApp reply-keyword consent withdrawal (docs/specs/offline-consent-capture.md §5).
+         * @description A fiduciary points their SMS/WhatsApp gateway's inbound webhook at this URL; every inbound reply is posted here, and only ones matching a withdrawal keyword (`stop`, `unsubscribe`, `withdraw`, `revoke`, `cancel`, matched case-insensitively against the whole trimmed message) act.
+         *
+         *     Always returns `200` on a well-formed, authenticated request — including "no keyword matched" and "no receipt found for this number" — because the caller is a gateway relaying arbitrary inbound text, not a client that can act on a 4xx. `matched`/`withdrawn` in the response let an integration log the outcome without needing a status-code-as-enum.
+         */
+        post: operations["smsWhatsappWithdraw"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/v1/staff/dsr": {
         parameters: {
             query?: never;
@@ -672,10 +842,7 @@ export interface paths {
         };
         get?: never;
         put?: never;
-        /**
-         * Deny an erasure request on a documented statutory basis.
-         * @description Requires the `dpdp_dsr_statutory_denial_enabled` flag.
-         */
+        /** Deny an erasure request on a documented statutory basis. */
         post: operations["staffRejectDsrWithStatutoryBasis"];
         delete?: never;
         options?: never;
@@ -717,6 +884,86 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v1/observatory/observations": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Ingest a batch of Consent Observatory observations (docs/specs/consent-observatory-extension.md §7).
+         * @description Unauthenticated by design — requiring an account would collapse contribution rates and would force linking a browsing-derived observation to an identity. Anti-abuse (quorum before publication, outlier rejection) happens downstream of ingest, not here; rate limiting is enforced at the edge, not by this route. Every observation is processed independently, so **partial success is normal**: one malformed observation never fails the batch. `domain` is re-normalized server-side (lowercased, scheme/port/userinfo stripped, reduced toward eTLD+1) — the client's own normalization is never trusted.
+         */
+        post: operations["ingestObservatoryObservations"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/observatory/domains/{domain}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Read a domain's published Consent Observatory verdict (docs/specs/consent-observatory-extension.md §7).
+         * @description Unauthenticated public read, so the browser extension (and any third party) can show a registry grade without shipping a Convex client. Returns only a verdict whose `publicationState` is `"published"` — every other state, and any domain with no verdict at all, is a `404`, never a redacted body, so an unpublished verdict's existence is not itself observable from outside. `domain` is re-normalized server-side (lowercased, scheme/path stripped, reduced toward eTLD+1) the same way ingest normalizes it.
+         */
+        get: operations["getObservatoryDomainVerdict"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/observatory/sectors/{sector}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Download the aggregate-only sector report (docs/specs/consent-observatory-extension.md §12).
+         * @description Unauthenticated public read of a CSV: cohort size, average score, and grade distribution for one closed-enum sector, aggregated only over `publicationState: "published"` verdicts on the current rubric version — never per-domain rows ("Open data (decided, OQ 8): aggregates only"). 404s for a `sector` outside the closed enum.
+         */
+        get: operations["getObservatorySectorReport"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/observatory/contributions/{contributorHash}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /**
+         * "Delete my contributions" (docs/specs/consent-observatory-extension.md §18).
+         * @description Unauthenticated, same reasoning as ingest — the only identity available is the rotating, salted `contributorHash` itself, never a user or organization id (§9.2). Deletes every `siteObservations` row for that hash. Always responds `{ "deleted": true }`, including for a hash with no observations — deletion is idempotent, and distinguishing "nothing to delete" from "deleted" would let a caller probe whether a given hash ever contributed anything. `contributorHash` rotates monthly with the salt (§9.2), so this only reaches what the current salt epoch can still link to one installation; after rotation, the data is no longer linkable to it. Ships ungated.
+         */
+        delete: operations["deleteObservatoryContributions"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
 }
 export type webhooks = Record<string, never>;
 export interface components {
@@ -779,8 +1026,18 @@ export interface components {
             };
             /** @description Present only if the domain group has customized banner styling. */
             bannerSettings?: Record<string, never>;
-        };
-        /** @description One immutable row of the Consent Gate decision audit log, written by `POST /api/v1/consent/verify` while `dpdp_consent_gate_decision_audit_enabled` is on. */
+            /** @description Absolute URL of the org's data-principal portal, or null. */
+            portalUrl?: string | null;
+            /** @description Version of the notice being presented; the widget stores it with the visitor's decision and re-prompts when it changes. */
+            noticeVersion?: number;
+            noticeSourceLanguage?: string;
+            /** @description The grievance contact the notice must name, or null. */
+            grievanceContact?: {
+                name?: string;
+                email?: string;
+            } | null;
+        };
+        /** @description One immutable row of the Consent Gate decision audit log, written by `POST /api/v1/consent/verify`. */
         ConsentGateDecision: {
             /** @description Stable id for this decision row — usable as a de-duplication key when tailing the log. */
             decisionId: string;
@@ -936,6 +1193,59 @@ export interface components {
             /** @description Free-text message. Not yet a stable machine-readable code — see the "Known gap" note in the top-level description. */
             error: string;
         };
+        /** @description One (domain, pageType, phase) snapshot (docs/specs/consent-observatory-extension.md §2.2, §4.1). Trimmed from the spec's full shape — no `pathHash`, `fpApiCalls`, `buttonGraph`, or `discoveredLinks` yet; this endpoint ships ingest and storage only, not rubric evaluation. */
+        ObservatoryObservation: {
+            /** @description Re-normalized server-side on receipt — do not rely on this being echoed back verbatim. */
+            domain: string;
+            /** @enum {string} */
+            pageType: "home" | "listing" | "product" | "article" | "auth" | "checkout" | "account" | "form" | "policy" | "other";
+            /** @enum {string} */
+            phase: "pre_interaction" | "post_accept" | "post_reject" | "no_action";
+            /** @enum {string} */
+            source: "extension" | "probe" | "seed_crawl";
+            /** @description Epoch milliseconds. */
+            observedAt: number;
+            rulesetVersion: string;
+            /** @description Rotating, salted hash of an extension-local install id. Absent for `source: probe`. */
+            contributorHash?: string;
+            cookies?: {
+                name: string;
+                /** @enum {string} */
+                party: "first" | "third";
+                /** @enum {string} */
+                expiryClass: "session" | "lt_24h" | "lt_30d" | "lt_13mo" | "gt_13mo";
+            }[];
+            storageKeys?: string[];
+            requestHosts?: string[];
+            cmp?: string;
+            bannerFingerprint?: string;
+        };
+        /** @description A published Consent Observatory verdict (docs/specs/consent-observatory-extension.md §4.3, §7). Never includes `publicationState`, `noticeSentAt`, `claimedByOrganizationId`, or `sector` — those are internal-only fields on `siteVerdicts`; a `200` from this endpoint is only ever returned for a `"published"` row in the first place. */
+        ObservatoryDomainVerdict: {
+            domain: string;
+            rubricVersion: string;
+            /** @description 0..100, excluding advisory checks. */
+            score: number;
+            /** @enum {string} */
+            grade: "A" | "B" | "C" | "D" | "E" | "insufficient_data";
+            checkResults: {
+                checkKey: string;
+                /** @enum {string} */
+                status: "pass" | "fail" | "insufficient_data";
+                weight: number;
+                confidence: number;
+            }[];
+            /** @description Epoch milliseconds. */
+            computedAt: number;
+            /** @description Epoch milliseconds; past this the verdict is due a recompute. */
+            staleAfter: number;
+            /** @description Whether this domain itself runs dpdpbot's own consent banner (docs/specs/consent-observatory-extension.md §14, "Reciprocal loop"). Always populated, with `verified: false` when it does not; the type stays nullable for backward compatibility. */
+            reciprocalBadge?: {
+                verified?: boolean;
+                /** @description Epoch milliseconds of the most recent observation reporting dpdpbot's own CMP, or null when `verified` is false. */
+                verifiedAt?: number | null;
+            } | null;
+        };
     };
     responses: never;
     parameters: {
@@ -1000,7 +1310,7 @@ export interface operations {
                     "application/json": components["schemas"]["Error"];
                 };
             };
-            /** @description Notice not found (or belongs to a different organization), or no data principal matches the given email. Also returned for every request while the `dpdp_cm_api_enabled` flag is off. */
+            /** @description Notice not found (or belongs to a different organization), or no data principal matches the given email. */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -1059,7 +1369,7 @@ export interface operations {
                     "application/json": components["schemas"]["Error"];
                 };
             };
-            /** @description No such consent record, or it belongs to a different organization than the API key. Also returned for every request while the `dpdp_cm_api_enabled` flag is off. */
+            /** @description No such consent record, or it belongs to a different organization than the API key. */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -1109,7 +1419,7 @@ export interface operations {
                     "application/json": components["schemas"]["Error"];
                 };
             };
-            /** @description No such consent record, or it belongs to a different organization than the API key. Also returned for every request while the `dpdp_cm_api_enabled` flag is off. */
+            /** @description No such consent record, or it belongs to a different organization than the API key. */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -1149,7 +1459,7 @@ export interface operations {
                     "application/json": components["schemas"]["OrgSummary"];
                 };
             };
-            /** @description No organization matches this slug, or the flag is off. */
+            /** @description No organization matches this slug. */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -1214,7 +1524,7 @@ export interface operations {
                     "application/json": components["schemas"]["Notice"];
                 };
             };
-            /** @description No such notice, or the flag is off. */
+            /** @description No such notice. */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -1252,7 +1562,7 @@ export interface operations {
                     };
                 };
             };
-            /** @description The domain is not registered to this organization, or the flag is off. */
+            /** @description The domain is not registered to this organization. */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -1294,7 +1604,7 @@ export interface operations {
                     "application/json": components["schemas"]["ApiError"];
                 };
             };
-            /** @description No matching domain group, the domain isn't registered to that group's organization, no notice resolves, or the `dpdp_mobile_api_enabled` flag is off. */
+            /** @description No matching domain group, the domain isn't registered to that group's organization, or no notice resolves. */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -1353,15 +1663,6 @@ export interface operations {
                     "application/json": components["schemas"]["ApiError"];
                 };
             };
-            /** @description The `dpdp_mobile_api_enabled` flag is off. */
-            404: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ApiError"];
-                };
-            };
         };
     };
     receiveCmSignal: {
@@ -1413,15 +1714,6 @@ export interface operations {
                     "application/json": components["schemas"]["Error"];
                 };
             };
-            /** @description The `dpdp_cm_inbound_signals_enabled` flag is off. */
-            404: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["Error"];
-                };
-            };
         };
     };
     linkAnonymousConsent: {
@@ -1450,6 +1742,7 @@ export interface operations {
                         needsReconsent: {
                             noticeId: string;
                             purpose: string;
+                            dataTypes: string[];
                         }[];
                     };
                 };
@@ -1491,6 +1784,12 @@ export interface operations {
                     purpose: string;
                     dataTypes: string[];
                     anonymousId: string;
+                    /** @description Locale of the notice text the visitor read. */
+                    noticeLocale?: string;
+                    /** @description SHA-256 of the exact notice text presented, stored in the consent audit trail as evidence of what was shown. */
+                    noticeHash?: string;
+                    /** @description The domain group the embedded widget loaded for. Used to attribute the consent when the notice itself is org-wide (not scoped to a group); ignored when the notice is scoped, and dropped if it is not a group in this organization. */
+                    domainGroupId?: string;
                 };
             };
         };
@@ -1518,38 +1817,91 @@ export interface operations {
                     "application/json": components["schemas"]["ApiError"];
                 };
             };
-            /** @description The `dpdp_mobile_api_enabled` flag is off. */
-            404: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ApiError"];
-                };
-            };
         };
     };
-    listDsrRequestsForCurrentUser: {
+    withdrawConsentAnonymous: {
         parameters: {
             query?: never;
             header?: never;
             path?: never;
             cookie?: never;
         };
-        requestBody?: never;
-        responses: {
-            /** @description The caller's own requests. */
-            200: {
-                headers: {
-                    [name: string]: unknown;
+        requestBody: {
+            content: {
+                "application/json": {
+                    organizationId: string;
+                    anonymousId: string;
+                    purposes: string[];
+                };
+            };
+        };
+        responses: {
+            /** @description Withdrawal processed. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        requests: components["schemas"]["DsrRequest"][];
+                        withdrawn: number;
+                        purposes: string[];
+                        withdrawnAt: number;
                     };
                 };
             };
-            /** @description Missing, invalid, or expired access token. */
+            /** @description Missing/invalid fields or rate limited. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
+        };
+    };
+    acknowledgeConsentWithdrawal: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Convex document id of the `consents` row. */
+                consentId: components["parameters"]["ConsentId"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    processorName: string;
+                    /** @enum {string} */
+                    outcome: "completed" | "partial" | "failed";
+                    note?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Acknowledgement recorded. */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        ok: boolean;
+                    };
+                };
+            };
+            /** @description Missing/invalid fields, invalid consent id, or the consent has not been withdrawn. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
+            /** @description Missing or invalid API key. */
             401: {
                 headers: {
                     [name: string]: unknown;
@@ -1558,7 +1910,7 @@ export interface operations {
                     "application/json": components["schemas"]["ApiError"];
                 };
             };
-            /** @description The `dpdp_mobile_api_enabled` flag is off. */
+            /** @description The consent does not belong to the calling key's organization. */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -1569,6 +1921,37 @@ export interface operations {
             };
         };
     };
+    listDsrRequestsForCurrentUser: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The caller's own requests. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        requests: components["schemas"]["DsrRequest"][];
+                    };
+                };
+            };
+            /** @description Missing, invalid, or expired access token. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
+        };
+    };
     createDsrRequest: {
         parameters: {
             query?: never;
@@ -1616,15 +1999,6 @@ export interface operations {
                     "application/json": components["schemas"]["ApiError"];
                 };
             };
-            /** @description The `dpdp_mobile_api_enabled` flag is off. */
-            404: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ApiError"];
-                };
-            };
         };
     };
     listGrievancesForCurrentUser: {
@@ -1656,15 +2030,6 @@ export interface operations {
                     "application/json": components["schemas"]["ApiError"];
                 };
             };
-            /** @description The `dpdp_mobile_api_enabled` flag is off. */
-            404: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ApiError"];
-                };
-            };
         };
     };
     createGrievance: {
@@ -1713,15 +2078,6 @@ export interface operations {
                     "application/json": components["schemas"]["ApiError"];
                 };
             };
-            /** @description The `dpdp_mobile_api_enabled` flag is off. */
-            404: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ApiError"];
-                };
-            };
         };
     };
     getNomination: {
@@ -1751,15 +2107,6 @@ export interface operations {
                     "application/json": components["schemas"]["ApiError"];
                 };
             };
-            /** @description The `dpdp_mobile_api_enabled` flag is off. */
-            404: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ApiError"];
-                };
-            };
         };
     };
     upsertNomination: {
@@ -1805,15 +2152,6 @@ export interface operations {
                     "application/json": components["schemas"]["ApiError"];
                 };
             };
-            /** @description The `dpdp_mobile_api_enabled` flag is off. */
-            404: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ApiError"];
-                };
-            };
         };
     };
     revokeNomination: {
@@ -1845,15 +2183,6 @@ export interface operations {
                     "application/json": components["schemas"]["ApiError"];
                 };
             };
-            /** @description The `dpdp_mobile_api_enabled` flag is off. */
-            404: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ApiError"];
-                };
-            };
         };
     };
     verifyParent: {
@@ -1901,15 +2230,6 @@ export interface operations {
                     "application/json": components["schemas"]["ApiError"];
                 };
             };
-            /** @description The `dpdp_mobile_api_enabled` flag is off. */
-            404: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ApiError"];
-                };
-            };
         };
     };
     listDueRetentions: {
@@ -1948,15 +2268,6 @@ export interface operations {
                     "application/json": components["schemas"]["ApiError"];
                 };
             };
-            /** @description The `dpdp_retention_due_api_enabled` flag is off. */
-            404: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ApiError"];
-                };
-            };
         };
     };
     getConsentStatus: {
@@ -1989,6 +2300,11 @@ export interface operations {
                             status: "opt_in" | "opt_out";
                             /** @description Epoch ms this purpose was withdrawn, if any. */
                             withdrawnAt?: number;
+                            /**
+                             * @description The reserved, platform-defined purpose this org's own `purposeKey` maps to (docs/specs/ecommerce-cms-plugins.md, §6), when a DPO has set one — so a plugin written once against e.g. `dpdp_reserved.marketing` works across every dpdpbot organization instead of string-matching a per-org label. Omitted when no mapping exists.
+                             * @enum {string}
+                             */
+                            standardPurpose?: "dpdp_reserved.marketing" | "dpdp_reserved.transactional" | "dpdp_reserved.analytics";
                         }[];
                     };
                 };
@@ -2011,7 +2327,157 @@ export interface operations {
                     "application/json": components["schemas"]["ApiError"];
                 };
             };
-            /** @description The `dpdp_consent_status_lookup_enabled` flag is off. */
+        };
+    };
+    recordDsrProcessorConfirmation: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                requestId: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    processorName: string;
+                    /** @enum {string} */
+                    outcome: "completed" | "partial" | "failed";
+                    details: {
+                        system: string;
+                        action: string;
+                        note?: string;
+                    }[];
+                };
+            };
+        };
+        responses: {
+            /** @description Confirmation recorded. */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        ok: boolean;
+                    };
+                };
+            };
+            /** @description Malformed request body, or the request id does not identify an erasure request. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
+            /** @description Missing or invalid API key. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
+            /** @description The request id does not belong to the calling key's organization. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
+        };
+    };
+    acknowledgeWithdrawalPropagation: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                propagationId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Acknowledged (or already was). */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        ok: boolean;
+                    };
+                };
+            };
+            /** @description Missing or invalid API key. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
+            /** @description The propagation id does not belong to the calling key's organization. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
+        };
+    };
+    getWithdrawalPropagationStatus: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                suppressionId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The suppression's fan-out status across destinations. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        total: number;
+                        acknowledged: number;
+                        failed: number;
+                        entries: {
+                            destinationLabel: string;
+                            /** @enum {string} */
+                            status: "pending" | "acknowledged" | "overdue" | "failed";
+                            dispatchedAt: number;
+                            acknowledgedAt?: number;
+                            failedAt?: number;
+                            failureReason?: string;
+                        }[];
+                    };
+                };
+            };
+            /** @description Missing or invalid API key. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
+            /** @description The suppression entry does not belong to the calling key's organization. */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -2022,6 +2488,50 @@ export interface operations {
             };
         };
     };
+    listSuppressionList: {
+        parameters: {
+            query?: {
+                /** @description Epoch ms; only entries suppressed strictly after this are returned. Omit (or pass 0) to pull the full list. */
+                since?: number;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The calling key's organization's suppression-list entries after `since`. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        entries: {
+                            identifier: string;
+                            /** @enum {string} */
+                            identifierType: "email" | "phone";
+                            /** @enum {string} */
+                            reason: "consent_withdrawal" | "dsr_erasure" | "manual";
+                            suppressedAt: number;
+                            liftedAt?: number;
+                        }[];
+                        /** @description Pass as the next call's `since` to continue the pull; `null` means the response was not truncated. */
+                        nextCursor: number | null;
+                    };
+                };
+            };
+            /** @description Missing or invalid API key. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
+        };
+    };
     listBreaches: {
         parameters: {
             query?: never;
@@ -2063,7 +2573,54 @@ export interface operations {
                     "application/json": components["schemas"]["ApiError"];
                 };
             };
-            /** @description The `dpdp_breach_register_api_enabled` flag is off. */
+        };
+    };
+    getConsentPortabilityManifest: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                exportId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The export's signed manifest. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        exportId: string;
+                        organizationId: string;
+                        schemaVersion: string;
+                        /** @enum {string} */
+                        status: "pending" | "building" | "complete" | "failed";
+                        /** @enum {string} */
+                        reason: "consent_manager_change" | "solution_replacement" | "regulatory_portability" | "routine_drill";
+                        scopeFromMs: number;
+                        scopeToMs: number;
+                        consentRecordCount: number;
+                        runningDigest?: string;
+                        manifestSignature?: string;
+                        manifestSignatureKeyId?: string;
+                        completedAt?: number;
+                        verificationRecipe?: string;
+                    };
+                };
+            };
+            /** @description Missing or invalid API key. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
+            /** @description The export does not exist or belongs to a different organization. */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -2123,7 +2680,7 @@ export interface operations {
                     "application/json": components["schemas"]["ApiError"];
                 };
             };
-            /** @description The `dpdp_consent_gate_api_enabled` flag is off, or the consent does not exist or belongs to another organization. */
+            /** @description The consent does not exist or belongs to another organization. */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -2175,15 +2732,6 @@ export interface operations {
                     "application/json": components["schemas"]["ApiError"];
                 };
             };
-            /** @description The `dpdp_consent_gate_audit_api_enabled` flag is off. */
-            404: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ApiError"];
-                };
-            };
         };
     };
     listConsentGateBypassAlerts: {
@@ -2206,21 +2754,12 @@ export interface operations {
                         /** @description The rolling window, in milliseconds, a deny still counts toward an alert within. */
                         windowMs: number;
                         /** @description In-window denies against one consent that constitute an alert. */
-                        denyThreshold: number;
-                    };
-                };
-            };
-            /** @description Missing, invalid, or revoked API key. */
-            401: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ApiError"];
+                        denyThreshold: number;
+                    };
                 };
             };
-            /** @description The `dpdp_consent_gate_audit_api_enabled` flag is off. */
-            404: {
+            /** @description Missing, invalid, or revoked API key. */
+            401: {
                 headers: {
                     [name: string]: unknown;
                 };
@@ -2268,7 +2807,68 @@ export interface operations {
                     "application/json": components["schemas"]["ApiError"];
                 };
             };
-            /** @description The `dpdp_cross_border_transfers_api_enabled` flag is off. */
+        };
+    };
+    ingestDiscoveryManifest: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description The discovery source to ingest into, as shown in the console. Must belong to the calling key's organization and must not be archived. */
+                    sourceId: string;
+                    columns: {
+                        /** @description e.g. `public.customers`. */
+                        tablePath: string;
+                        columnName: string;
+                        /** @description The database's own type, e.g. `varchar`. */
+                        declaredType?: string;
+                        /** @description Opt-in only, and never stored. See the description above before sending these. */
+                        sampleValues?: string[];
+                    }[];
+                    /** @description Tables this manifest describes in full. Columns on file under them and absent here are retired. */
+                    reconcileTablePaths?: string[];
+                };
+            };
+        };
+        responses: {
+            /** @description What the ingestion classified, added, updated and retired. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        fieldsClassified: number;
+                        fieldsNew: number;
+                        fieldsUpdated: number;
+                        fieldsRetired: number;
+                    };
+                };
+            };
+            /** @description Malformed body, a manifest over the per-call column limit, sample values for a source that has not opted in, or a reconciled table the manifest does not describe. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
+            /** @description Missing or invalid API key. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
+            /** @description No such source for the calling key's organization. */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -2277,6 +2877,15 @@ export interface operations {
                     "application/json": components["schemas"]["ApiError"];
                 };
             };
+            /** @description The source is archived. */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
         };
     };
     createOfflineConsentLink: {
@@ -2319,7 +2928,7 @@ export interface operations {
                     "application/json": components["schemas"]["ApiError"];
                 };
             };
-            /** @description Notice not found (or belongs to a different organization). Also returned for every request while the `dpdp_offline_consent_link_api_enabled` flag is off. */
+            /** @description Notice not found (or belongs to a different organization). */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -2383,15 +2992,6 @@ export interface operations {
                     "application/json": components["schemas"]["ApiError"];
                 };
             };
-            /** @description The `dpdp_offline_agent_capture_enabled` flag is off. */
-            404: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ApiError"];
-                };
-            };
             /** @description Per-API-key rate limit exceeded. */
             429: {
                 headers: {
@@ -2454,7 +3054,7 @@ export interface operations {
                     "application/json": components["schemas"]["ApiError"];
                 };
             };
-            /** @description Notice not found, or the `dpdp_offline_async_consent_enabled` flag is off. */
+            /** @description Notice not found. */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -2518,7 +3118,7 @@ export interface operations {
                     "application/json": components["schemas"]["ApiError"];
                 };
             };
-            /** @description Notice not found, or the `dpdp_offline_async_consent_enabled` flag is off. */
+            /** @description Notice not found. */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -2538,29 +3138,39 @@ export interface operations {
             };
         };
     };
-    staffListDsrRequests: {
+    smsWhatsappWithdraw: {
         parameters: {
-            query: {
-                organizationId: string;
-            };
+            query?: never;
             header?: never;
             path?: never;
             cookie?: never;
         };
-        requestBody?: never;
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description Raw number as the gateway received it; normalised and HMAC'd per-organization before lookup. Never stored in the clear. */
+                    phone: string;
+                    /** @description The inbound reply text, verbatim. */
+                    message: string;
+                };
+            };
+        };
         responses: {
-            /** @description The organization's DSR requests. */
+            /** @description Request processed (regardless of whether a keyword matched). */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        requests: Record<string, never>[];
+                        /** @description Whether the message matched a withdrawal keyword. */
+                        matched: boolean;
+                        /** @description Whether at least one receipt for this phone number was withdrawn as a result. */
+                        withdrawn: boolean;
                     };
                 };
             };
-            /** @description Missing organizationId, or the caller isn't staff at that org. */
+            /** @description Malformed body, or the phone number contains no digits. */
             400: {
                 headers: {
                     [name: string]: unknown;
@@ -2569,7 +3179,7 @@ export interface operations {
                     "application/json": components["schemas"]["ApiError"];
                 };
             };
-            /** @description Not authenticated. */
+            /** @description Missing, invalid, or revoked API key. */
             401: {
                 headers: {
                     [name: string]: unknown;
@@ -2578,8 +3188,8 @@ export interface operations {
                     "application/json": components["schemas"]["ApiError"];
                 };
             };
-            /** @description The `dpdp_mobile_api_enabled` flag is off. */
-            404: {
+            /** @description Per-API-key rate limit exceeded. */
+            429: {
                 headers: {
                     [name: string]: unknown;
                 };
@@ -2589,10 +3199,10 @@ export interface operations {
             };
         };
     };
-    staffListStatutoryBasisSuggestions: {
+    staffListDsrRequests: {
         parameters: {
-            query?: {
-                sector?: string;
+            query: {
+                organizationId: string;
             };
             header?: never;
             path?: never;
@@ -2600,17 +3210,26 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description Suggestions (empty if the feature flag is off). */
+            /** @description The organization's DSR requests. */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        suggestions: Record<string, never>[];
+                        requests: Record<string, never>[];
                     };
                 };
             };
+            /** @description Missing organizationId, or the caller isn't staff at that org. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
             /** @description Not authenticated. */
             401: {
                 headers: {
@@ -2620,8 +3239,32 @@ export interface operations {
                     "application/json": components["schemas"]["ApiError"];
                 };
             };
-            /** @description The `dpdp_mobile_api_enabled` flag is off. */
-            404: {
+        };
+    };
+    staffListStatutoryBasisSuggestions: {
+        parameters: {
+            query?: {
+                sector?: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Suggestions. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        suggestions: Record<string, never>[];
+                    };
+                };
+            };
+            /** @description Not authenticated. */
+            401: {
                 headers: {
                     [name: string]: unknown;
                 };
@@ -2753,7 +3396,7 @@ export interface operations {
                     };
                 };
             };
-            /** @description Missing fields, flag off, wrong request type, invalid transition, or the caller isn't staff at that org. */
+            /** @description Missing fields, wrong request type, invalid transition, or the caller isn't staff at that org. */
             400: {
                 headers: {
                     [name: string]: unknown;
@@ -2813,15 +3456,6 @@ export interface operations {
                     "application/json": components["schemas"]["ApiError"];
                 };
             };
-            /** @description The `dpdp_mobile_api_enabled` flag is off. */
-            404: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ApiError"];
-                };
-            };
         };
     };
     staffRespondToGrievance: {
@@ -2874,4 +3508,151 @@ export interface operations {
             };
         };
     };
+    ingestObservatoryObservations: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    batch: components["schemas"]["ObservatoryObservation"][];
+                };
+            };
+        };
+        responses: {
+            /** @description Per-observation results. A 202 does **not** mean every observation was accepted — inspect `rejected`. */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        accepted: number;
+                        rejected: {
+                            index: number;
+                            reason: string;
+                        }[];
+                    };
+                };
+            };
+            /** @description Malformed body, missing `batch`, or an empty batch. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
+            /** @description More than 50 observations, or the body exceeds 256KB. */
+            413: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
+        };
+    };
+    getObservatoryDomainVerdict: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The domain to look up, e.g. `example.com`. */
+                domain: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The domain's published verdict. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ObservatoryDomainVerdict"];
+                };
+            };
+            /** @description No published verdict for this domain, or the `domain` path segment is missing. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
+        };
+    };
+    getObservatorySectorReport: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                sector: "ecommerce" | "bfsi" | "healthtech" | "edtech" | "travel" | "media" | "gov_adjacent";
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description CSV with header `sector,cohortSize,averageScore,grade,count` — one row per grade in the sector's distribution. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/csv": string;
+                };
+            };
+            /** @description `sector` is not a recognized sector. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
+        };
+    };
+    deleteObservatoryContributions: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The extension-local, salted contributor hash to erase. */
+                contributorHash: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Every observation for this hash has been deleted (or there were none). */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        deleted: boolean;
+                    };
+                };
+            };
+            /** @description The `contributorHash` path segment is missing or malformed. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
+        };
+    };
 }