# DSAR

> Developer-first Data Subject Access Request engine: APIs, SDK, lifecycle, policy, and webhooks.

## Overview

- Self-hostable runtime with tenant-safe persistence and storage adapters.
- OpenAPI generated at GET /spec.json with interactive docs at GET /docs.
- Inbound channels (Resend, Slack) and outbound delivery wired through the same lifecycle.
- Auth split between machine bearer tokens and trusted-host identity projection.

## Best Starting Points

- [Getting Started](/docs/guides/getting-started.md): Stand up the runtime and walk through your first request.
- [Auth Model](/docs/architecture/auth-model.md): How machine and trusted-host identity lanes work.
- [Requests API](/docs/reference/api/requests.md): Core DSAR request lifecycle endpoints.

## Agent Guidance

Start with the getting started guide for a runnable local runtime, then use the architecture docs to understand contracts and the API reference for endpoint-level behavior.

## When to use DSAR

Use DSAR when you need to build or operate data subject rights workflows, including request intake, identity verification, data collection, delivery, appeals, retention, and audit records.

- Start with the getting started guide when you need a runnable self-hosted runtime.
- Use the API reference and the `/spec.json` exposed by your hosted DSAR runtime when you need endpoint inputs, outputs, authentication, or error contracts.
- Use the integration guides when choosing inbound channels, outbound delivery, storage, rate limiting, or authentication adapters.
- Use the architecture guides when extending the runtime, persistence layer, policy packs, or adapter contracts.
- Do not use DSAR for cookie consent or consent-banner implementation. Use [c15t](https://c15t.com/docs) for that job.

## Socials

- [Bluesky](https://bsky.app/profile/inth.com): Follow @inth.com.
- [X / Twitter](https://x.com/inth): Follow @inth.
- [Discord](https://discord.gg/CnVvE4W3U7): Join the Inth community.
- [GitHub](https://github.com/inthhq/dsar): View the DSAR repository.