API to record consent preferences

[seanpreston]

Add an API endpoint to:

<br/>

<br/>

{<br/>"identity": " [test@example.com](mailto:test@example.com)", # should this be hashed?<br/>"identity_type": "email",<br/> "regulation": "gdpr",<br/> "data_use": "this can validated against Fideslang until we unify Fides", # we won't support custom data uses<br/>"opt_in": "true"<br/>}

<br/>

<br/>

1. Create a ProvidedIdentity record for the identity value passed.
2. Create a corresponding Consent record.

[sanders41]

@seanpreston there is an issue here with using the verification code we discussed. Verification codes only work with email currently, but the identity_type can either be email or phone number. This type comes from ProvidedIdentity so we may only have a phone number. How do you want to handle this?

[seanpreston]

Good spot — while it's impossible to verify phone numbers with Fidesops currently that doesn't mean people can't verify the numbers themselves and add them. I believe we've not hit this with Privacy Requests yet as the only folks using them are using email only (which is configurable in the privacy centre itself). In this scenario it's reasonable to expect an auth token in order to perform the action.

My main concern with that conclusion is how big a lift it is to build in another auth method depending on payload at the same URL, I don't think we have a convention for this yet.