Manage account holder consent

After an account holder gives their consent, the third-party provider can check if it is still valid and see what they consented to. If an account holder wants to withdraw their consent, the third party provider can make a call to revoke that consent.

This page explains how you, as a third-party provider, use the /consents endpoint to:

• Check if an account holder's consent is still valid and how a third party provider can use the consent.
• Revoke consent on the account holder's behalf.

Requirements

Check if the account holder granted consent

To get the status of a previously granted consent:

1. Make a GET /consents/{consent_id}/status request, where consent_id is a unique identifier for a specific consent. This is the consent_id you saved in the create a consent step. In the headers, include a UUID for the X-Request-ID and the access_token you saved in the get and access token step.

2. In the response, check the consentStatus. This value indicates your current stage in the consent process. See the consentStatus for all possible values.

   Parameter	Description
   consentStatus	Status of consent. Possible values: received: The consent data have been received. The request will need to be repeated to check if its status updates to "valid" for use. rejected: The consent data have been rejected. This is a final status. valid: The consent is accepted and valid. revokedByPsu: The consent has been revoked by the account holder. expired: The consent expired. terminatedByTpp: The third-party provider has terminated the consent.
   psuMessage	Details regarding the account holder's consent.

Check the authorization status of an account holders consent

To get information about consent authorization and to determine where your account holder is in the authentication flow, for accessing account information, or to initiate payments:

1. Make a GET /consents/{consentId}/authorisations/{authorization-id-consent} request, where consent_id is a unique identifier for a specific consent and authorization-id-consent is a unique identifier for a specific consent authorization.

   • Note that this authorization-id-consent can be found in the create a consent response. This is the last set of characters at the end of thescaStatus link.

2. The response contains the authorization status, use this to determine what part of the authentication flow your account holder is currently in. See scaStatus for all possible values.

   Parameter

   Description

   scaStatus

   Status of authorization. Possible values: scaMethodSelected: The account holder/third-party provider has selected the related Strong Customer Authentication (SCA) routine. started: The addressed SCA routine has been started. finalised: The SCA routine has been finalized successfully (including a potential confirmation command). This is a final status of the authorization resource. failed: The SCA routine failed. This is a final status of the authorization resource.

Check consent details of an account holder

To retrieve the details of a previously granted consent, such as the consent status, expiration date, scope, and other related information:

1. Make a GET /consents/{consent_id} request, where consent_id is a unique identifier for a specific consent.

2. Check the response for details about account access, validity period, consent status, and links to available resources.

Delete a consent

Revoking consent withdraws the account holder's authorization to access account information or initiate payments. To revoke a previously granted consent:

1. Make a DELETE /consents/{consent_id} request, where consent_id is a unique identifier for a specific consent.

2. If the deactivation was successful, you'll get an HTTP 200 OK response. The revokedByPsu status will appear in future calls when you check if the account holder granted consent.