A GDPR purpose links a specific record to a definition of the purpose of personal data processing. Purposes cannot be created via the REST API through a separate call — they are created and removed using the nested elements vytvor-ucel and zrus-ucel inside the imported record. This guide describes both cases, including how to find the identifier of an existing purpose.

Prerequisites

For the nested elements to take effect, three conditions must be met:

GDPR processing is enabled in the company settings. Until it is enabled, the import will fail with an error and nothing will change.
The purpose definition is manually generatable. Purposes that ABRA Flexi creates on its own cannot be created via the API.
The purpose definition is applicable to the given record type. Each definition is tied to the type of record it belongs to — a definition for issued invoices cannot be used for a received invoice.

⚠️ While GDPR processing is disabled, the ucel and definice-ucelu records are also unavailable — querying them returns a akcePristupOdepren error.

Creating a purpose

A purpose is created using the vytvor-ucel element inside a record of a record type that supports GDPR:

<?xml version="1.0"?>
<winstrom version="1.0">
  <faktura-vydana>
    <!-- záznam, může být z kterékoliv podporované evidence -->
    <id>code:FAKTURA1</id>
    <!-- lze normálně uvést další vlastnosti záznamu jako při běžném importu -->
    <vytvor-ucel>
      <definiceUcelu>code:DEFINICE</definiceUcelu>
      <poznam>Uživatelská poznámka</poznam>
      <!-- nepovinné -->
    </vytvor-ucel>
  </faktura-vydana>
</winstrom>

The vytvor-ucel element accepts:

Element	Required	Description
`definiceUcelu`	yes	A reference to a record in the `definice-ucelu` record type. You can specify either the numeric ID or the code in the form `code:`.
`poznam`	no	A user note for the purpose.

The record that the purpose belongs to is identified the same way as in a regular import — by numeric ID, code, or external identifier.

ℹ️ In the return values, the parent record is listed as updated, not the purpose — a created or removed purpose is not counted toward created or deleted. An import with the ?dry-run=true parameter only validates the input and does not create the purpose.

Removing a purpose

A purpose is unlinked from the record and deleted using the zrus-ucel element, into which you enter the purpose identifier:

<?xml version="1.0"?>
<winstrom version="1.0">
  <faktura-vydana>
    <!-- záznam, může být z kterékoliv podporované evidence -->
    <id>code:FAKTURA1</id>
    <!-- lze normálně uvést další vlastnosti záznamu jako při běžném importu -->
    <zrus-ucel>
      <id>1</id>
    </zrus-ucel>
  </faktura-vydana>
</winstrom>

Finding the purpose identifier

The purpose identifier is obtained by querying the specific record type. Record types that support GDPR contain the ucely relation:

GET https://demo.flexibee.eu/c/demo/faktura-vydana/1.json?relations=ucely

The response contains the identifiers of the purposes linked to the record:

{
  "winstrom": {
    "@version": "1.0",
    "faktura-vydana": [
      {
        "id": "1",
        "ucely": [
          { "id": "1" }
        ]
      }
    ]
  }
}

Details about purposes are returned by a separate record type, ucel — besides the linked definition, it also contains the validity of the purpose and the pozastaveno and vyreseno flags:

GET https://demo.flexibee.eu/c/demo/ucel.json?detail=full

Record types with the ucely relation

The following record types have the ucely relation:

Area	Record type
Address book	`adresar`, `kontakt`
Invoices and other receivables and payables	`faktura-vydana`, `faktura-prijata`, `pohledavka`, `zavazek`
Business documents	`objednavka-prijata`, `nabidka-vydana`, `poptavka-prijata`, and other business documents
Cash and internal documents	`banka`, `pokladni-pohyb`, `interni-doklad`
Warehouse	`skladovy-pohyb`
Contracts and orders	`smlouva`, `zakazka`

📝 The API silently ignores an unknown relation name — in that case, no relation will appear in the response. If the ucely key is missing from the response, the record type either does not support GDPR, or GDPR processing is disabled.

Error states

All of the cases listed below return 400, and the entire import is not performed:

Error code	Cause
`gdprVypnuto`	GDPR processing is disabled in the company settings.
`definiceUceluNegener`	The specified purpose definition is not manually generatable — ABRA Flexi creates purposes based on it on its own.
`definiceUceluNeVEvid`	The specified purpose definition is not applicable to the record type you are importing into.
`nestedObjectNotFound`	The `definiceUcelu` element refers to a non-existent purpose definition, or the `id` element inside `zrus-ucel` refers to a non-existent purpose.

Creating and Deleting a GDPR Purpose