--- title: "Create an account access consent" method: POST path: "/account-access-consents" tags: ["Accounts"] --- # Create an account access consent `POST /account-access-consents` ## Request - Base URL: `https://oba-auth.revolut.com` - URL: `https://oba-auth.revolut.com/account-access-consents` - Auth: API key in header `Authorization` Before you can access any data from a Revolut user, you must create an access consent to read data from the user's profile. :::note When you create an account access consent, you must include a specific permission that follows the rules in the table below; otherwise, you get a `400 Bad request` error. ::: **Request Permissions** | PERMISSIONS | DEPENDENCIES | |--|--| | **`ReadAccountsBasic`** | None | | **`ReadAccountsDetail`** | None| | **`ReadBalances`** | None| | **`ReadBeneficiariesBasic`** | None| | **`ReadBeneficiariesDetail`** | None| | **`ReadDirectDebits`** | None| | **`ReadScheduledPaymentsBasic`** | None| | **`ReadScheduledPaymentsDetail`** | None| | **`ReadStandingOrdersBasic`** | None| | **`ReadStandingOrdersDetail`** | None| | **`ReadTransactionsBasic`** | None| | **`ReadTransactionsCredits`** | `ReadTransactionsBasic` OR `ReadTransactionsDetail` | | **`ReadTransactionsDebits`** | `ReadTransactionsBasic` OR `ReadTransactionsDetail` | | **`ReadTransactionsDetail`** | None | See also [Tutorials: Get account and transaction information](https://developer.revolut.com/docs/guides/build-banking-apps/tutorials/get-account-and-transaction-information#2-create-an-account-access-consent). ## Headers - `x-fapi-financial-id` string, required - `x-fapi-customer-last-logged-time` string - `x-fapi-customer-ip-address` string - `x-fapi-interaction-id` string - `Authorization` string, required - `x-customer-user-agent` string ## Request body - OBReadConsent1 - `Data` OBReadData1, required - `Permissions` OBExternalPermissions1Code[], required: Specifies the type of data access to the account. This is a list of the data clusters being consented by the [PSU](https://developer.revolut.com/docs/guides/build-banking-apps/glossary), and requested for authorisation with the [ASPSP](https://developer.revolut.com/docs/guides/build-banking-apps/glossary). - `ExpirationDateTime` string, date-time: Specifies the date and time the permission expires. If this is not specified, the permission is open ended. All dates in the JSON payloads are represented in [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) date-time format. All date-time fields in responses must include the timezone. For example: `2017-04-05T10:43:07+00:00`. - `TransactionFromDateTime` string, date-time: Specifies the start date and time for the transaction query period. If this is not specified, the start date is open ended, and data is returned from the earliest available transaction. All dates in the JSON payloads are represented in [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) date-time format. All date-time fields in responses must include the timezone. For example: `2017-04-05T10:43:07+00:00`. - `TransactionToDateTime` string, date-time: Specifies the end date and time for the transaction query period. If this is not specified, the end date is open ended, and data is returned to the latest available transaction. All dates in the JSON payloads are represented in [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) date-time format. All date-time fields in responses must include the timezone. For example: `2017-04-05T10:43:07+00:00`. - `Risk` OBRisk2, required: The Risk section contains the risk indicators that the initiating party sends to the [ASPSP](https://developer.revolut.com/docs/guides/build-banking-apps/glossary), which can be used to specify additional details for risk scoring for account information. ## Response `201` Account Access Consents Created - OBReadConsentResponse1 - `Data` object, required - `ConsentId` string, required: The unique ID that is assigned to identify the account access consent resource. - `CreationDateTime` string, date-time, required: The date and time when the account access consent was created. All dates in the JSON payloads are represented in [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) date-time format. All date-time fields in responses must include the timezone. For example: `2017-04-05T10:43:07+00:00`. - `Status` 'Authorised' | 'AwaitingAuthorisation' | 'Rejected' | 'Revoked', required: The status of the account access consent. - `StatusUpdateDateTime` string, date-time, required: The date and time when the account access consent was created. All dates in the JSON payloads are represented in [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) date-time format. All date-time fields in responses must include the timezone. For example: `2017-04-05T10:43:07+00:00`. - `Permissions` OBExternalPermissions1Code[], required: The type of data access to the account. - `ExpirationDateTime` string, date-time: The date and time when the permission expires. If this is not specified, the permission is open ended. All dates in the JSON payloads are represented in [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) date-time format. All date-time fields in responses must include the timezone. For example: `2017-04-05T10:43:07+00:00`. - `TransactionFromDateTime` string, date-time: The start date and time for the transaction query period. If this is not specified, the start date is open ended, and data is returned from the earliest available transaction. All dates in the JSON payloads are represented in [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) date-time format. All date-time fields in responses must include the timezone. For example: `2017-04-05T10:43:07+00:00`. - `TransactionToDateTime` string, date-time: The end date and time for the transaction query period. If this is not specified, the end date is open ended, and data is returned to the latest available transaction. All dates in the JSON payloads are represented in [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) date-time format. All date-time fields in responses must include the timezone. For example: `2017-04-05T10:43:07+00:00`. - `Risk` OBRisk2, required: The Risk section contains the risk indicators that the initiating party sends to the [ASPSP](https://developer.revolut.com/docs/guides/build-banking-apps/glossary), which can be used to specify additional details for risk scoring for account information. - `Links` Links, required: Links relevant to the payload. - `Self` string, uri, required: The absolute URI to the resource. - `Next` string, uri: The absolute URI to the next pagination resource. - `Prev` string, uri: The absolute URI to the previous pagination resource. - `Meta` Meta, required: Meta data relevant to the payload. - `TotalPages` integer: Used for pagination. Indicates how many pages of results are available. ## Other responses - `400`: Bad request - `401`: Unauthorized - `403`: Forbidden - `405`: Method Not Allowed - `406`: Not Acceptable - `415`: Unsupported Media Type - `429`: Too Many Requests - `500`: Internal Server Error --- [API](https://skmtc.dev/revolut/apis/open-banking-api.md) - [All operations](https://skmtc.dev/revolut/apis/open-banking-api/llms.txt) - [OpenAPI document](https://skmtc.dev/revolut/apis/open-banking-api/revisions/e2a5bcac7971?raw)