The following section describes the process of establishing a Data Privacy Protection (DPP) workflow through the API. In most cases, a Partner protects a user by checking their identity exposure, enabling continuous dark web monitoring, and submitting data broker opt-out requests on their behalf. To use the DPP services via the API, the Partner must follow the documented procedures.

Get your Secret Key

Retrieve your Secret Key from the Partner Console. Never share it or expose it client-side.

Exchange it for an Access Token

Call the Authentication endpoint with your Secret Key to obtain an Access Token.

Protect a user

Register the user’s details via Create a User.

Check identity exposure

Submit the user’s identifier to a Dark Web Scan to see where it appears in breach data.

Enable real-time monitoring

Register the user’s assets with Real-Time Dark Web Monitoring for continuous alerts.

Submit data broker opt-out

Initiate removal requests on the user’s behalf via Initiate Profile Request, then poll Get Profile Status.

​
Notes

After authenticating, you can call any of the DPP service endpoints with a valid Access Token. All data between your application and the PureWL API is encrypted in transit with TLS (HTTPS).
Your app sends each request with its Access Token. PureWL verifies the token and processes the requested operation — an exposure lookup, monitoring, or an opt-out.

​
Getting Started

To begin, you need an active PureWL Partner account with API access.

​
Get Access Token

An Access Token is a short-lived string that identifies your Partner account to the API. Every call except the token request itself must send it in the X-AccessToken header. You obtain an Access Token from the Authentication endpoint:
  1. Log in to the Partner Console.
  2. Open the Secret Key section and copy your Secret Key. Do not share it or expose it client-side.
  3. Send it in a POST request to /auth/v2/accessToken with grantType=secret — see Authentication. The response contains your Access Token, its expiry, and a Refresh Token.

​
Check Identity Exposure

Once you have your Access Token, you can check whether a user’s personal information has been compromised:
  • Quick Scan — Stats by Email and Stats by Domain return exposure counts only.
  • Dark Web Scan — look up the breach records for one identifier at a time: email, domain, phone number, username, and more. Each record names the breach it came from.
  • Use the results to inform the user and trigger remediation steps.

​
Enable Dark Web Monitoring

After assessing a user’s exposure, you can register their assets for continuous protection using the Real-Time Dark Web Monitoring endpoint. This is useful for:
  • Monitoring email addresses, phone numbers, and domains across dark web sources.
  • Receiving real-time alerts when a monitored asset is detected.
  • Tracking new exposures over time without re-scanning manually.
When an asset is registered, the service continuously watches dark web marketplaces, forums, and paste sites and notifies you via webhook the moment the asset appears.

​
Submit Data Broker Opt-Out

To proactively reduce a user’s exposure, Partners can submit removal requests on the user’s behalf via the Data Broker Opt-Out Service:
  1. Create the user with an rmd service entry carrying their personal details — see Create a User.
  2. Sign the profile’s Power of Attorney with Initiate Profile Request. This authorizes removal requests to brokers on the user’s behalf.
  3. Each broker is tracked individually until the record is removed.
  4. Poll Get Profile Status to follow progress and show results to the user.

​
Broker Statuses

Get Profile Status returns one entry per broker in brokers, each with a scanStatus and a removalStatus.
A broker does not always pass through every status, and a single user can have removals in progress at many brokers at once. Each broker’s progress array is its removal track, ready to draw as a step tracker.

​
Supported Features

The PureWL DPP API currently supports the following features:
  • User Management — Create, list, update, enable, disable, renew, and delete the users you protect.
  • Dark Web Monitoring — Look up breach records by identifier, browse the breach catalog, and enrich identities.
  • Data Broker Opt-Out Service — Scan data broker sites for a person and automate removal requests.
Further endpoints, such as webhook configuration, will be documented as they become available.

​
Next steps

Quickstart

Follow the end-to-end quickstart to make your first authenticated call.

Authentication

See the exact request/response shape for exchanging your Secret Key.

User Management overview

Learn how to create and manage the users you protect.