Consent Admin Endpoint¶

The Consent Admin Endpoint (/admin) provides a REST API for managing consents from administrative portals — such as a Self-Care Portal. It exposes operations for searching, revoking, auditing, and inspecting consents stored in the WSO2 Financial Services Accelerator consent core service.

User Permission Model¶

Two user roles interact with this API:

Note: The permission check applies only to GET /admin/search and DELETE /admin/revoke. All other endpoints do not enforce this user-level restriction.

Endpoints¶

Search Consents¶

Searches detailed consent records with optional filtering parameters.

GET /admin/search

Query Parameters¶

Sample Request¶

curl -X GET \
  'https://<IS_HOSTNAME>:9446/api/fs/consent/admin/[email protected]&consentStatuses=authorised&limit=10&offset=0' \
  -H 'Authorization: Bearer eyJhbGciOiJSUzI1NiJ9...'

Sample Response — 200 OK¶

{
  "data": [
    {
      "consentID": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
      "clientID": "YwqKLFEtG9f23zMAEHtaBC71bvAa",
      "consentType": "accounts",
      "currentStatus": "authorised",
      "createdTime": 1710000000,
      "updatedTime": 1710003600,
      "receipt": {
        "Data": {
          "Permissions": ["ReadAccountsDetail", "ReadBalances", "ReadTransactionsDetail"],
          "ExpirationDateTime": "2026-12-31T00:00:00Z"
        }
      },
      "consentAttributes": {
        "x-fapi-interaction-id": "93bac548-d2de-4546-b106-880a5018460d"
      },
      "authorizationResources": [
        {
          "authorizationID": "auth-001",
          "userID": "[email protected]",
          "authorizationStatus": "authorised",
          "authorizationType": "primary_member"
        }
      ],
      "consentMappingResources": [
        {
          "mappingID": "map-001",
          "authorizationID": "auth-001",
          "accountID": "30080012343456",
          "permission": "primary_member",
          "mappingStatus": "active"
        }
      ]
    }
  ],
  "metadata": {
    "count": 1,
    "offset": 0,
    "limit": 10,
    "total": 1
  }
}

Revoke Consent¶

Revokes an authorised consent. Optionally invokes a pre-process extension before revoking.

DELETE /admin/revoke

Query Parameters¶

Sample Request — CCO Revoking Any Consent¶

curl -X DELETE \
  'https://<IS_HOSTNAME>:9446/api/fs/consent/admin/revoke?consentId=a1b2c3d4-e5f6-7890-abcd-ef1234567890&[email protected]' \
  -H 'Authorization: Bearer eyJhbGciOiJSUzI1NiJ9...'

Sample Response — 204 No Content¶

HTTP/1.1 204 No Content

Search Consent Status Audit Records¶

Returns the status change audit trail for one or more consents.

GET /admin/search/consent-status-audit

Query Parameters¶

Sample Request¶

curl -X GET \
  'https://<IS_HOSTNAME>:9446/api/fs/consent/admin/search/consent-status-audit?consentIDs=a1b2c3d4-e5f6-7890-abcd-ef1234567890&limit=5' \
  -H 'Authorization: Bearer eyJhbGciOiJSUzI1NiJ9...'

Sample Response — 200 OK¶

{
  "data": [
    {
      "statusAuditID": "audit-001",
      "consentID": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
      "currentStatus": "authorised",
      "actionTime": 1710003600,
      "reason": "User authorised consent",
      "actionBy": "[email protected]",
      "previousStatus": "awaitingAuthorisation"
    },
    {
      "statusAuditID": "audit-002",
      "consentID": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
      "currentStatus": "awaitingAuthorisation",
      "actionTime": 1710000000,
      "reason": "Consent created",
      "actionBy": "YwqKLFEtG9f23zMAEHtaBC71bvAa",
      "previousStatus": null
    }
  ],
  "metadata": {
    "count": 2,
    "offset": null,
    "limit": 5,
    "total": 2
  }
}

Search Consent File¶

Retrieves the file content uploaded as part of a file-type consent (e.g., bulk payment files).

GET /admin/search/consent-file

Query Parameters¶

Sample Request¶

curl -X GET \
  'https://<IS_HOSTNAME>:9446/api/fs/consent/admin/search/consent-file?consentId=a1b2c3d4-e5f6-7890-abcd-ef1234567890' \
  -H 'Authorization: Bearer eyJhbGciOiJSUzI1NiJ9...'

Sample Response — 200 OK¶

{
  "consentFile": "<pain.001.001.03 xmlns=\"urn:iso:std:iso:20022:...\">\n  <GrpHdr>...</GrpHdr>\n</pain.001.001.03>"
}

Get Consent Amendment History¶

Retrieves the full amendment history for a consent alongside its current state. Optionally enriched via the ENRICH_CONSENT_SEARCH_RESPONSE extension.

GET /admin/consent-amendment-history

Query Parameters¶

Sample Request¶

curl -X GET \
  'https://<IS_HOSTNAME>:9446/api/fs/consent/admin/consent-amendment-history?consentId=a1b2c3d4-e5f6-7890-abcd-ef1234567890' \
  -H 'Authorization: Bearer eyJhbGciOiJSUzI1NiJ9...'

Sample Response — 200 OK¶

{
  "consentID": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "currentConsent": {
    "consentID": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "clientID": "YwqKLFEtG9f23zMAEHtaBC71bvAa",
    "consentType": "accounts",
    "currentStatus": "authorised",
    "createdTime": 1710000000,
    "updatedTime": 1712000000,
    "receipt": {
      "Data": {
        "Permissions": ["ReadAccountsDetail", "ReadBalances"],
        "ExpirationDateTime": "2027-01-01T00:00:00Z"
      }
    }
  },
  "amendmentHistory": [
    {
      "historyID": "hist-001",
      "amendedReason": "User extended expiry date",
      "amendedTime": 1712000000,
      "consentData": {
        "consentID": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
        "currentStatus": "authorised",
        "receipt": {
          "Data": {
            "Permissions": ["ReadAccountsDetail", "ReadBalances"],
            "ExpirationDateTime": "2026-12-31T00:00:00Z"
          }
        }
      }
    }
  ],
  "metadata": {
    "amendmentCount": 1
  }
}

Flow With ENRICH_CONSENT_SEARCH_RESPONSE Extension Enabled¶

The handler posts the raw amendmentHistory array to the external service with searchType: "AMENDMENT_HISTORY". The enriched array returned by the service replaces the raw history in the response.

Trigger Consent Expiry Job¶

Manually triggers the background job that marks expired consents as expired.

GET /admin/expire-consents

Sample Request¶

curl -X GET \
  'https://<IS_HOSTNAME>:9446/api/fs/consent/admin/expire-consents' \
  -H 'Authorization: Bearer eyJhbGciOiJSUzI1NiJ9...'

Sample Response — 204 No Content¶

HTTP/1.1 204 No Content

Search Consent Attributes¶

Searches consents by custom attribute key (and optionally by value). Useful for looking up consents tagged with domain-specific metadata.

GET /admin/search/consent-attributes

Query Parameters¶

Sample Request — Search by Key and Value¶

curl -X GET \
  'https://<IS_HOSTNAME>:9446/api/fs/consent/admin/search/consent-attributes?key=x-fapi-interaction-id&value=93bac548-d2de-4546-b106-880a5018460d' \
  -H 'Authorization: Bearer eyJhbGciOiJSUzI1NiJ9...'

Sample Response — 200 OK (key + value)¶

{
  "data": [
    {
      "consentID": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
      "attributeKey": "x-fapi-interaction-id",
      "attributeValue": "93bac548-d2de-4546-b106-880a5018460d"
    }
  ]
}

Sample Request — Search by Key Only¶

curl -X GET \
  'https://<IS_HOSTNAME>:9446/api/fs/consent/admin/search/consent-attributes?key=x-fapi-interaction-id' \
  -H 'Authorization: Bearer eyJhbGciOiJSUzI1NiJ9...'

Sample Response — 200 OK (key only)¶

{
  "data": [
    {
      "consentID": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
      "attributeKey": "x-fapi-interaction-id",
      "attributeValue": "93bac548-d2de-4546-b106-880a5018460d"
    },
    {
      "consentID": "b9c8d7e6-f5a4-3210-bcde-fa0987654321",
      "attributeKey": "x-fapi-interaction-id",
      "attributeValue": "71adb321-1cbd-4329-a701-550a9014571e"
    }
  ]
}

Service Extensions¶

Two service extension points can optionally delegate processing to an external HTTP service. They are activated via configuration:

API Summary¶