BUburodeingresos
Consents

Create Consent

Changed on

Deprecated. Send ip_address in POST /verifications instead (or in each item of POST /verifications/bulk). This endpoint keeps working until November 15, 2026, when it is removed.

Registers a consent for an identifier. Accepts an 18-char CURP (individual) or a 12-char RFC (business). The payload is the same in both cases.

A consent expires 365 days after creation. After that, POST /verifications for the identifier returns consent_expired until you create a new consent. Data from verifications already completed can still be read.

post/consents

Request

Request body

identifierstring required

Identifier of the data owner: 18-char CURP for individuals or 12-char RFC for businesses.

ip_addressstring required

IP address of the user giving consent. Must be a valid IPv4 (e.g., 192.168.2.74) or IPv6 (e.g., 2001:db8::1) address.

privacy_notice_urlstring uri required

URL to the privacy notice accepted by the user.

Example request

{
  "identifier": "CUAI911021MOCRQS09",
  "ip_address": "192.168.2.74",
  "privacy_notice_url": "https://mycompany.com/privacy-policy"
}

Response

Consent created successfully.

idstring uuid

Unique identifier for the created consent.

identifierstring

The CURP (individual, 18 chars) or RFC (business, 12 chars) associated with the consent.

ip_addressstring

The IP address of the user who gave consent. Returned as either an IPv4 or IPv6 address.

privacy_notice_urlstring uri

URL of the privacy notice accepted by the user.

created_atstring date-time

Timestamp of when the consent was created.

expires_atstring date-time

Timestamp of when the consent expires (365 days after creation). After it, new verifications for the identifier need a new consent; data already obtained can still be read.

Changes