# Show the data processing agreement

> Whether the account has signed a data processing agreement (AV-Vertrag); the PDF on request.

- Effect: Read - Changes nothing.
- Idempotent: yes
- Stability: beta
- MCP tool: `manitu_account_gdpr_dpa_get` on https://mcp.manitu.de/mcp
- REST: `POST https://api.manitu.de/v1/account/gdpr/dpa/get`
- Needs: `account`
- Page: /reference/account/gdpr/dpa/get/

## MCP tool

`manitu_account_gdpr_dpa_get`

### Description for the model

Shows whether the manitu customer account this connection works in has signed a data processing agreement with manitu (AV-Vertrag, GDPR art. 28), when, and whether one can be signed. Leave include_file out to answer questions about it; ask for it only when the customer needs the PDF itself - it comes base64-encoded and is long. Signing works only in the customer panel. It changes nothing.

### Arguments

- `include_file` (boolean) - true: the signed agreement as PDF as well, base64. Left out: no file.

### Example

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "manitu_account_gdpr_dpa_get",
    "arguments": {}
  }
}
```

## REST

`POST https://api.manitu.de/v1/account/gdpr/dpa/get`

### Authentication

One of `X-API-Key`, `Authorization: Bearer …` - never more than one in a request.

### Request body

JSON; unknown fields are refused.

- `include_file` (boolean) - true: the signed agreement as PDF as well, base64. Left out: no file.

### Response

In `data`; the rest of the body as on every call.

- `data_processing_agreement` (object, required)
  - `data_processing_agreement.account_id` (integer, required) - The customer account - its id is also its customer number.
  - `data_processing_agreement.is_available` (boolean, required) - Whether manitu offers this account to sign a data processing agreement.
  - `data_processing_agreement.is_signed` (boolean, required) - Whether the account has signed one.
  - `data_processing_agreement.signed_at` (string | null, required) - When it was signed; null: not signed. (format `date-time`)
- `file` (object | null, required) - The signed agreement as PDF if include_file was asked and there is one; else null.
  - `file.filename` (string, required)
  - `file.content_type` (string, required)
  - `file.data_base64` (string, required)

### Statuses

- `200` Success.
- `400` The request does not match the declared input schema.
- `401` No credential was presented, or it was not recognised.
- `403` The credential is not permitted to use this operation.
- `500` The server failed. Nothing about the request was wrong. Whether a change took effect is not known - check before trying it again.
- `503` The channel this operation forwards through is unavailable.

### Example

```sh
curl -X POST 'https://api.manitu.de/v1/account/gdpr/dpa/get' \
  -H 'X-API-Key: $API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{}'
```

## Example result

```json
{
  "data_processing_agreement": {
    "account_id": 12345,
    "is_available": true,
    "is_signed": true,
    "signed_at": "2026-10-23T12:00:00+02:00"
  },
  "file": {
    "filename": "string",
    "content_type": "string",
    "data_base64": "string"
  }
}
```