# Sign the data processing agreement

> The account signs the data processing agreement (AV-Vertrag) - with a session only.

- Effect: Write - Changes the account. Agents ask first.
- Idempotent: no
- Stability: beta
- REST: `POST https://api.manitu.de/v1/account/gdpr/dpa/create`
- Needs: `account`
- Page: /reference/account/gdpr/dpa/create/

**Changes the account. Agents say what will happen and wait for an explicit yes before calling it.**

## REST

`POST https://api.manitu.de/v1/account/gdpr/dpa/create`

### Authentication

One of `X-API-Key`, `Authorization: Bearer …` - never more than one in a request.

### Request body

JSON; unknown fields are refused.

- `signer_name` (string, required) - Who signs. (minLength `1`; maxLength `100`)
- `signer_position` (string | null) - His position in the company, if any. (maxLength `100`)
- `signature_image` (string, required) - The signature as a PNG data URL (data:image/png;base64,...). (maxLength `2000000`; pattern `"^data:image/png;base64,[A-Za-z0-9+/]+={0,2}$"`)

### Response

In `data`; the rest of the body as on every call.

- `account_id` (integer, required) - The customer account - its id is also its customer number.
- `is_available` (boolean, required) - Whether manitu offers this account to sign a data processing agreement.
- `is_signed` (boolean, required) - Whether the account has signed one.
- `signed_at` (string | null, required) - When it was signed; null: not signed. (format `date-time`)

### Statuses

- `200` Success.
- `400` The request does not match the declared input schema.
- `401` No credential was presented, or it was not recognised.
- `403` The credential is not permitted to use this operation.
- `500` The server failed. Nothing about the request was wrong. Whether a change took effect is not known - check before trying it again.
- `503` The channel this operation forwards through is unavailable.

### Example

```sh
curl -X POST 'https://api.manitu.de/v1/account/gdpr/dpa/create' \
  -H 'X-API-Key: $API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{"signer_name":"string","signature_image":"string"}'
```

## Example result

```json
{
  "account_id": 12345,
  "is_available": true,
  "is_signed": true,
  "signed_at": "2026-10-23T12:00:00+02:00"
}
```