In-app consent

For an app screen, a backend sign-up, or any system that is not a web page with the script, Pactbase gives you two API calls and one link. All three need an API key with Read and record consent, and all three are called from your server. A key inside an app or web page lets anyone record consent for anyone.

1. Create the collection pointCopy Anchor Link

Consent Management, then Collection Points, type App screen (or API for a backend). Map its purposes. Make sure a Purpose Registry version is published. Without one, there is no notice to show and recording is refused with NO_NOTICE.

2. Show what you are askingCopy Anchor Link

curl -s "https://v1.pactbase.in/api/v1/collection-points/newsletter?lang=hi" \
  -H "Authorization: Bearer $PACTBASE_API_KEY"

The response lists each purpose with its basis:

• consent: show an unticked checkbox. DPDP section 6 needs an affirmative act.
• legitimate_use: show the text as information only, with no checkbox.

Show the current purposes right before you send, so the notice version recorded is the one the person saw.

3. Record the decisionCopy Anchor Link

curl -s -X POST "https://v1.pactbase.in/api/v1/consent" \
  -H "Authorization: Bearer $PACTBASE_API_KEY" -H "Content-Type: application/json" \
  -d '{
    "collection_point": "newsletter",
    "email": "asha@example.in",
    "decisions": { "PURPOSE_ID": true },
    "ip_address": "203.0.113.7",
    "user_agent": "AcmeApp/2.1 (Android 14)"
  }'

• Send the person's device IP and user agent. They are the evidence of the device as your system saw it. Left out, they are recorded as unknown, never as your server's address.
• Consent purposes left out of decisions count as not given.
• Withdrawal is the same call with the purpose set to false.
• Retries are safe: the same decisions for the same person and collection point within a minute return the first event with duplicate: true.
• The record appears in Consent Records, the person's Manage my data page and their receipt, and fires webhooks like any other consent.

Full request and response: Record consent.

4. Let a signed-in person manage their consentCopy Anchor Link

Your person is already signed in to your app, so they do not need an emailed code. Ask Pactbase for a one-use link and open it:

curl -s -X POST "https://v1.pactbase.in/api/v1/portal-sessions" \
  -H "Authorization: Bearer $PACTBASE_API_KEY" -H "Content-Type: application/json" \
  -d '{ "email": "asha@example.in" }'

Open the returned url at once in a browser tab, in-app browser or web view. Request a new link each time the person taps. See Portal sessions.

Which one for whatCopy Anchor Link