---
title: "Accept the currently published Terms and Privacy versions"
method: POST
path: "/account/legal-acceptances"
tags: ["Account"]
---

# Accept the currently published Terms and Privacy versions

`POST /account/legal-acceptances`

## Request

- Base URL: `https://api.flashdata.dev/v2`
- URL: `https://api.flashdata.dev/v2/account/legal-acceptances`
- Auth: API key in cookie `__Host-fd_session` and API key in header `X-CSRF-Token`

Appends an immutable legal acceptance, clears the migration gate, and rotates the Session. Stale submitted versions are rejected.

## Request body

- LegalAcceptanceRequest
  - `acceptedTerms` true, required
  - `termsVersion` string, required
  - `privacyVersion` string, required

## Response `200`

Legal acceptance recorded and Session rotated to full mode

- LoginResponse
  - `account` Account, required: Deleted accounts are only returned through authorized Admin projections; their identity fields are redacted.
    - `id` string, required
    - `name` string, required
    - `email` string, email, nullable, required
    - `status` 'pending_verification' | 'active' | 'suspended' | 'deleting' | 'deleted', required
    - `emailVerified` boolean, required
    - `legalAcceptanceRequired` boolean, required
    - `role` 'user' | 'admin', required
    - `timezone` string, required
    - `createdAt` string, date-time, required
    - `updatedAt` string, date-time, required
  - `csrfToken` string, required
  - `sessionMode` 'full' | 'email_verification' | 'legal_acceptance' | 'deletion_recovery', required

## Other responses

- `401`: Authentication required or invalid
- `403`: Authenticated but not permitted, or CSRF validation failed
- `404`: Resource not found or not owned by the caller
- `422`: Request validation failed

---

[API](https://skmtc.dev/flashdata/apis/flashdata-customer-api.md) · [All operations](https://skmtc.dev/flashdata/apis/flashdata-customer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/flashdata/apis/flashdata-customer-api/revisions/109179fe9313?raw)