A consumer may obtain from the controller a list of the third parties to which it sold their personal data or, if it keeps no consumer-level list, a list of all third parties to which it has sold personal data, without revealing trade secrets.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.