API
Record consent
Record a decision made in your own app, backend or form tool.
POST /api/v1/consent
Records one decision. It needs a key with Read and record consent (consent:write). A read-only key gets 403 MISSING_SCOPE. Call it from your server.
curl -s -X POST "https://v1.pactbase.in/api/v1/consent" \
-H "Authorization: Bearer $PACTBASE_API_KEY" -H "Content-Type: application/json" \
-d '{
"collection_point": "newsletter",
"email": "asha@example.in",
"decisions": { "36ff...": true },
"website": "shop.example.in",
"ip_address": "203.0.113.7",
"user_agent": "AcmeApp/2.1 (Android 14)"
}'| Field | |
|---|---|
collection_point | Required. The collection point's slug or id. It must be active |
email | Required. The data principal. Trimmed and lower-cased |
decisions | Required. purpose_id to true or false. Consent purposes left out count as not given. Only the collection point's own purposes are accepted. Legitimate-use purposes are recorded as notice shown, whatever is sent |
website | Optional. One of your websites, by hostname, when the decision was made on one |
ip_address, user_agent | Optional, but send them. They are the evidence of the person's device as your system saw it. Left out, they are recorded as unknown, never as your server's address |
Answer 201 Created, or 200 for a duplicate:
{
"consent_event_id": "5b0e...",
"duplicate": false,
"collection_point": { "id": "...", "slug": "newsletter", "name": "Newsletter signup" },
"notice_version": "4",
"purposes": [
{ "id": "36ff...", "name": "Newsletter", "lawful_basis": "consent", "status": "granted" },
{ "id": "8a1c...", "name": "Order delivery", "lawful_basis": "legitimate_use", "status": "notice_shown" }
]
}How it is recorded
- One consent event. The same ledger rows as a consent block on a web form, with
source: "api", the collection point, and the notice version live at that moment. Show the person the current purposes right before you send. - Retries are safe. The same decisions for the same person and collection point within a minute return the first event with
duplicate: true. Nothing new is written. - Withdrawal. Send the purpose as
false. Webhooks sendconsent.updated, andconsent.withdrawnfor a purpose that was granted. The record appears in Consent Records, the person's Manage my data page and their receipt. - Usage. Every call is in the key's usage log.
Which collection point type uses what
| Type | How consent is recorded |
|---|---|
| Web form | The consent block inside the form |
| App screen | The app shows the collection point, and your backend sends this call |
| API | Your backend, a CRM, or n8n (a form tool's webhook, then n8n, then this call) |