DeclareBreachDto

titlestringrequired

Possible values: >= 3 characters and <= 200 characters

descriptionstringrequired

Possible values: >= 3 characters and <= 4000 characters

severitystring

Possible values: [low, medium, high, critical]

detectedAtstringrequired

subjects object[]

Array [

subjectTypestringrequired

Possible values: [client, agent, user]

subjectIdstringrequired

dataCategoriesstring[]required

Complaints + SARs Phase 2 gap 4 — DPPA §17 severity assessment. Every subject on a breach declaration must enumerate WHICH data categories were exposed. Downstream severity classification + regulator notification cadence (72h if NIN / bank_account / medical vs 30d otherwise) key off this list.

Possible values: [nin, phone, email, address, bank_account, medical, financial, behavioural, other]

]

DeclareBreachDto

{
  "title": "string",
  "description": "string",
  "severity": "low",
  "detectedAt": "string",
  "subjects": [
    {
      "subjectType": "client",
      "subjectId": "string",
      "dataCategories": [
        "nin"
      ]
    }
  ]
}