Processing rests on one ground: the subject's consent (freely given, informed, in writing or a form allowing consent to be inferred, including ticking a box at e-commerce registration, provided the system allows no processing before the box is ticked), a legal permission for a controller's powers, entry into or performance of a transaction with or for the subject, vital interests, a legal obligation of the controller, or the legitimate interests of the controller or a recipient unless overridden by the subject's fundamental rights and freedoms.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.