A controller must establish, and describe in its privacy notice, one or more secure and reliable means to submit rights requests, taking into account how consumers normally interact with it, secure communication and identity verification. It may not require a consumer to create a new account, though it may require use of an existing one.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.