ethyca-fides 2.71.1b1__py2.py3-none-any.whl → 2.74.0rc1__py2.py3-none-any.whl

fides/api/models/messaging_template.py

@@ -58,6 +58,13 @@ DEFAULT_MESSAGING_TEMPLATES: Dict[str, Any] = {
             "body": "Your erasure request has been completed.",
         },
     },
+    MessagingActionType.MANUAL_TASK_DIGEST.value: {
+        "label": "Manual task digest",
+        "content": {
+            "subject": "Weekly DSR Summary from __ORGANIZATION_NAME__",
+            "body": "This is your weekly summary of open data subject requests tasks from __ORGANIZATION_NAME__ that require your attention. Please review the tasks in our Privacy Center to ensure timely completion.",
+        },
+    },
 }
 
 

fides/api/models/privacy_experience.py

@@ -101,6 +101,11 @@ class PrivacyExperienceConfigBase:
         nullable=True,
         default=True,
     )  # base is nullable for privacy experience config history
+    cookie_deletion_based_on_host_domain = Column(
+        Boolean,
+        nullable=True,
+        default=True,
+    )  # base is nullable for privacy experience config history
 
     disabled = Column(Boolean, nullable=False, default=True)
 
@@ -143,6 +148,9 @@ class ExperienceConfigTemplate(PrivacyExperienceConfigBase, Base):
     auto_subdomain_cookie_deletion = Column(
         Boolean, nullable=False, default=True, server_default="t"
     )  # Overrides PrivacyExperienceConfigBase to make non-nullable
+    cookie_deletion_based_on_host_domain = Column(
+        Boolean, nullable=False, default=True, server_default="t"
+    )  # Overrides PrivacyExperienceConfigBase to make non-nullable
     dismissable = Column(
         Boolean, nullable=False, default=True, server_default="t"
     )  # Overrides PrivacyExperienceConfigBase to make non-nullable
@@ -217,6 +225,9 @@ class PrivacyExperienceConfig(PrivacyExperienceConfigBase, Base):
     auto_subdomain_cookie_deletion = Column(
         Boolean, nullable=False, default=True, server_default="t"
     )  # Overrides PrivacyExperienceConfigBase to make non-nullable
+    cookie_deletion_based_on_host_domain = Column(
+        Boolean, nullable=False, default=True, server_default="t"
+    )  # Overrides PrivacyExperienceConfigBase to make non-nullable
     disabled = Column(
         Boolean, nullable=False, default=True, index=True
     )  # Overridding PrivacyExperienceConfigBase to index

fides/api/models/privacy_preference.py

@@ -44,6 +44,7 @@ class RequestOrigin(Enum):
     banner_and_modal = "banner_and_modal"
     api = "api"
     tcf_overlay = "tcf_overlay"
+    headless = "headless"
 
 
 class ConsentMethod(Enum):
@@ -58,6 +59,7 @@ class ConsentMethod(Enum):
     gpc = "gpc"
     individual_notice = "individual_notice"
     acknowledge = "acknowledge"
+    external_provider = "external_provider"
 
 
 class ServingComponent(Enum):

fides/api/models/privacy_request/duplicate_group.py

@@ -0,0 +1,84 @@
+import hashlib
+import json
+import uuid
+from typing import TYPE_CHECKING, Any
+
+from sqlalchemy import Boolean, Column, Text
+from sqlalchemy.dialects.postgresql import UUID
+from sqlalchemy.ext.declarative import declared_attr
+from sqlalchemy.orm import Session, relationship
+
+from fides.api.db.base_class import Base  # type: ignore[attr-defined]
+from fides.config.duplicate_detection_settings import DuplicateDetectionSettings
+
+if TYPE_CHECKING:
+    from fides.api.models.privacy_request.privacy_request import PrivacyRequest
+
+
+def generate_deterministic_uuid(rule_version: str, dedup_key: str) -> uuid.UUID:
+    """Overrides the base class method to generate a deterministic group id.
+
+    The actual rule version is a hash of the duplicate detection settings config,
+    using simple examples here for illustration:
+    - under rule "email", duplicate@example.com → group A,
+    - under rule "email|phone", duplicate@example.com|1234567890 → group B.
+    - ... and so on.
+
+    No collisions, no overlap.
+    """
+    # Combine the rule version and the key into a stable hash
+    hash_input = f"{rule_version}:{dedup_key}".encode("utf-8")
+    return uuid.UUID(hashlib.md5(hash_input).hexdigest())
+
+
+def generate_rule_version(config: DuplicateDetectionSettings) -> str:
+    """Generate a stable short hash for the dedup rule config."""
+    normalized = json.dumps(config.model_dump(), sort_keys=True)
+    return hashlib.sha256(normalized.encode("utf-8")).hexdigest()[:8]
+
+
+class DuplicateGroup(Base):
+    """
+    A table for storing duplicate request group information.
+    """
+
+    @declared_attr
+    def __tablename__(self) -> str:
+        return "duplicate_group"
+
+    id = Column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
+    rule_version = Column(Text, nullable=False)
+    # TODO: The is_active column is not used yet since we are defaulting to just email for
+    # duplicate detection. When we allow users to configure the duplicate detection settings,
+    # we will need to add a way to activate/deactivate duplicate groups.
+    # This should be done by getting the previous rule version and deactivating all groups with
+    # that rule version. New groups will be created with the new rule version.
+    is_active = Column(Boolean, default=True, nullable=False)
+    dedup_key = Column(Text, nullable=False)
+    privacy_requests = relationship(
+        "PrivacyRequest",
+        back_populates="duplicate_group",
+        lazy="dynamic",
+        primaryjoin="and_(DuplicateGroup.id == PrivacyRequest.duplicate_request_group_id)",
+    )
+
+    @classmethod
+    def create(
+        cls, db: Session, *, data: dict[str, Any], check_name: bool = False
+    ) -> "DuplicateGroup":
+        """Create a new duplicate group.
+        Override the base class method to generate a deterministic group id.
+        If the group already exists, update the is_active column to True and return the group.
+        """
+        group_id = generate_deterministic_uuid(data["rule_version"], data["dedup_key"])
+        # If the group already exists, update the is_active column to True and return the group
+        duplicate_group = (
+            db.query(DuplicateGroup).filter(DuplicateGroup.id == group_id).one_or_none()
+        )
+        if duplicate_group:
+            duplicate_group.update(db, data={"is_active": True})
+            return duplicate_group
+
+        # If the group does not exist, create a new one
+        data["id"] = group_id
+        return super().create(db, data=data, check_name=check_name)

fides/api/models/privacy_request/privacy_request.py

@@ -4,12 +4,12 @@ from __future__ import annotations
 
 import json
 from datetime import datetime, timedelta
-from typing import TYPE_CHECKING, Any, Dict, List, Optional, Set, Union
+from typing import TYPE_CHECKING, Any, Dict, List, Optional, Set, Tuple, Union
 
 from celery.result import AsyncResult
 from loguru import logger
 from sqlalchemy import Boolean, Column, DateTime, ForeignKey, Integer, String
-from sqlalchemy.dialects.postgresql import JSONB
+from sqlalchemy.dialects.postgresql import JSONB, UUID
 from sqlalchemy.ext.declarative import declared_attr
 from sqlalchemy.ext.mutable import MutableDict, MutableList
 from sqlalchemy.orm import Query, RelationshipProperty, Session, backref, relationship
@@ -69,6 +69,7 @@ from fides.api.models.pre_approval_webhook import (
     PreApprovalWebhook,
     PreApprovalWebhookReply,
 )
+from fides.api.models.privacy_request.duplicate_group import DuplicateGroup
 from fides.api.models.privacy_request.execution_log import (
     COMPLETED_EXECUTION_LOG_STATUSES,
     EXITED_EXECUTION_LOG_STATUSES,
@@ -224,6 +225,18 @@ class PrivacyRequest(
     source = Column(EnumColumn(PrivacyRequestSource), nullable=True)
     location = Column(String, nullable=True)
 
+    # Duplicate detection - group ID to link duplicates together
+    duplicate_request_group_id = Column(
+        UUID(as_uuid=True),
+        ForeignKey("duplicate_group.id"),
+        nullable=True,
+    )
+    duplicate_group = relationship(
+        DuplicateGroup,
+        back_populates="privacy_requests",
+        uselist=False,
+    )
+
     # A PrivacyRequest can be soft deleted, so we store when it was deleted
     deleted_at = Column(DateTime(timezone=True), nullable=True)
     # and who deleted it
@@ -369,7 +382,7 @@ class PrivacyRequest(
         return {
             "id": self.id,
             "external_id": self.external_id,
-            "status": self.status.value,
+            "status": self.status.value if self.status is not None else None,
             "requested_at": (
                 self.requested_at.isoformat() if self.requested_at else None
             ),
@@ -601,7 +614,10 @@ class PrivacyRequest(
         """Verify the identification code supplied by the user
         If verified, change the status of the request to "pending", and set the datetime the identity was verified.
         """
-        if not self.status == PrivacyRequestStatus.identity_unverified:
+        if not self.status in [
+            PrivacyRequestStatus.identity_unverified,
+            PrivacyRequestStatus.duplicate,
+        ]:
             raise IdentityVerificationException(
                 f"Invalid identity verification request. Privacy request '{self.id}' status = {self.status.value}."  # type: ignore # pylint: disable=no-member
             )
@@ -679,12 +695,29 @@ class PrivacyRequest(
                 },
             )
 
-    def get_cached_identity_data(self) -> Dict[str, Any]:
-        """Retrieves any identity data pertaining to this request from the cache"""
+    def identity_prefix_cache_and_keys(self) -> Tuple[str, FidesopsRedis, List[str]]:
+        """Returns the prefix and cache keys for the identity data for this request"""
         prefix = f"id-{self.id}-identity-*"
         cache: FidesopsRedis = get_cache()
         keys = cache.keys(prefix)
-        result = {}
+        return prefix, cache, keys
+
+    def verify_cache_for_identity_data(self) -> bool:
+        """Verifies if the identity data is cached for this request"""
+        _, _, keys = self.identity_prefix_cache_and_keys()
+        return len(keys) > 0
+
+    def get_cached_identity_data(self) -> Dict[str, Any]:
+        """Retrieves any identity data pertaining to this request from the cache"""
+        result: Dict[str, Any] = {}
+        prefix, cache, keys = self.identity_prefix_cache_and_keys()
+
+        if not keys:
+            logger.debug(f"Cache miss for request {self.id}, falling back to DB")
+            identity = self.get_persisted_identity()
+            self.cache_identity(identity)
+            keys = cache.keys(prefix)
+
         for key in keys:
             value = cache.get(key)
             if value:
@@ -702,10 +735,25 @@ class PrivacyRequest(
 
     def get_cached_custom_privacy_request_fields(self) -> Dict[str, Any]:
         """Retrieves any custom fields pertaining to this request from the cache"""
+        result: Dict[str, Any] = {}
         prefix = f"id-{self.id}-custom-privacy-request-field-*"
+
         cache: FidesopsRedis = get_cache()
         keys = cache.keys(prefix)
-        result = {}
+
+        if not keys:
+            logger.debug(f"Cache miss for request {self.id}, falling back to DB")
+            custom_privacy_request_fields = (
+                self.get_persisted_custom_privacy_request_fields()
+            )
+            self.cache_custom_privacy_request_fields(
+                {
+                    key: CustomPrivacyRequestFieldSchema(**value)
+                    for key, value in custom_privacy_request_fields.items()
+                }
+            )
+            keys = cache.keys(prefix)
+
         for key in keys:
             value = cache.get(key)
             if value:

fides/api/models/privacy_request/request_task.py

@@ -8,8 +8,9 @@ from typing import TYPE_CHECKING, List, Optional, Tuple
 from loguru import logger
 from sqlalchemy import Boolean, Column, ForeignKey, Integer, String
 from sqlalchemy.dialects.postgresql import JSONB
+from sqlalchemy.ext.declarative import declared_attr
 from sqlalchemy.ext.mutable import MutableDict, MutableList
-from sqlalchemy.orm import Query, Session, relationship
+from sqlalchemy.orm import Query, RelationshipProperty, Session, relationship
 from sqlalchemy_utils.types.encrypted.encrypted_type import (
     AesGcmEngine,
     StringEncryptedType,
@@ -183,6 +184,14 @@ class RequestTask(WorkerTask, Base):
         uselist=False,
     )
 
+    # Stores the sub-requests data for async polling tasks
+    sub_requests: "RelationshipProperty[List[RequestTaskSubRequest]]" = relationship(
+        "RequestTaskSubRequest",
+        back_populates="request_task",
+        cascade="all, delete-orphan",
+        order_by="RequestTaskSubRequest.created_at",
+    )
+
     @property
     def request_task_address(self) -> CollectionAddress:
         """Convert the collection_address into Collection Address format"""
@@ -318,3 +327,91 @@ class RequestTask(WorkerTask, Base):
             )
 
         return task_in_flight
+
+
+class RequestTaskSubRequest(Base):
+    """
+    Model for storing individual sub-request data during the execution of a request task.
+    Supports 1:N relationship - each RequestTask can have multiple sub-requests.
+    Currently used for storing request data for polling tasks.
+    """
+
+    @declared_attr
+    def __tablename__(cls) -> str:
+        """Overriding base class method to set the table name."""
+        return "request_task_sub_request"
+
+    request_task_id = Column(
+        String(255),
+        ForeignKey(
+            "requesttask.id",
+            name="request_task_sub_request_request_task_id_fkey",
+            ondelete="CASCADE",
+        ),
+        nullable=False,
+        index=True,
+    )
+
+    request_task = relationship(
+        "RequestTask",
+        back_populates="sub_requests",
+    )
+
+    # Individual sub-request data (e.g., request_id, status, result data)
+    # Additional fields for enhanced sub-request tracking
+    param_values = Column(  # An encrypted JSON String - saved as a dict
+        StringEncryptedType(
+            type_in=JSONTypeOverride,
+            key=CONFIG.security.app_encryption_key,
+            engine=AesGcmEngine,
+            padding="pkcs5",
+        ),
+        nullable=False,
+    )
+    status = Column(String, nullable=False)
+
+    # Raw data retrieved from an access request is stored here.  This contains all of the
+    # intermediate data we retrieved, needed for downstream tasks, but hasn't been filtered
+    # by data category for the end user.
+    _access_data = Column(  # An encrypted JSON String - saved as a list of Rows
+        "access_data",
+        StringEncryptedType(
+            type_in=JSONTypeOverride,
+            key=CONFIG.security.app_encryption_key,
+            engine=AesGcmEngine,
+            padding="pkcs5",
+        ),
+    )
+
+    # Use descriptors for automatic external storage handling
+    access_data = EncryptedLargeDataDescriptor(
+        field_name="access_data", empty_default=[]
+    )
+
+    # Written after an erasure is completed
+    rows_masked = Column(Integer)
+
+    def get_correlation_id(self) -> Optional[str]:
+        """Helper method to extract correlation_id from param_values."""
+        if self.param_values and "request_id" in self.param_values:
+            return self.param_values["request_id"]
+        return None
+
+    def update_status(self, db: Session, status: str) -> None:
+        """Helper method to update the status of this sub-request."""
+        self.status = status
+        self.save(db)
+
+    def cleanup_external_storage(self) -> None:
+        """Clean up all external storage files for this sub-request"""
+        # Access the descriptor from the class to call cleanup
+        RequestTaskSubRequest.access_data.cleanup(self)
+
+    def get_access_data(self) -> List[Row]:
+        """Helper to retrieve access data or default to empty list"""
+        return self.access_data or []
+
+    def delete(self, db: Session) -> None:
+        """Override delete to cleanup external storage first"""
+        self.cleanup_external_storage()
+        super().delete(db)

fides/api/models/sql_models.py

@@ -184,6 +184,9 @@ class DataCategory(Base, FidesBase):
     version_deprecated = Column(Text)
     replaced_by = Column(Text)
 
+    # LLM Classification
+    tagging_instructions = Column(Text, nullable=True)
+
     children: "RelationshipProperty[List[DataCategory]]" = relationship(
         "DataCategory",
         back_populates="parent",

fides/api/models/taxonomy.py

@@ -21,7 +21,15 @@ from fides.api.common_exceptions import ValidationError
 from fides.api.db.base_class import Base
 from fides.api.models.sql_models import FidesBase  # type: ignore[attr-defined]
 
-LEGACY_TAXONOMIES = {"data_categories", "data_uses", "data_subjects"}
+# Legacy Fideslang taxonomy keys
+LEGACY_TAXONOMY_KEYS = {
+    "data_category",
+    "data_use",
+    "data_subject",
+}
+
+# Taxonomies that are managed by Fides (legacy taxonomies and system group)
+MANAGED_TAXONOMY_KEYS = {"data_category", "data_use", "data_subject", "system_group"}
 
 
 class TargetType(str, Enum):
@@ -81,7 +89,9 @@ class Taxonomy(Base, FidesBase):
         """Create a new Taxonomy with proper handling of applies_to."""
         # Disallow creating taxonomies that represent legacy types
         fides_key = data.get("fides_key")
-        if fides_key in LEGACY_TAXONOMIES:
+        # Specifically exclude system_group to allow for creation during tests
+        # We already have unique constraints on fides_key to prevent duplicates on DB level
+        if fides_key in MANAGED_TAXONOMY_KEYS:
             raise ValidationError(
                 f"Cannot create taxonomy '{fides_key}'. This is a taxonomy managed by the system."
             )
@@ -166,7 +176,7 @@ class TaxonomyAllowedUsage(Base):
 
     target_type can be either:
     - A generic type: "system", "privacy_declaration", "taxonomy"
-    - A taxonomy key: "data_categories", "data_uses", etc.
+    - A taxonomy key: "data_category", "data_use", etc.
     """
 
     @declared_attr
@@ -193,7 +203,7 @@ class TaxonomyAllowedUsage(Base):
     )
     target_type: Column[str] = Column(
         String, primary_key=True
-    )  # Can be "system", "dataset", OR a taxonomy key like "data_categories"
+    )  # Can be "system", "dataset", OR a taxonomy key like "data_category"
 
 
 class TaxonomyElement(Base, FidesBase):

fides/api/models/v3/privacy_preferences.py

@@ -0,0 +1,85 @@
+"""SQLAlchemy model for the v3 privacy_preferences table."""
+
+from sqlalchemy import (  # type: ignore[attr-defined]
+    BigInteger,
+    Boolean,
+    Column,
+    DateTime,
+    Identity,
+    Text,
+    text,
+)
+from sqlalchemy.dialects.postgresql import JSONB
+from sqlalchemy.ext.declarative import declared_attr
+from sqlalchemy_utils.types.encrypted.encrypted_type import (
+    AesGcmEngine,
+    StringEncryptedType,
+)
+
+from fides.api.cryptography.cryptographic_util import hash_value_with_salt
+from fides.api.cryptography.identity_salt import get_identity_salt
+from fides.api.db.base_class import Base
+from fides.api.schemas.redis_cache import MultiValue
+from fides.config import CONFIG
+
+
+class PrivacyPreferences(Base):
+    """
+    Model for the v3 privacy_preferences table.
+    This is used for the v3 privacy preferences API.
+
+    This table stores privacy preference records with a partitioning scheme
+    based on the is_latest flag, splitting records into current and historic partitions.
+    """
+
+    @declared_attr
+    def __tablename__(self) -> str:
+        return "privacy_preferences"
+
+    # Override the default id column from Base (which is a String UUID)
+    # with a BigInteger identity column for this table
+    id = Column(
+        BigInteger,  # type: ignore[arg-type]
+        Identity(start=1, increment=1, always=True),
+        primary_key=True,
+    )
+
+    # Searchable/queryable data stored as JSONB
+    search_data = Column(JSONB, nullable=True)
+
+    # Full record data stored as encrypted text (contains PII)
+    record_data = Column(
+        StringEncryptedType(
+            type_in=Text(),
+            key=CONFIG.security.app_encryption_key,
+            engine=AesGcmEngine,
+            padding="pkcs5",
+        ),
+        nullable=True,
+    )
+
+    # Partition key - determines if record goes to _current or _historic partition
+    is_latest = Column(
+        Boolean, nullable=False, server_default=text("false"), primary_key=True
+    )
+
+    # Override base class timestamp columns to match migration
+    created_at = Column(
+        DateTime(timezone=True), nullable=False, server_default=text("now()")
+    )
+    updated_at = Column(DateTime(timezone=True), nullable=True)
+
+    @classmethod
+    def hash_value(
+        cls,
+        value: MultiValue,
+        encoding: str = "UTF-8",
+    ) -> str:
+        """Utility function to hash the value with a generated salt"""
+        salt = get_identity_salt()
+        value_str = str(value)
+        hashed_value = hash_value_with_salt(
+            value_str.encode(encoding),
+            salt.encode(encoding),
+        )
+        return hashed_value

fides/api/models/worker_task.py

@@ -17,6 +17,14 @@ class ExecutionLogStatus(enum.Enum):
     awaiting_processing = "paused"  # "paused" in the database to avoid a migration, but use "awaiting_processing" in the app
     retrying = "retrying"
     skipped = "skipped"
+    polling = "polling"
+
+
+# Statuses that can be resumed
+RESUMABLE_EXECUTION_LOG_STATUSES = [
+    ExecutionLogStatus.pending,
+    ExecutionLogStatus.polling,
+]
 
 
 class WorkerTask:

fides/api/schemas/application_config.py

@@ -101,6 +101,31 @@ class ConsentConfig(FidesSchema):
     model_config = ConfigDict(extra="forbid")
 
 
+class DuplicateDetectionApplicationConfig(FidesSchema):
+    """
+    API model - configuration settings for duplicate privacy request detection.
+    """
+
+    enabled: Optional[bool] = Field(
+        default=False,
+        description="Whether duplicate detection is enabled. Disabled by default.",
+    )
+
+    time_window_days: Optional[int] = Field(
+        default=365,
+        description="Time window in days for duplicate detection. Default is 1 year.",
+        ge=1,
+        le=3650,  # Max 10 years
+    )
+
+    match_identity_fields: Optional[List[str]] = Field(
+        default=["email"],
+        description="Identity field names to match on for duplicate detection (e.g., 'email', 'phone_number'). Default is email only.",
+    )
+
+    model_config = ConfigDict(extra="forbid")
+
+
 class SecurityApplicationConfig(FidesSchema):
     # only valid URLs should be set as cors_origins
     # for advanced usage of non-URLs, e.g. wildcards (`*`), the related
@@ -129,6 +154,9 @@ class ApplicationConfig(FidesSchema):
     consent: Optional[ConsentConfig] = None
     admin_ui: Optional[AdminUIConfig] = None
     privacy_center: Optional[PrivacyCenterConfig] = None
+    privacy_request_duplicate_detection: Optional[
+        DuplicateDetectionApplicationConfig
+    ] = None
 
     @model_validator(mode="before")
     @classmethod

fides/api/schemas/connection_configuration/connection_config.py

@@ -13,6 +13,7 @@ from fides.api.schemas.connection_configuration import connection_secrets_schema
 from fides.api.schemas.policy import ActionType
 from fides.api.schemas.saas.saas_config import SaaSConfigBase
 from fides.api.util.connection_type import get_connection_type_secret_schema
+from fides.api.util.masking_util import mask_sensitive_fields
 
 
 class CreateConnectionConfiguration(BaseModel):
@@ -41,36 +42,6 @@ class CreateConnectionConfigurationWithSecrets(CreateConnectionConfiguration):
     model_config = ConfigDict(from_attributes=True, extra="ignore")
 
 
-def mask_sensitive_fields(
-    connection_secrets: Dict[str, Any], secret_schema: Dict[str, Any]
-) -> Dict[str, Any]:
-    """
-    Mask sensitive fields in the given secrets based on the provided schema.
-    This function traverses the given secrets dictionary and uses the provided schema to
-    identify fields that have been marked as sensitive. The function replaces the sensitive
-    field values with a mask string ('********').
-    Args:
-        connection_secrets (Dict[str, Any]): The secrets to be masked.
-        secret_schema (Dict[str, Any]): The schema defining which fields are sensitive.
-    Returns:
-        Dict[str, Any]: The secrets dictionary with sensitive fields masked.
-    """
-    if connection_secrets is None:
-        return connection_secrets
-
-    secret_schema_properties = secret_schema["properties"]
-    new_connection_secrets = {}
-
-    for key, value in connection_secrets.items():
-        if key in secret_schema_properties:
-            if secret_schema_properties.get(key, {}).get("sensitive", False):
-                new_connection_secrets[key] = "**********"
-            else:
-                new_connection_secrets[key] = value
-
-    return new_connection_secrets
-
-
 class ConnectionConfigSecretsMixin(BaseModel):
     """
     A schema mixin to declare a connection config `secrets` attribute

fides/api/schemas/messaging/messaging.py

@@ -89,6 +89,7 @@ class MessagingActionType(str, Enum):
     PRIVACY_REQUEST_REVIEW_APPROVE = "privacy_request_review_approve"
     USER_INVITE = "user_invite"
     EXTERNAL_USER_WELCOME = "external_user_welcome"
+    MANUAL_TASK_DIGEST = "manual_task_digest"
     TEST_MESSAGE = "test_message"
 
 
@@ -101,6 +102,7 @@ CONFIGURABLE_MESSAGING_ACTION_TYPES: Tuple[str, ...] = (
     MessagingActionType.PRIVACY_REQUEST_COMPLETE_DELETION.value,
     MessagingActionType.PRIVACY_REQUEST_REVIEW_DENY.value,
     MessagingActionType.PRIVACY_REQUEST_REVIEW_APPROVE.value,
+    MessagingActionType.MANUAL_TASK_DIGEST.value,
 )
 
 
@@ -219,6 +221,18 @@ class ExternalUserWelcomeBodyParams(BaseModel):
     org_name: str
 
 
+class ManualTaskDigestBodyParams(BaseModel):
+    """Body params required to send manual task digest emails"""
+
+    vendor_contact_name: str
+    organization_name: str
+    portal_url: str
+    imminent_task_count: int
+    upcoming_task_count: int
+    total_task_count: int
+    company_logo_url: Optional[str] = None
+
+
 class FidesopsMessage(
     BaseModel,
 ):
@@ -256,6 +270,7 @@ class FidesopsMessage(
             MessagingActionType.PRIVACY_REQUEST_ERROR_NOTIFICATION: ErrorNotificationBodyParams,
             MessagingActionType.USER_INVITE: UserInviteBodyParams,
             MessagingActionType.EXTERNAL_USER_WELCOME: ExternalUserWelcomeBodyParams,
+            MessagingActionType.MANUAL_TASK_DIGEST: ManualTaskDigestBodyParams,
         }
 
         valid_body_params = valid_body_params_for_action_type.get(