Skip to content

Settings → Privacy

Getting a copy of your own data, and recording a cookie-consent decision against your account.

Endpoint summary

Method Path Notes
GET /user/v1/settings/profile/export Download a ZIP of your own data
POST /user/v1/settings/cookie-consent Record your cookie-consent decision

Account deletion lives on Account Settings.

Downloading your data

GET /user/v1/settings/profile/export

Serves the right of access and the right to data portability in one response: a ZIP of readable JSON covering profile, settings, documents, signing activity, identity verification, saved signatures, certificates, notifications and account history, with a README.md explaining what is and is not included.

Every list in the archive is ordered by date, most recent first, so a client reading one of the JSON files gets the newest record at index 0 rather than having to sort.

The response is a binary download, not JSON:

200 OK
Content-Type: application/octet-stream
Content-Disposition: attachment; filename="vscrawl-data-export-{userId}.zip"

Read the bytes, don't parse them

Clients that JSON-decode every response by default will corrupt the archive. Request the body as bytes.

Deliberately excluded: document files, signature images and security credentials, along with other people's names and addresses. Documents are downloadable one at a time from the Documents endpoints, so the archive covers what is otherwise unreachable rather than duplicating what is not.

Each call writes a DATA_EXPORTED entry to your activity log.

Errors: 429 if another export was started too soon after the last one — one per minute per account.

POST /user/v1/settings/cookie-consent

{
  "method": "accept_all",
  "functional": true,
  "analytics": true,
  "version": 1,
  "policyFingerprint": "v.fof1t0",
  "decidedAt": "2026-08-31T15:31:29.979Z"
}
Field Notes
method Required. accept_all, reject_all or custom
functional / analytics Whether each optional purpose was allowed
version The banner's own version, so consent given under older wording is not reused
policyFingerprint Mark identifying the published Privacy Policy the decision was taken against
decidedAt When the person answered, as recorded by their browser

The decision is written to the account's activity log as COOKIE_CONSENT_RECORDED. The notice is shown on a visitor's first sign-in, never before — signed out, the application sets no storage at all, and the cookies it describes begin with the session. There is therefore always an account to attribute the acknowledgement to, which is what gives the controller a copy it can produce rather than one only the visitor can erase.

Call it once per decision, and again whenever the person answers afresh.

Errors: 400 if method is missing or is not one of the three values.