Automating Action Items for Subject Rights

This tutorial uses AWS Lambda for simplicity, but you can use any framework (e.g., Express API on ECS, etc.). As long as you can provide an API to receive the webhook requests. If you're not using the provided sample code, the workflow remains the same.

This guide walks you through setting up a webhook integration using AWS Lambda to automate Subject Rights (DSAR) action items for manual data stores.

You'll:

1. Deploy a Lambda function to process webhook payloads
2. Configure a webhook in Osano
3. Automatically complete action items via Osano’s API

The code will do the following:

1. Parse the webhook payload
2. Search for the requester’s data
   • For example, search a database where you're storing the requester's data
3. Handle the requested action (e.g., DELETE, OPT_OUT)
   • For example, delete the requester's data from your database
4. Attach a summary file of the requester's data to the action item via the summaries API endpoint

POST /api/v1/subject-rights/action-items/{action_item_id}/summaries
Content-Type: application/json
Authorization: Bearer {your_api_key}
Body: {user_data}

5. Mark the action item complete via the update API endpoint

PATCH /api/v1/subject-rights/action-items/{action_item_id}
Content-Type: application/json
Authorization: Bearer {your_api_key}
Body: { "status": "COMPLETED" }

---

Prerequisites

• AWS account with Lambda access
• Clone the Webhook Sample Apps repo

---

Step 1: Create a Lambda

1. Go to Lambda → Functions → Create function

2. Choose Author from scratch

3. Set the following during creation:

   • Runtime: Node.js 22.x
   • Architecture: arm64
   • Function URL: Enabled (public url)
     • ⚠️ For production use, it may be good to put your Lambda function behind authentication

4. Follow the DSAR Sample App README to generate a .zip and upload it to your Lambda function under Code → Upload from → .zip file

Note down the Function URL — you'll need it in Step 4.

Environment Variables

Go to Configuration → Environment variables and add:

Key	Value
OSANO_API_KEY	Your Osano API key

Additional Configuration

Increase the Lambda timeout to 1 minute.

---

Step 2: Create a Data Store

1. Now log in to Osano and create a manual data store
2. Add the following fields:

Field	Location	Classification
id	users	Online ID
email	users	Email
name	users	Name

NOTE: You would add the actual fields your data store contains when using this in production

---

Step 3: Create a Form

1. Navigate to Subject Rights → Forms and create a new form
2. On the form details page under Settings → Action Item Processing, select the Only the following Data Store(s) option and add the data store you just created in Step 2

---

Step 4: Configure the Webhook

1. Now navigate to Webhooks from the Settings icon in the top right and create a new webhook via the Add Webhook button
2. Set the following:

App and Event

Product	Event
Subject Rights	Action Item Generated

Filters

Field	Condition	Value
{{dataStoreName}}	Equals	Your Data Store Name

Actions

Method	URL
POST	Your Lambda Function URL

Headers

Name	Value
Content-Type	application/json

Content

{
    "actionItemId": "{{dsarActionItemId}}",
    "email": "{{dsarDetails.email}}",
    "requestedAction": "{{requestedAction}}"
}

Check out the variables documentation to see a full list of variables available for substitution.

Step 5: Test the Webhook

1. Submit a Subject Rights request to the form you created in Step 3
2. Verify your email to ensure action items are generated
3. Navigate to the request details from the Subject Rights -> Requests page
4. There should be a completed action item with a file attached

Overall, you've now automated action items for a manual data store.