Consent Management

Overview

Open Finance rules require that your end users can access, view and manage the long-lived consents and payment history authorized between their bank and your application. This must be exposed through a dedicated management interface.

To satisfy this, call manageConsents() in the Link SDK. This presents the management interface to the user, where they can view and manage everything authorized between their bank account and your application:

• Account-on-File consents and their associated payment history
• Single Instant Payments history
• Data consents

manageConsents({
    app_token: "your_app_token",
    customer_id: "your_customer_id",
    access_token: "your_customer_scoped_access_token",
    consent_id: "optional_consent_id", // OPTIONAL
    consent_type: "optional_consent_types" // OPTIONAL
  })

• Passing the optional consent_id field launches manageConsents() and lands the user directly on the consent overview screen for that consent_idskipping the consent selection menu (see second screen below).
• Passing theconsent_type query parameter is recommended (payment, dataor payment_history). The consent_type renders only the tabs for the passed value(s). If multiple values are passed, all corresponding tabs render. The user lands on the tab for the first passed consent_type by default.
• The consent type mapping and what renders is as follows:

• If no consent_type value is passed, manageConsents() renders payment, payment_history and data tabs, with the user landing on the data tab by default.
• If you have an Account-on-File integration only, we recommend passing consent_type: payment- this will render a tab with the users active and historic Account-on-File consents details and a payment history tab containing a full history of all payments associate with their consents

See UI/UX example below:

Consent revocation

Open Finance rules mean that it is mandatory that customers must be able to 'Revoke' (Cancel) an 'Authorised' long lived consent at anytime including Account-on-file payments consents. Customers can do this via the Consent Management Interface called from your application via the Link SDK.

In the scenario, that a customers does 'revoke' a consent, Lean will notify you with a consent.status.updated web hook to ensure you are kept updated.

See UX example below:

👍

Customers can also 'revoke' consent directly with their bank; in this scenario Lean will also communicate the consent status change to you via consent.status.updated web hook

Customers may need to revoke an Account-on-file payments consent directly in certain scenarios, for example:

• The end user has permanently closed their account with the customer
• Fraudulent activity has been detected
• Revoking an existing consent nearing expiry once a replacement consent has been authorised, ensuring a seamless renewal experience for the end user.

For this Lean, provides an optional consents/v1/id/revocation endpoint.

❗️

consents/v1/id/revocation is for customer-initiated revocations only and does not replace the manageConsents()` SDK function. Providing end users the ability to view and revoke their own consents at any time is a mandatory regulatory requirement and must be implemented as part of any Account on File payments integration.

{
  "reason": "CONSENT_RENEWAL", // mandatory
  "additional_context": "USER_CANCELLED" // optional
}