TrustArc
TrustArc is a Walnut Creek, California enterprise privacy management platform that helps organizations operationalize global data privacy programs. Its product portfolio spans three suites. Privacy Studio covers consumer-facing consent and rights with Cookie Consent Manager, Consent & Preference Manager, Individual Rights Manager (DSR automation), and the Unified Trust Center. The Governance Suite covers internal privacy program operations with PrivacyCentral, Data Mapping & Risk Manager, Assessment Manager (PIA/DPIA/TIA), and Nymity Research for regulatory intelligence. Assurance Services delivers third-party attestations including Data Privacy Framework verification, GDPR and CCPA/CPRA validation, APEC CBPR/PRP, and TRUSTe Responsible AI Certification. TrustArc exposes a developer surface through gated APIs documented in the customer help center — including the Gateway API, Individual Rights Manager Rapid/Client APIs, Cookie Consent Manager Reporting API, Consent & Preference Manager Rapid/Standard APIs, and Assessment Manager Internal API — plus a Mobile Consent SDK (iOS), 300+ prebuilt connectors to platforms such as Salesforce, HubSpot, Marketo, Adobe Experience Manager, Microsoft Dynamics, Jira, and Google Workspace, and a Google Consent Mode v2 template published on GitHub. The developer surface is larger than it looks: TrustArc serves one machine-readable contract openly — the Guardian identity API at login.truste.com/v3/api-docs, an OpenAPI 3.1.0 document with 205 paths, 276 operations and 158 schemas that includes a standards-compliant SCIM 2.0 provisioning surface — plus OpenID Connect and RFC 8414 discovery documents advertising PKCE, mTLS-bound tokens, DPoP and token exchange. Six further external APIs (Cookie Consent Manager External v1, CCM Reporting, Individual Rights Manager, Consent & Preference Manager, the Data Mapping Hub external-integration API and Assessment Manager) are fully documented in the public help center with endpoints, payloads, status codes and a versioning and deprecation policy, but publish no OpenAPI. Founded over 28 years ago and serving 1,500+ enterprises including Abbott, ADP, GE, Nike, and Starbucks, TrustArc operates on a commercial SaaS model with no published pricing; API credentials are issued by an account administrator rather than self-service.
Real signal across most facets with visible, nameable gaps — the contract exists but is thin, or the portal is good while governance and commercial terms are absent.
API Evangelist profiles TrustArc the way a machine reads it — 64 machine-readable artifacts across 2 APIs, pulled from the provider's own public surface and indexed so a developer, an analyst, or an AI agent can evaluate it against every other provider on the network.
Every provider in the network is reduced to the same set of machine-readable artifacts — OpenAPI contracts, event specifications, GraphQL schemas, runnable collections, pricing and rate-limit signals, security posture, OAuth scopes, and the agent surfaces (MCP servers and skills) that let software drive the API on its own. We profile them because the interface is the part of a company you can actually inspect: it is a truer signal of what a provider does than any marketing page. From those artifacts we compute the Kin Score — TrustArc scores 50.6/100 (developing), with a separate agent-readiness read of 39/100 (agent ready). The full breakdown is below, followed by every artifact we hold — each card links through to its machine-readable definition on apis.io.
Kin Score
This is the API Evangelist rating — a single, repeatable read computed from the artifacts on this page. Green fill is points earned; the red track is points possible, so every bar shows earned-versus-possible at a glance. Every facet and dimension name is a link: it opens that measurement's page on APIs.io, where the rating runs across the whole catalog — the exact checks that feed it, how every profiled provider distributes on it, and who is at the top of it.
Kin Score
How this is scored →scored 2026-09-08 · rubric v0.20.0
Put this on your own site. The badge is drawn live from TrustArc's current Kin Score — paste it once and it updates itself every time the score is recomputed. It follows your visitor's light or dark setting, and it links back here so anyone who sees it can read the full breakdown.
<!-- Kin Score · API Evangelist -->
<a href="https://providers.apievangelist.com/providers/trustarc/"
title="TrustArc on API Evangelist — API profile and Kin Score">
<img src="https://apis.io/badge/trustarc.svg"
alt="TrustArc Kin Score — API readiness rating by API Evangelist" width="150" height="150" loading="lazy">
</a>[](https://providers.apievangelist.com/providers/trustarc/)<!-- Kin Score · API Evangelist -->
<a href="https://providers.apievangelist.com/providers/trustarc/"
title="TrustArc on API Evangelist — API profile and Kin Score">
<img src="https://apis.io/badge/trustarc/card.svg"
alt="TrustArc Kin Score — API readiness rating by API Evangelist" width="340" height="120" loading="lazy">
</a>More shapes, themes and sizes → · Score as JSON · How badges work
How we profile TrustArc
Each block below is one kind of artifact we hold for TrustArc. For each we say what it is and why it earns a place in the profile, then list every one we've indexed — capped at two rows, scroll within the panel for the rest.
APIs 56
Each API is captured as its own OpenAPI definition — every operation, parameter, and response. This is the single most useful machine-readable description of what an API does, and it's what lets us score, lint, mock, and generate against it without asking the provider for anything.
Individual APIs this provider publishes, each with its own machine-readable definition.
TrustArc Cookie Consent Manager External API
Manage the website inventory of a Cookie Consent Manager instance and queue tracker scans. Version v1.0, released 2025-04-23, with a published versioning policy (URI versioning,...
TrustArc Individual Rights Manager External API
Create, label, search and close data subject requests (DSR/DSAR) in Individual Rights Manager, and register callbacks for request status changes. Request bodies are keyed by per...
TrustArc Consent & Preference Manager External API
Read and write consent records, consent forms, data subjects and their callbacks in Consent & Preference Manager, with a matching EU data-residency deployment at cpm.trustarc.eu...
TrustArc Data Mapping Hub External Integration API
Synchronize the privacy data inventory — Business Processes, IT Systems, Company Affiliates and Third Parties — between a customer system of record and TrustArc's Data Mapping &...
TrustArc Cookie Consent Manager Reporting API
Pull consent analytics out of Cookie Consent Manager — analytics reports, consent locations and GDPR reports, in JSON and CSV. Version 1.4 of the guide, last updated 2026-01-07....
TrustArc Assessment Manager API
Create Assessment Manager projects (PIA/DPIA/TIA) programmatically over a RESTful surface, plus an external-integration project answer endpoint and packaged Salesforce and Servi...
TrustArc Accounts API
The Accounts API from TrustArc — 14 operation(s) for accounts.
TrustArc Accounts Custom Meta Tags API
The Accounts-CustomMetaTags API from TrustArc — 7 operation(s) for accounts-custommetatags.
TrustArc Accounts Extension API
The Accounts-Extension API from TrustArc — 6 operation(s) for accounts-extension.
TrustArc Accounts Fieldtypes API
The Accounts-fieldtypes API from TrustArc — 3 operation(s) for accounts-fieldtypes.
TrustArc Accounts Meta Tags API
The Accounts-MetaTags API from TrustArc — 3 operation(s) for accounts-metatags.
TrustArc Accounts Organizational Structure API
The Accounts-OrganizationalStructure API from TrustArc — 6 operation(s) for accounts-organizationalstructure.
TrustArc Accounts Pick Tags API
The Accounts-PickTags API from TrustArc — 4 operation(s) for accounts-picktags.
TrustArc Accounts Prefaces API
The Accounts-Prefaces API from TrustArc — 3 operation(s) for accounts-prefaces.
TrustArc Accounts Report Configs API
The Accounts-ReportConfigs API from TrustArc — 3 operation(s) for accounts-reportconfigs.
TrustArc Accounts Sub Account API
The Accounts-SubAccount API from TrustArc — 2 operation(s) for accounts-subaccount.
TrustArc Accounts Tokens API
The Accounts-Tokens API from TrustArc — 3 operation(s) for accounts-tokens.
TrustArc Accounts User Groups API
The Accounts-UserGroups API from TrustArc — 1 operation(s) for accounts-usergroups.
TrustArc Actuator API
Monitor and interact
TrustArc Anon Credential Resource API
The anon-credential-resource API from TrustArc — 2 operation(s) for anon-credential-resource.
TrustArc Anon Session Controller API
The anon-session-controller API from TrustArc — 1 operation(s) for anon-session-controller.
TrustArc Clients API
The Clients API from TrustArc — 13 operation(s) for clients.
TrustArc Clients Extension API
The Clients-Extension API from TrustArc — 1 operation(s) for clients-extension.
TrustArc Clients Extension License API
The Clients-Extension-License API from TrustArc — 3 operation(s) for clients-extension-license.
TrustArc Clients Roles API
The Clients-Roles API from TrustArc — 2 operation(s) for clients-roles.
TrustArc Clients User Groups API
The Clients-UserGroups API from TrustArc — 3 operation(s) for clients-usergroups.
TrustArc Email Templates API
The Email Templates API from TrustArc — 4 operation(s) for email templates.
TrustArc Entity Configs API
The Entity Configs API from TrustArc — 4 operation(s) for entity configs.
TrustArc Groups API
The Groups API from TrustArc — 2 operation(s) for groups.
TrustArc History API
The History API from TrustArc — 3 operation(s) for history.
TrustArc Jobs API
The Jobs API from TrustArc — 3 operation(s) for jobs.
TrustArc Navigation Menus API
The Navigation-Menus API from TrustArc — 4 operation(s) for navigation-menus.
TrustArc Nymity API
The Nymity API from TrustArc — 2 operation(s) for nymity.
TrustArc Permission Profiles API
The PermissionProfiles API from TrustArc — 5 operation(s) for permissionprofiles.
TrustArc Preface API
The Preface API from TrustArc — 3 operation(s) for preface.
TrustArc Reports API
The Reports API from TrustArc — 2 operation(s) for reports.
TrustArc Schedules API
The Schedules API from TrustArc — 3 operation(s) for schedules.
TrustArc SCIM API
The Scim API from TrustArc — 5 operation(s) for scim.
TrustArc Sessions API
The Sessions API from TrustArc — 5 operation(s) for sessions.
TrustArc SSO Login Controller API
The sso-login-controller API from TrustArc — 1 operation(s) for sso-login-controller.
TrustArc Storage API
The Storage API from TrustArc — 1 operation(s) for storage.
TrustArc Sysinfo API
The Sysinfo API from TrustArc — 1 operation(s) for sysinfo.
TrustArc Translations API
The Translations API from TrustArc — 2 operation(s) for translations.
TrustArc User Info Resource API
The user-info-resource API from TrustArc — 1 operation(s) for user-info-resource.
TrustArc User Profiles Activations API
The UserProfiles-Activations API from TrustArc — 2 operation(s) for userprofiles-activations.
TrustArc User Profiles API
The UserProfiles API from TrustArc — 11 operation(s) for userprofiles.
TrustArc User Profiles Users API
The UserProfiles-Users API from TrustArc — 4 operation(s) for userprofiles-users.
TrustArc Users API
The Users API from TrustArc — 34 operation(s) for users.
TrustArc Users Audits API
The Users-Audits API from TrustArc — 1 operation(s) for users-audits.
TrustArc Users Extension API
The Users-Extension API from TrustArc — 1 operation(s) for users-extension.
TrustArc Users Fieldtypes API
The Users-fieldtypes API from TrustArc — 2 operation(s) for users-fieldtypes.
TrustArc Users History API
The Users-History API from TrustArc — 3 operation(s) for users-history.
TrustArc Users Meta Tags API
The Users-MetaTags API from TrustArc — 4 operation(s) for users-metatags.
TrustArc Users Simple API
The Users-Simple API from TrustArc — 1 operation(s) for users-simple.
TrustArc Users Switch API
The Users-Switch API from TrustArc — 1 operation(s) for users-switch.
TrustArc Xauths API
The Xauths API from TrustArc — 4 operation(s) for xauths.
Scroll within the panel for all 56 ·
Pricing Plans 1
Pricing is part of the interface. Machine-readable plans tell you what a tier costs and includes before you commit — one of the things the Kin Score reads for access clarity — renamed from commercial clarity in rubric 0.12, because a free statutory interface has access terms and no commercial ones.
Published pricing tiers and plan structures.
Rate Limits 1
Rate limits are the difference between a demo that works and a production integration that doesn't fall over. Publishing them is an operational-transparency signal — and a hard requirement for any agent that plans its own throughput.
Documented rate limits and quota policies.
Trustarc Rate Limits
RATE LIMITSEvent Specifications 1
Not every API is request/response. AsyncAPI describes the event-driven and streaming side — the webhooks and channels — so the asynchronous half of the interface is documented the same way the synchronous half is.
AsyncAPI definitions for this provider's event-driven and streaming APIs.
Trustarc Webhooks
ASYNCAPISecurity Posture 3
Authentication, domain security, vulnerability disclosure, and trust-center signals — the evidence that a provider takes security seriously enough to document it. We profile it because you can't govern what you can't see.
Authentication, domain security, vulnerability disclosure, and trust-center signals.
Scopes 1
OAuth scopes are the vocabulary of least-privilege access. Profiling them shows exactly what an integration — or an agent acting on a user's behalf — is allowed to do.
OAuth scopes governing access to this provider's APIs.
Agentic Access 1
An x-agentic-access contract marks which operations are safe for an agent to run on its own and which need a human in the loop. It is the difference between an API an agent can use and one it can use safely.
Recommended x-agentic-access execution contracts for AI agents.
Resources
Every other property we hold for TrustArc — documentation, portals, status pages, policies, and corporate surface — grouped by the job it does, following the integrator's arc from getting started to running in production.
Get Started 4
Portal, sign-up, and the first successful call
Documentation 4
Reference material describing how the API behaves
Agent Surfaces 5
MCP servers, agent skills, and machine-readable catalogs
Design & Contract 7
Pagination, idempotency, versioning, errors, and events
Scroll within the panel for all 7 ·
Build 5
SDKs, sample code, and the tooling you integrate with
Access & Security 7
Authentication, authorization, and security posture
Scroll within the panel for all 7 ·
Operate 6
Status, limits, changes, and where to get help
Commercial 5
Pricing, plans, and the legal terms of use
Company 4
The organization behind the API
Other 12
Properties that don't map to a standard resource type
Scroll within the panel for all 12 ·
← All providers · Data indexed from github.com/api-evangelist/trustarc · machine-readable index on apis.io
This is an independent, third-party profile of TrustArc, published by API Evangelist. We do not operate, host, resell, or support these APIs, and we are not affiliated with or endorsed by the company unless stated above. Everything here is built from publicly available information — the company's own site, developer portal, documentation, public repositories, and the specifications it publishes for public use. Nothing is obtained by breaching a system, defeating an access control, or using credentials.
The Kin Score and Agent Readiness rating are independently calculated assessments of a company's public API artifacts, scored against a published rubric. They are not certifications, endorsements, security assessments, or audits.
Corrections, re-scores, and removal are free — no partnership or purchase required, and you do not need to justify the request. A removed company is recorded as unrated, never scored zero for having asked. Acknowledgement within one business day; removal within two.
info@apievangelist.com
·
Read the full data-sourcing policy →
On a security or compliance team? Put security in the subject line and
you will get a person, not a form — we will tell you exactly which public URLs this profile was built from.