Protección

Consent Management

List, inspect, and revoke the consents customers have granted you, and keep your records in sync as they change.

Consent Management

Once a customer has authorised sharing, you hold an arrangement that you can inspect and revoke. This guide covers the consent lifecycle and the endpoints for managing it. For full request/response detail, see the Consent API reference.

StatusMeaning
activeThe consent is valid; you can request data within its scopes.
expiredThe sharing_duration has elapsed. Re-authorise to continue.
revokedThe customer or your app cancelled it. No further access.

List consents

Retrieve the consents a customer has granted you. Filter by status, customer_id, or scope, and page with a cursor.

curl --cert client.crt --key client.key \
  "https://api.provider.fiskil.com/consents?status=active&page_size=50" \
  -H "Authorization: Bearer ACCESS_TOKEN"
{
  "data": [
    {
      "consent_id": "cnst_8H2kQ9",
      "arrangement_id": "arr_5f9c2a1b",
      "status": "active",
      "app_name": "Your Company",
      "customer_id": "cust_31ab",
      "scopes": ["openid", "bank:accounts.basic:read", "bank:transactions:read"],
      "account_ids": ["acc_001", "acc_002"],
      "granted_at": "2026-05-01T09:30:00Z",
      "expires_at": "2026-07-30T09:30:00Z",
      "updated_at": "2026-05-01T09:30:00Z"
    }
  ],
  "next_cursor": null
}
curl --cert client.crt --key client.key \
  https://api.provider.fiskil.com/consents/cnst_8H2kQ9 \
  -H "Authorization: Bearer ACCESS_TOKEN"

A customer can revoke at any time from Protección's consumer dashboard — and you should offer the same in your own app. Revoking immediately invalidates the arrangement and any tokens issued under it.

curl -X DELETE --cert client.crt --key client.key \
  https://api.provider.fiskil.com/consents/cnst_8H2kQ9 \
  -H "Authorization: Bearer ACCESS_TOKEN"

A 204 No Content confirms revocation. The consent's status becomes revoked.

Revocation is permanent. To resume sharing after revoking, run a fresh consent authorisation.

Keep your records in sync

Consents change without your involvement — customers revoke, and durations expire. Keep your side accurate two ways:

Incremental polling

Periodically list consents with updated_after set to your last sync timestamp to fetch only what changed.

Webhooks

Subscribe to consent lifecycle notifications so you're told when a consent is revoked or expires, in near real time.

curl --cert client.crt --key client.key \
  "https://api.provider.fiskil.com/consents?updated_after=2026-05-01T00:00:00Z" \
  -H "Authorization: Bearer ACCESS_TOKEN"

Treat the consent status as the source of truth before every data pull. If a consent is expired or revoked, stop requesting and prompt the customer to re-authorise.

The consumer dashboard

Protección hosts a consent dashboard where customers can review every arrangement — which recipient, which scopes, which accounts, and when it expires — and revoke with one click. You don't build this; you just honour the outcome via webhooks or polling.

Next step