Consent Management
List, inspect, and revoke the consents customers have granted you, and keep your records in sync as they change.
Consent Management
Once a customer has authorised sharing, you hold an arrangement that you can inspect and revoke. This guide covers the consent lifecycle and the endpoints for managing it. For full request/response detail, see the Consent API reference.
The consent lifecycle
| Status | Meaning |
|---|---|
active | The consent is valid; you can request data within its scopes. |
expired | The sharing_duration has elapsed. Re-authorise to continue. |
revoked | The customer or your app cancelled it. No further access. |
List consents
Retrieve the consents a customer has granted you. Filter by status, customer_id, or scope, and page with a cursor.
curl --cert client.crt --key client.key \
"https://api.provider.fiskil.com/consents?status=active&page_size=50" \
-H "Authorization: Bearer ACCESS_TOKEN"{
"data": [
{
"consent_id": "cnst_8H2kQ9",
"arrangement_id": "arr_5f9c2a1b",
"status": "active",
"app_name": "Your Company",
"customer_id": "cust_31ab",
"scopes": ["openid", "bank:accounts.basic:read", "bank:transactions:read"],
"account_ids": ["acc_001", "acc_002"],
"granted_at": "2026-05-01T09:30:00Z",
"expires_at": "2026-07-30T09:30:00Z",
"updated_at": "2026-05-01T09:30:00Z"
}
],
"next_cursor": null
}Inspect a single consent
curl --cert client.crt --key client.key \
https://api.provider.fiskil.com/consents/cnst_8H2kQ9 \
-H "Authorization: Bearer ACCESS_TOKEN"Revoke a consent
A customer can revoke at any time from Protección's consumer dashboard — and you should offer the same in your own app. Revoking immediately invalidates the arrangement and any tokens issued under it.
curl -X DELETE --cert client.crt --key client.key \
https://api.provider.fiskil.com/consents/cnst_8H2kQ9 \
-H "Authorization: Bearer ACCESS_TOKEN"A 204 No Content confirms revocation. The consent's status becomes revoked.
Revocation is permanent. To resume sharing after revoking, run a fresh consent authorisation.
Keep your records in sync
Consents change without your involvement — customers revoke, and durations expire. Keep your side accurate two ways:
Incremental polling
Periodically list consents with updated_after set to your last sync timestamp to fetch only what changed.
Webhooks
Subscribe to consent lifecycle notifications so you're told when a consent is revoked or expires, in near real time.
curl --cert client.crt --key client.key \
"https://api.provider.fiskil.com/consents?updated_after=2026-05-01T00:00:00Z" \
-H "Authorization: Bearer ACCESS_TOKEN"Treat the consent status as the source of truth before every data pull. If a consent is expired or revoked, stop requesting and prompt the customer to re-authorise.
The consumer dashboard
Protección hosts a consent dashboard where customers can review every arrangement — which recipient, which scopes, which accounts, and when it expires — and revoke with one click. You don't build this; you just honour the outcome via webhooks or polling.