---
title: "Record consent (consumer)"
method: POST
path: "/user/payment-account/consent"
tags: ["Consent"]
---

# Record consent (consumer)

`POST /user/payment-account/consent`

## Request

- Base URL: `https://www.sandbox.striga.com/api/v1`
- URL: `https://www.sandbox.striga.com/api/v1/user/payment-account/consent`
- Auth: API key in header `api-key` and API key in header `Authorization`

Records the user's acceptance of the Payment Account terms.

The **first acceptance wins**: re-posting `"accepted": true` for a user who already consented leaves the original consent record — including its acceptance date — unchanged. Recording `"accepted": false` withdraws consent: the user’s third-party transactions are refused from then on.

`ip` defaults to the source IP of this API request. When calling from your backend — the normal integration pattern — pass the **end user's** IP explicitly, otherwise your server's IP is recorded on the consent record.

`dateAccepted` defaults to the server time of the call.

## Request body

- SetUserConsentRequest
  - `userId` string, uuid, required: The user recording consent.
  - `accepted` boolean, required: `true` records acceptance of the Payment Account terms; `false` withdraws it. Must be a JSON boolean — the string `"true"` is rejected with a validation error.
  - `termsVersion` string: The version of the terms document you displayed to the user.
  - `termsUri` string, uri: Where the displayed terms document is hosted.
  - `dateAccepted` string, date-time: ISO 8601 timestamp of the acceptance. Defaults to the server time of the call.
  - `ip` string: The end user's IP address (IPv4 or IPv6). Defaults to the source IP of this API request — **pass this explicitly when calling from your backend**, otherwise your server's IP is recorded.

## Response `200`

Consent recorded. The response echoes the stored record.

- UserConsentResponse
  - `userId` string, uuid, required
  - `paymentAccountConsent` ConsentRecord, required: The stored consent record. Optional fields are present only when they were supplied (or defaulted) on the recording call.
    - `accepted` boolean, required
    - `dateAccepted` string, date-time, required
    - `ip` string
    - `termsUri` string, uri
    - `termsVersion` string

## Other responses

- `400`: Validation failure (`errorCode` `00002` — the message names the offending field, e.g. `Invalid userId`, `accepted must be a boolean`; note that `accepted` must be a JSON boolean — the string `"true"` is rejected), or the user does not exist (`errorCode` `30005`).
- `401`: Missing or invalid `api-key` or HMAC signature.
- `403`: `errorCode` `30042`: your application does not have the `SET_PAYMENT_ACCOUNT_CONSENT` permission. `errorCode` `30043` / `32017`: the user's account status blocks the call (inaccessible / terminated). Suspended users **can** record consent.
- `404`: `errorCode` `30005`: the user was not found in this application.

---

[API](https://skmtc.dev/striga/apis/payment-accounts-third-party-payments.md) - [All operations](https://skmtc.dev/striga/apis/payment-accounts-third-party-payments/llms.txt) - [OpenAPI document](https://skmtc.dev/striga/apis/payment-accounts-third-party-payments/revisions/61bef9935c6d?raw)