Skip to content
Last updated: 2026-04-06
Reference

GraphQL Actions Reference

Dxtra exposes GraphQL actions for privacy compliance operations. Actions are mutations and queries executed through the GraphQL API at https://api.dxtra.ai/v1/graphql.

Authentication

All actions require a valid JWT token:

HTTP
Authorization: Bearer <your_jwt_token>
X-Hasura-Role: user

See Authentication for how to obtain tokens.

Data Controller & Subject Management

Generate Data Controller DID

Creates a deterministic privacy-preserving identifier for your organization. This identifier is derived from your organization's database UUID using SHA3-256 hashing.

GraphQL
mutation GenerateDataControllerDID(
  $generateDataControllerDIDInput: GenerateDataControllerDIDInput
) {
  generateDataControllerDID(
    generateDataControllerDIDInput: $generateDataControllerDIDInput
  ) {
    status
    message
    data {
      dataControllerId
      did
    }
  }
}

Timeout: This action has a 210-second timeout due to the DID generation process.

Generate Data Subject DID

Creates a privacy-preserving identifier for a data subject, derived deterministically from the data controller and data subject UUIDs.

GraphQL
mutation GenerateDataSubjectDID(
  $generateDataSubjectDIDInput: GenerateDataSubjectDIDInput
) {
  generateDataSubjectDID(
    generateDataSubjectDIDInput: $generateDataSubjectDIDInput
  ) {
    status
    message
    data {
      dataSubjectId
    }
  }
}

Timeout: 210-second timeout.

Compliance Reporting

Report Compliance Issues

Returns flagged compliance issues for a data controller.

GraphQL
query ReportDataControllersComplianceIssues(
  $reportDataControllersComplianceIssuesInput: ReportDataControllersComplianceIssuesInput
) {
  reportDataControllersComplianceIssues(
    reportDataControllersComplianceIssuesInput: $reportDataControllersComplianceIssuesInput
  ) {
    status
    message
    data {
      rows {
        id
        dataControllerId
        createdAt
        updatedAt
        state
        description
        priority
        isDismissed
      }
    }
  }
}

Report Rights Requests

Returns data subject rights requests and their processing status.

GraphQL
query ReportDataSubjectsRightsRequests(
  $reportDataSubjectsRightsRequestsInput: ReportDataSubjectsRightsRequestsInput
) {
  reportDataSubjectsRightsRequests(
    reportDataSubjectsRightsRequestsInput: $reportDataSubjectsRightsRequestsInput
  ) {
    status
    message
    data {
      rows {
        id
        dataSubjectId
        createdAt
        requestType
        description
      }
    }
  }
}

Report Data Subject Statistics

Returns aggregate statistics about data subjects and their interactions.

GraphQL
query ReportDataSubjectsStats(
  $reportDataSubjectsStatsInput: ReportDataSubjectsStatsInput
) {
  reportDataSubjectsStats(
    reportDataSubjectsStatsInput: $reportDataSubjectsStatsInput
  ) {
    status
    message
    data {
      visitCount
      faqCount
      questionCount
    }
  }
}

Report Third-Party Services

Returns information about connected third-party integrations.

GraphQL
query ReportThirdPartyServices(
  $reportThirdPartyServicesInput: ReportThirdPartyServicesInput
) {
  reportThirdPartyServices(
    reportThirdPartyServicesInput: $reportThirdPartyServicesInput
  ) {
    status
    message
    data {
      rows {
        name
        description
        model
      }
    }
  }
}

Tag Manager

Login to Tag Manager

Authenticates a user for the Tag Manager application and returns a redirect URL.

GraphQL
mutation LoginUserTagManager(
  $loginUserTagManagerInput: LoginUserTagManagerInput
) {
  loginUserTagManager(
    loginUserTagManagerInput: $loginUserTagManagerInput
  ) {
    status
    message
    data {
      userId
      redirect
    }
  }
}

Report Tag Manager Statistics

Returns usage statistics for your Tag Manager applications.

GraphQL
query ReportTagManagerApplicationStats($reportTagManagerApplicationStatsInput: ReportTagManagerApplicationStatsInput) {
  reportTagManagerApplicationStats(reportTagManagerApplicationStatsInput: $reportTagManagerApplicationStatsInput) {
    status
    message
    data {
      orgId
      apps {
        appId
        appName
      }
    }
  }
}

Team Management

Send Invite Email

Sends an invitation email to a new team member.

GraphQL
mutation SendInviteEmail($input: SendInviteEmailInput!) {
  sendInviteEmail(input: $input) {
    status
    message
  }
}

Privacy Notices

Sample Privacy Notices

Returns sample privacy notice text based on your processing activities and jurisdiction.

GraphQL
query SamplePrivacyNotices(
  $samplePrivacyNoticesInput: SamplePrivacyNoticesInput
) {
  samplePrivacyNotices(
    samplePrivacyNoticesInput: $samplePrivacyNoticesInput
  ) {
    status
    message
    data {
      textList
    }
  }
}

Translation

Translate Text

Translates privacy documents and notices using DeepL.

GraphQL
mutation TranslateText($input: TranslateTextInput!) {
  translateText(input: $input) {
    translatedText
  }
}

The response returns the translated text directly.

System Operations

Trigger Manual Reassessment

Triggers a full reassessment of your compliance documents. Use this after significant changes to your organization setup, processing activities, or data processors.

GraphQL
mutation TriggerManualReassessment($dataControllerId: uuid!) {
  triggerManualReassessment(dataControllerId: $dataControllerId) {
    inserted
  }
}

Returns { "inserted": true } when the reassessment has been queued.

Use Sparingly

Reassessments regenerate all your compliance documents. This is a catch-up tool for significant changes, not a routine operation.

Billing & Subscriptions

Create Checkout Session

Creates a Stripe checkout session for subscription management.

GraphQL
mutation CreateCheckoutSession(
  $createCheckoutSessionInput: CreateCheckoutSessionInput
) {
  createCheckoutSession(
    createCheckoutSessionInput: $createCheckoutSessionInput
  ) {
    sessionId
    url
  }
}

Create Billing Portal

Opens the Stripe billing portal for managing invoices and payment methods.

GraphQL
mutation CreateBillingPortal(
  $input: CreateBillingPortalInput!
) {
  createBillingPortal(
    input: $input
  ) {
    portalUrl
  }
}

Fetch Subscription Products

Returns available subscription plans and pricing.

GraphQL
query {
  fetchStripeProducts {
    products {
      id
      name
      description
      image
      tax_code
      features
      prices {
        id
        amount
        currency
        interval
      }
    }
  }
}

Get Customer Subscription

Returns the current subscription status for your organization.

GraphQL
query {
  getCustomerSubscription {
    customer {
      # StripeCustomer fields
    }
    invoices {
      # StripeInvoice fields
    }
    paymentMethods {
      # StripePaymentMethod fields
    }
    subscriptions {
      # StripeSubscription fields
    }
  }
}

FAQ

Answer FAQ

Returns an AI-generated answer to a data subject's FAQ question.

GraphQL
mutation AnswerFAQ($answerFAQInput: AnswerFAQInput) {
  answerFAQ(answerFAQInput: $answerFAQInput) {
    status
    message
    data {
      id
      textList
    }
  }
}

Response Patterns

Standard Response

Most actions follow this pattern:

JSON
{
  "status": "success",
  "message": "Operation completed",
  "data": { }
}

Error Response

JSON
{
  "status": "error",
  "message": "Description of the problem",
  "data": null
}

GraphQL-Level Errors

JSON
{
  "errors": [
    {
      "message": "UNAUTHORIZED: Invalid authentication",
      "extensions": {
        "code": "UNAUTHORIZED",
        "path": ["generateDataControllerDID"]
      }
    }
  ]
}

Common error codes:

  • UNAUTHORIZED -- invalid or expired token
  • FORBIDDEN -- insufficient role permissions
  • VALIDATION_ERROR -- invalid input parameters
  • SERVICE_UNAVAILABLE -- temporary service issue

Rate Limits

GraphQL actions authenticated with JWT tokens are not rate-limited. Public-facing endpoints without authentication are rate-limited to 1,000 requests per 15 minutes per IP address.

Note

The specific rate limit figures above have not been independently verified from configuration. Contact support to confirm current limits before relying on these values in production.

See Rate Limits for details.