@dpdpguard/contract

The versioned wire contract for the DPDP Guard Consent Manager API: an OpenAPI 3.1 specification, a machine-readable error-code catalog, and the audit-hash canonicalization algorithm with golden conformance vectors.

DPDP Guard SDKs are intended to depend on this package rather than vendoring copies of these files, so that every SDK stays byte-for-byte in sync with the same wire shape instead of drifting independently.

Contents

| File | Purpose | | --- | --- | | openapi/v1.yaml | The /api/v1 OpenAPI 3.1 specification. | | conformance/error-catalog.json | The stable, machine-readable error code enum returned in API error responses. | | conformance/audit-hash-spec.md | The audit-hash canonicalization algorithm (HMAC-SHA256), described in prose. | | conformance/audit-hash-vectors.json | Golden input → output vectors for verifying an independent implementation of the audit-hash algorithm. | | conformance/capture-artifact-vectors.json | Golden vectors for the dpdpcca/2 Cryptographic Consent Artifact canonicalization an offline capture device signs over (described in audit-hash-spec.md). |

Install

npm install @dpdpguard/contract

Official server SDKs

| Language | Package | Status | | --- | --- | --- | | Node/TypeScript | @dpdpguard/server | Shipped — reference implementation. | | Python | dpdpguard-sdk (pip install dpdpguard-sdk / uv add dpdpguard-sdk, import dpdpguard) | Shipped — mirrors @dpdpguard/server method for method. | | JVM | — | Tracked in docs/specs/mobile-server-sdk.md (P1). Not shipped yet. |

Prefer these over hand-rolling a client or generating one — they're hand-maintained against this package's openapi/v1.yaml and the ADR-002 error catalog, so upgrades are a versioned dependency bump instead of a manual diff or a regeneration step.

Generating a client for an unsupported language

For a language without an official SDK above, generate a typed client directly from this package's openapi/v1.yaml with openapi-generator rather than hand-writing one against the raw spec:

npm install --no-save @dpdpguard/contract
npx @openapitools/openapi-generator-cli generate \
  -i node_modules/@dpdpguard/contract/openapi/v1.yaml \
  -g go \
  -o ./generated/dpdpguard-client-go \
  --additional-properties packageName=dpdpguard_client

Swap -g go and the output path for any other openapi-generator target language (-g java, -g csharp, …). Pin the @dpdpguard/contract version per this package's own versioning rules above — a major bump can change generated types, so regenerate deliberately, not on every install.

This, plus the official SDK table above, is the documented resolution to docs/specs/crm-backend-integration-blockers.md B4 ("no official server-side SDK or client library"): use an official SDK where one ships, and fall back to generation only where one doesn't.

Versioning

This package's version tracks the contract artifact itself, independent of the /api/v1 URL version: a major bump means a breaking change to the wire shape or error catalog, a minor bump means an additive change (new endpoint, new optional field), and a patch bump means docs/clarification only. Pin an exact version, or a caret range, rather than latest if you're generating code from this package — a major bump can change generated types.

License

Apache License, Version 2.0 — see LICENSE.