---
title: "Record consent (business)"
method: POST
path: "/business/payment-account/consent"
tags: ["Consent"]
---

# Record consent (business)

`POST /business/payment-account/consent`

## Request

- Base URL: `https://www.sandbox.striga.com/api/v1`
- URL: `https://www.sandbox.striga.com/api/v1/business/payment-account/consent`
- Auth: API key in header `api-key` and API key in header `Authorization`

Records the business's acceptance of the Payment Account terms, given by its director / primary user in your application. Consent is recorded once for the business entity, not per member.

Send the real `businessId` — not a sub-admin id.

Semantics match the consumer endpoint: re-posting replaces the record wholesale, `"accepted": false` withdraws consent, `ip` defaults to the request's source IP (pass the end user's IP explicitly from your backend), and `dateAccepted` defaults to the server time.

## Request body

- SetBusinessConsentRequest
  - `businessId` string, uuid, required: The business recording consent. Send the real `businessId`, not a sub-admin id.
  - `accepted` boolean, required: `true` records acceptance of the Payment Account terms; `false` withdraws it. Must be a JSON boolean — the string `"true"` is rejected with a validation error.
  - `termsVersion` string: The version of the terms document you displayed to the user.
  - `termsUri` string, uri: Where the displayed terms document is hosted.
  - `dateAccepted` string, date-time: ISO 8601 timestamp of the acceptance. Defaults to the server time of the call.
  - `ip` string: The end user's IP address (IPv4 or IPv6). Defaults to the source IP of this API request — **pass this explicitly when calling from your backend**, otherwise your server's IP is recorded.

## Response `200`

Consent recorded. The response echoes the stored record.

- BusinessConsentResponse
  - `businessId` string, uuid, required
  - `paymentAccountConsent` ConsentRecord, required: The stored consent record. Optional fields are present only when they were supplied (or defaulted) on the recording call.
    - `accepted` boolean, required
    - `dateAccepted` string, date-time, required
    - `ip` string
    - `termsUri` string, uri
    - `termsVersion` string

## Other responses

- `400`: Validation failure (`errorCode` `00002` — the message names the offending field; `accepted` must be a JSON boolean, the string `"true"` is rejected), or the business does not exist (`errorCode` `30005`).
- `401`: Missing or invalid `api-key` or HMAC signature.
- `403`: `errorCode` `30042`: your application does not have the `BUSINESS_SET_PAYMENT_ACCOUNT_CONSENT` permission. `errorCode` `30043` / `32017`: the business's account status blocks the call (inaccessible / terminated). Suspended businesses **can** record consent.
- `404`: `errorCode` `30005`: the business was not found in this application.

---

[API](https://skmtc.dev/striga/apis/payment-accounts-third-party-payments.md) - [All operations](https://skmtc.dev/striga/apis/payment-accounts-third-party-payments/llms.txt) - [OpenAPI document](https://skmtc.dev/striga/apis/payment-accounts-third-party-payments/revisions/61bef9935c6d?raw)