curl -X POST https://api.orbit.devotel.io/api/v1/compliance/processing-activities \
  -H "X-API-Key: dv_live_sk_..." \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Customer support call recordings",
    "description": "Voice recordings of inbound support calls used for quality review and dispute resolution.",
    "purpose": "Quality assurance and dispute handling for support interactions.",
    "controller_role": "controller",
    "lawful_basis": "legitimate_interests",
    "data_subject_categories": ["customers", "prospects"],
    "data_categories": ["audio recordings", "caller number", "agent notes"],
    "special_categories": [],
    "recipients": ["support operations team"],
    "cross_border_transfers": false,
    "retention_period": "90 days after call, then deleted",
    "security_measures": ["encryption at rest", "role-restricted access", "audit logging"],
    "large_scale": false,
    "automated_decision_making": false,
    "systematic_monitoring": false
  }'

{
  "id": "processingActivity_7kf2…",
  "reference": "ROPA-2026-0004",
  "status": "draft",
  "screening": {
    "required": false,
    "triggers": []
  }
}

curl -X PATCH https://api.orbit.devotel.io/api/v1/compliance/processing-activities/processingActivity_7kf2… \
  -H "X-API-Key: dv_live_sk_..." \
  -H "Content-Type: application/json" \
  -d '{ "status": "active" }'

curl -X PUT https://api.orbit.devotel.io/api/v1/compliance/processing-activities/processingActivity_7kf2…/dpia \
  -H "X-API-Key: dv_live_sk_..." \
  -H "Content-Type: application/json" \
  -d '{
    "necessity_proportionality": "Call recording is limited to support lines; retention is capped at 90 days; access is restricted to the support operations team.",
    "risks_identified": ["Unauthorised access to recordings", "Retention beyond stated purpose"],
    "likelihood": "medium",
    "severity": "high",
    "mitigations": ["Role-restricted access", "Automated deletion at 90 days", "Access audit trail"],
    "residual_risk": "medium",
    "dpo_consulted": true,
    "outcome": "proceed_with_safeguards"
  }'

curl https://api.orbit.devotel.io/api/v1/compliance/processing-activities/inventory \
  -H "X-API-Key: dv_live_sk_..."

{
  "generatedAt": "2026-08-24T09:30:00.000Z",
  "recordCount": 1,
  "records": [
    {
      "reference": "ROPA-2026-0004",
      "name": "Customer support call recordings",
      "purpose": "Quality assurance and dispute handling for support interactions.",
      "controllerRole": "controller",
      "lawfulBasis": "legitimate_interests",
      "dataSubjectCategories": ["customers", "prospects"],
      "dataCategories": ["audio recordings", "caller number", "agent notes"],
      "specialCategories": [],
      "recipients": ["support operations team"],
      "crossBorderTransfers": false,
      "transferSafeguard": null,
      "retentionPeriod": "90 days after call, then deleted",
      "securityMeasures": ["encryption at rest", "role-restricted access", "audit logging"],
      "status": "draft",
      "dpiaRequired": false,
      "dpiaTriggers": [],
      "dpiaRecorded": false,
      "dpiaOutcome": null,
      "residualRisk": null
    }
  ]
}