Braze
Authentication & Authorization
Credentials
- Braze connects via API key.
- API key is set with the HTTP Authorization request header.
- Your API keys can be created in the Braze dashboard in the Developer Console. See Braze Connection Instructions.
- Publicly exposing your API keys can allow unauthorized access to the Braze API endpoints, and your Braze data by a third party. DataGrail stores your API keys encrypted and protected.
Permissions
API key permissions should be assigned a user or group to limit DataGrail access to certain Braze API calls. See Braze Connection Instructions.
The next permissions are required and should be set to connect DataGrail integration:
- users.export.ids – query for user profile information by identifier.
Additionally, depending on the required integration capabilities, DataGrail requires the following permissions to be set:
Deletion
- users.delete – delete any user.
Do Not Sell
- users.track – record user attributes, custom events, and purchases.
Responsible Data Discovery (RDD)
- email.unsubscribe - query for unsubscribed email addresses;
- users.export.segment - query for user profile information by Segment;
- segments.list - query for a list of Segments;
- catalogs.get - get a list of Catalogs;
- catalogs.get_items - get items preview from an existing catalog.
Base URL
Braze manages a number of different instances for our dashboard and REST Endpoints. Use the correct REST endpoint based on which instance you are provisioned to, e.g. https://dashboard-03.braze.com.
See Braze Connection Instructions.
Endpoints Utilized
DataGrail uses the following endpoints to verify API connection:
- POST {BASE_URL}/users/export/ids
- GET {BASE_URL}/email/unsubscribes (if RDD enabled).
Limits
- DataGrail supports requests throttling to stay within 70-80% of specified service rate limits.
- DataGrail processes API responses with HTTP 429 status to interrupt requests, waiting and retrying (using an exponential backoff strategy).
Access
For an access request, DataGrail will take the following actions:
- Export data from the user profile by the Data Subject email.
- For all objects found, DataGrail will return all available fields. You can edit which objects and fields you want to provide to the Data Subject via our Portal Requests.
Endpoints Utilized
- POST {BASE_URL}/users/export/ids
Deletion
For a deletion request, DataGrail will take the following actions:
- Export data from the user profile by the Data Subject email.
- Delete any user profile by specifying a Braze user identifier.
Endpoints Utilized
- POST {BASE_URL}/users/export/ids
- POST {BASE_URL}/users/delete
Do Not Sell
For a Do Not Sell request, DataGrail will take the following actions:
- Export data from the user profile by the Data Subject email.
- Update attributes to set
opted_out
value for all detected user profiles by specifying a Braze user identifier.
opted_out
value is stored as one of the custom attributes of user attributes object in the format:
- “custom_attributes” => { “dg_opt_out” => true }
- “custom_attributes” => { “dg_opt_out” => false }
Endpoints Utilized
- POST {BASE_URL}/users/export/ids
- POST {BASE_URL}/users/track
Responsible Data Discovery
Data discovery is based on the principle of finding any and all personal data that's stored in a data system.
For discovery requests, DataGrail will take the following actions:
- Retrieve segment IDs and for each of them extract user data from the following fields:
- apps
- braze_id
- country
- custom_attributes
- custom_events
- devices
- dob
- external_id
- first_name
- gender
- home_city
- language
- last_coordinates
- last_name
- phone
- purchases
- time_zone
- total_revenue
- user_aliases
- Download extracted user data in zip files from AWS S3 or configured Cloud Storage
- Get a list of catalogs in a workspace
- For each catalog get item details.
- Sampling data for the next analysis and classification.
Endpoints Utilized
- GET {BASE_URL}/segments/list
- POST {BASE_URL}/users/export/segment
- GET {ZIPPED_USER_DATA_PATH}
- GET {BASE_URL}/catalogs
- GET {BASE_URL}/catalogs/{CATALOG_NAME}/items
Disclaimer: The information contained in this message does not constitute as legal advice. We would advise seeking professional counsel before acting on or interpreting any material.