Privacy

API reference descriptions are provided in English to preserve the exact published contract.

GETList standing and released legal holdslegalHolds.list
POSTPlace a legal holdlegalHolds.create
POSTRelease a legal holdlegalHolds.release
GETList privacy requestsprivacy.requests.list
POSTCreate a data-subject privacy requestprivacy.requests.create
GETGet a privacy requestprivacy.requests.retrieve
POSTLift the processing restriction a RESTRICTION request placedprivacy.requests.liftRestriction
GETGet the account retention policyprivacy.retentionPolicy.list
PUTSet the account retention policyprivacy.retentionPolicy.update
GETPreview what a retention policy would remove nowprivacy.retentionPolicy.preview.list

List standing and released legal holds

GET/v1/accounts/{AC}/legal-holds

legalHolds.listSDK operation getV1AccountsByAcLegalHolds

Required scope: legal_holds:read.Paginated

Parameters

limitinteger (1–100)query
cursorstring (max 2048 chars)query

GET /v1/accounts/{AC}/legal-holds

curl "https://api.toutye.com/v1/accounts/$TOUTYE_ACCOUNT_SID/legal-holds" \
  -H "Authorization: Bearer $TOUTYE_API_KEY" \
  -H "Toutye-Version: 2026-08-21"

Responses

Place a legal hold

POST/v1/accounts/{AC}/legal-holds

legalHolds.createSDK operation postV1AccountsByAcLegalHolds

The account's own compliance role (legal_holds:manage: OWNER, ADMIN, COMPLIANCE_MANAGER) places a hold on the account, a contact, a conversation, a campaign or a date range. While it stands, retention skips the data in scope and erasure requests that touch it are parked. Toutye staff holds need an approvalSid.

Required scope: any one of legal_holds:write, legal_holds:manage.Idempotency-Key required

Request body

caseRefstring (max 128 chars)Required
scopeobjectRequired
approvalSidstring (AP… SID)
customerVisibleboolean

POST /v1/accounts/{AC}/legal-holds

curl -X POST "https://api.toutye.com/v1/accounts/$TOUTYE_ACCOUNT_SID/legal-holds" \
  -H "Authorization: Bearer $TOUTYE_API_KEY" \
  -H "Toutye-Version: 2026-08-21" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
  "caseRef": "string",
  "scope": {}
}'

Responses

Release a legal hold

POST/v1/accounts/{AC}/legal-holds/{holdId}/release

legalHolds.releaseSDK operation postV1AccountsByAcLegalHoldsByHoldidRelease

Releasing lets retention and parked erasures remove the data again. The account's compliance role releases only holds it placed, with a step-up token for LEGAL_HOLD_RELEASE; a hold Toutye placed is released only by Toutye compliance.

Required scope: any one of legal_holds:write, legal_holds:manage.Idempotency-Key required

Parameters

holdIdstring (uuid)Required

Request body

caseRefstring (max 128 chars)Required
stepUpTokenstring (max 256 chars)

POST /v1/accounts/{AC}/legal-holds/{holdId}/release

curl -X POST "https://api.toutye.com/v1/accounts/$TOUTYE_ACCOUNT_SID/legal-holds/holdId.../release" \
  -H "Authorization: Bearer $TOUTYE_API_KEY" \
  -H "Toutye-Version: 2026-08-21" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
  "caseRef": "string"
}'

Responses

List privacy requests

GET/v1/accounts/{AC}/privacy/requests

privacy.requests.listSDK operation getV1AccountsByAcPrivacyRequests

Required scope: privacy:read.Paginated

Parameters

limitinteger (1–100)query
cursorstring (max 2048 chars)query

GET /v1/accounts/{AC}/privacy/requests

curl "https://api.toutye.com/v1/accounts/$TOUTYE_ACCOUNT_SID/privacy/requests" \
  -H "Authorization: Bearer $TOUTYE_API_KEY" \
  -H "Toutye-Version: 2026-08-21"

Responses

Create a data-subject privacy request

POST/v1/accounts/{AC}/privacy/requests

privacy.requests.createSDK operation postV1AccountsByAcPrivacyRequests

Required scope: privacy:write.Idempotency-Key required

Request body

kindenumRequired
ERASUREACCESSPORTABILITYRECTIFICATIONRESTRICTION
reasonstring (max 2000 chars)Required
stepUpTokenstring (max 256 chars)Required
subjectobjectRequired
changesobject
Show 4 child attributes
- attributesobject
- displayNamenull | string (max 128 chars)
- localenull | string (max 16 chars)
- timezonenull | string (max 64 chars)

POST /v1/accounts/{AC}/privacy/requests

curl -X POST "https://api.toutye.com/v1/accounts/$TOUTYE_ACCOUNT_SID/privacy/requests" \
  -H "Authorization: Bearer $TOUTYE_API_KEY" \
  -H "Toutye-Version: 2026-08-21" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
  "kind": "ERASURE",
  "reason": "string",
  "stepUpToken": "string",
  "subject": {}
}'

Responses

Get a privacy request

GET/v1/accounts/{AC}/privacy/requests/{DR}

privacy.requests.retrieveSDK operation getV1AccountsByAcPrivacyRequestsByDr

Required scope: privacy:read.

Parameters

DRstring (DR… SID)Required

GET /v1/accounts/{AC}/privacy/requests/{DR}

curl "https://api.toutye.com/v1/accounts/$TOUTYE_ACCOUNT_SID/privacy/requests/DR..." \
  -H "Authorization: Bearer $TOUTYE_API_KEY" \
  -H "Toutye-Version: 2026-08-21"

Responses

Lift the processing restriction a RESTRICTION request placed

POST/v1/accounts/{AC}/privacy/requests/{DR}/lift-restriction

privacy.requests.liftRestrictionSDK operation postV1AccountsByAcPrivacyRequestsByDrLiftRestriction

Required scope: privacy:write.Idempotency-Key required

Parameters

DRstring (DR… SID)Required

Request body

reasonstring (max 2000 chars)Required
stepUpTokenstring (max 256 chars)Required

POST /v1/accounts/{AC}/privacy/requests/{DR}/lift-restriction

curl -X POST "https://api.toutye.com/v1/accounts/$TOUTYE_ACCOUNT_SID/privacy/requests/DR.../lift-restriction" \
  -H "Authorization: Bearer $TOUTYE_API_KEY" \
  -H "Toutye-Version: 2026-08-21" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
  "reason": "string",
  "stepUpToken": "string"
}'

Responses

Get the account retention policy

GET/v1/accounts/{AC}/privacy/retention-policy

privacy.retentionPolicy.listSDK operation getV1AccountsByAcPrivacyRetentionPolicy

A null window means the data is kept until the customer deletes it, which is the default for an account that never set a policy.

Required scope: privacy:read.

GET /v1/accounts/{AC}/privacy/retention-policy

curl "https://api.toutye.com/v1/accounts/$TOUTYE_ACCOUNT_SID/privacy/retention-policy" \
  -H "Authorization: Bearer $TOUTYE_API_KEY" \
  -H "Toutye-Version: 2026-08-21"

Responses

Set the account retention policy

PUT/v1/accounts/{AC}/privacy/retention-policy

privacy.retentionPolicy.updateSDK operation putV1AccountsByAcPrivacyRetentionPolicy

Content is kept 30 to 3650 days and message records 1 to 120 months; null keeps them until deleted. A change that shortens either window removes data and needs a step-up token for RETENTION_POLICY_CHANGE; the response says what the retention job will remove on its next run.

Required scope: retention:write.Idempotency-Key required

Request body

messageContentDaysinteger (30–3650) | nullRequired
messageMetadataMonthsinteger (1–120) | nullRequired
analyticsMonthsinteger (1–36)
stepUpTokenstring (max 256 chars)

PUT /v1/accounts/{AC}/privacy/retention-policy

curl -X PUT "https://api.toutye.com/v1/accounts/$TOUTYE_ACCOUNT_SID/privacy/retention-policy" \
  -H "Authorization: Bearer $TOUTYE_API_KEY" \
  -H "Toutye-Version: 2026-08-21" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
  "messageContentDays": 30,
  "messageMetadataMonths": 1
}'

Responses

Preview what a retention policy would remove now

GET/v1/accounts/{AC}/privacy/retention-policy/preview

privacy.retentionPolicy.preview.listSDK operation getV1AccountsByAcPrivacyRetentionPolicyPreview

A dry run with the retention job's own windows and legal-hold rules. Nothing is changed. Omit a window to preview keeping that data until deleted.

Required scope: privacy:read.

Parameters

messageContentDaysinteger (30–3650)query
messageMetadataMonthsinteger (1–120)query

GET /v1/accounts/{AC}/privacy/retention-policy/preview

curl "https://api.toutye.com/v1/accounts/$TOUTYE_ACCOUNT_SID/privacy/retention-policy/preview" \
  -H "Authorization: Bearer $TOUTYE_API_KEY" \
  -H "Toutye-Version: 2026-08-21"

Responses