Creating a Workflow for Managing DROP Requests

Important:

The DROP support feature is under Public Preview. Please contact OneTrust Support to request early access.

This article explains how to configure an integration workflow to process DROP requests in OneTrust after they are imported into OneTrust.

You will create a web form and supporting workflows, send hashed DROP request data to an external matching system, receive the match result through an inbound webhook, and route the result to the appropriate action. The workflow updates unmatched requests as Not found, creates an opt-out DSR for a partial match, or creates a data-deletion DSR for a complete match.

This article explains how to build the integration workflow. To configure DROP intake, API-key settings, sync frequency, automatic or manual request sync, and status reporting back to DROP, see Managing Delete Request and Opt-Out Platform (DROP) Requests.

Prerequisites

Before you begin, make sure you have the following:

  • Established workflows for opt-out and deletion requests.

  • Authentication credentials for your OneTrust environment.

  • Authentication credentials for the DroP service on the California Privacy Protection Agency website.

  • Access to an external system with:

    • The API, webhook URL, and connection path for the external application/database.

    • A sample request body for the API and webhook.

    • Confirmation of which hashed consumer deletion list will be used, including:

      • Email address

      • Phone number

      • Mobile advertising ID

      • First Name, Last Name, and VIN

      • First Name, Last Name, Date of Birth, and Zip

      • Connected TV Identifier

    • A hashed consumer dataset, for comparison against the DROP hashed dataset.

To create a dedicated DROP requests web form and workflow

Important:

The instructions below are presented an as example. You should create a form that contains the fields you need to fulfil a DROP request.

  1. On the Privacy Rights Automation menu, go to Setup > Web forms. The Web form templates screen appears.

  2. Click the Create web form button or copy an existing web form by selecting Copy from the context menu of an existing web form.
  3. If you created a new web form, select any of the templates to base your new web form on. If you copied an existing web form, give your new web form a suitable name, for example DROP Intake Requests. The Web form customization screen appears.

  4. Expand the Form fields section. Remove all fields except I am a (an) and Select request type(s).
  5. In the I am a (an) field, create an option called DROP request.
  6. In the Select request type(s) field add an option for Data Deletion and another for Opt Out.


  7. Click the Save template button.
  8. Go to the Rules tab on the Web form customization screen.
  9. Remove any existing rules.
  10. Click the Add rule button. You will need to add 2 new rules, one for opt-out requests and one for deletion requests.
  11. Configure the following fields in the rule builder:


    Field

    Opt-out requests

    Deletion requests

    Rule name

    Route opt-out requests

    Route deletion requests

    Field

    Select request type(s)

    Select request type(s)

    Operator

    Equal to

    Equal to

    Value

    Opt Out

    Data Deletion

    Workflow

    Select the workflow used for opt-out requests

    Select the workflow used for deletion requests
  12. Go to the Settings tab and disable all settings. Click the Save button.
  13. Got to the Verification tab and disable all settings. Click the Save button.
  14. Click the Publish button.

To create the outbound integration for new DROP requests

  1. On the Privacy Rights Automation menu, go to Setup > Integrations > Integrations. The Integration builder appears.

  2. Click the Add integration button. The Add integration modal appears.

  3. Configure the fields by adding a name, system and notification email. If you do not have a dedicated system, select Generic from the drop-down list. Click the Add button.


  4. On the Builder tab of the Integration builder screen, select Privacy Rights Automation under Add OneTrust trigger.
  5. Select Drop Request Created. The click the Done button.


  6. Select the Add action button. The Add action screen appears.

  7. On the System tab, scroll down to Https GET request.
  8. If the destination system requires authentication, select Select existing credentials, otherwise select Configure new credentials and configure the required information. Click the Next button.
  9. On the Request tab of the Builder tab of the Integration builder page, configure the form as follows:


    Field
    Description
    Request URL

    The webhook or API endpoint for your downstream system.

    Method

    POST

    Headers

    Add any required header values, such as Content-Type.

    Body

    Leave this field blank to send the full event payload, or provide a custom payload using Freemarker variables.

  10. Click the Finish button.
  11. Under the If no path, remove any placeholder action.
  12. Click the Save button.

Example Drop Request Created event payload

JSON 
{   
    "orgId": "5d27fa04-26ea-45b7-8877-0d390858901c",
    "dropId": 107849,   
    "hashType": "Email",   
    "hash": "Pfzmx+ynDao5Gai7m+JvBijmtdZOjYvswh3zjC7wlNI=",   
    "createdDate": "2026-07-17T18:09:17.702+00:00",   
    "stagingRequest": true,   
    "status": "PENDING",   
    "batchName": "20260618_1594_EMAIL.csv" 
}

To create the inbound webhook integration

This integration receives the external system response, and will either update the DROP request status or create a new DSAR request.

  1. On the Privacy Rights Automation menu, go to Setup > Integrations > Integrations. The Integration builder appears.

  2. Click the Add integration button. The Add integration modal appears.

  3. Configure the fields by adding a name, system and notification email. If you do not have a dedicated system, select Generic from the drop-down list. Click the Add button.
  4. On the Builder tab of the Integration builder screen, select the Built-in tab under Add OneTrust trigger, then select the Webhook option.


  5. Enter a JSON schema for the incoming payload. As a minimum, you will need to make sure the external system is sending the associated DROP ID, match status of the hashed dataset, and any additional fields you need to enable request fulfillment or routing.
    Example JSON schema
    JSON 
    {  
    "DROP_ID": 12345,   
    "Match_Status": "Partial" 
} 
  6. Click the Done button.

Route actions based on match status

Once the webhook trigger is configured, you'll need to add condition logic to route the response based on match status.

No match - Update the DROP request status

  1. In your inbound webhook integration, click the Add action button, then on the Logic tab select Condition.



  2. On the Conditional screen, configure the fields by adding an expression, selecting the operator and adding an value.



    Field
    Description
    Expression

    ${(event.payload["Match_Status"])!}

    Select operator

    Contains any

    Value

    NF

  3. Click the Done button. The If yes and If no paths will appear.

  4. On the If yes path, select the System tab and then select Https PUT request.

  5. Select Select existing credentials and choose your OneTrust credentials from the drop-down list. Click the Next button.

  6. Configure the Request fields with the following information:



    Field
    Description
    Request URL

    https://<your-tenant-base-url>/api/drop-manager/v1/drop/${(event.payload["DROP_ID"])!}

    Header(s)

    Key

    Value

    Content-Type

    application/json
    Body

    {"status": "NOT_FOUND"}

  7. Click the Finish button.

  8. On the If no path, delete any placeholder action.



  9. Click the Save button.

Partial match - Create an opt-out DSAR request

  1. In your inbound webhook integration, click the Add action button, then on the Logic tab select Condition.

  2. On the Conditional screen, configure the fields by adding an expression, selecting the operator and adding an value.



    Field
    Description
    Expression

    ${(event.payload["Match_Status"])!}

    Select operator

    Contains any

    Value

    Partial

  3. Click the Done button. The If yes and If no paths will appear.

  4. On the If yes path, select the System tab and then select Https POST request.

  5. Select Select existing credentials and choose your OneTrust credentials from the drop-down list. Click the Next button.

  6. Configure the Request fields with the following information:



    Field
    Description
    Request URL

    https://<your-tenant-base-url>/api/drop-manager/v2/drop/${(event.payload["DROP_ID"])!}/request

    Header(s)

    Key

    Value

    Content-Type

    application/json
    Body
    JSON 
    { 
"dropRequestType": "OptOut", 
"templateId": "<published-web form-template-id>", 
"language": "en-us", 
"requestTypes": [ 
"Opt Out" 
],
"subjectTypes"
       "DROP Request"
   ]
}

  7. Click the Finish button.

  8. On the If no path, delete any placeholder action.

  9. Click the Save button.

Full match - Create a data deletion DSAR request

  1. In your inbound webhook integration, click the Add action button, then on the Logic tab select Condition.

  2. On the Conditional screen, configure the fields by adding an expression, selecting the operator and adding an value.



    Field
    Description
    Expression

    ${(event.payload["Match_Status"])!}

    Select operator

    Contains any

    Value

    Complete

  3. Click the Done button. The If yes and If no paths will appear.

  4. On the If yes path, select the System tab and then select Https POST request.

  5. Select Select existing credentials and choose your OneTrust credentials from the drop-down list. Click the Next button.

  6. Configure the Request fields with the following information:



    Field
    Description
    Request URL

    https://<your-tenant-base-url>/api/drop-manager/v2/drop/${(event.payload["DROP_ID"])!}/request

    Header(s)

    Key

    Value

    Content-Type

    application/json
    Body
    JSON 
    { 
"dropRequestType": "DataDeletion", 
"templateId": "<published-web form-template-id>", 
"language": "en-us", 
"requestTypes": [ 
"Data Deletion" 
],
"subjectTypes": [
       "DROP Request"
   ]
}

  7. Click the Finish button.

  8. On the If no path, delete any the placeholder action.

  9. Click the Save button.