GET /obp/v7.0.0/oidc/consents/CONSENT_ID

Gets the facts an OIDC provider needs to finish a consent flow, read from the Consent stored in OBP-API.

After a User accepts a Consent on the consent page, the OIDC provider issues an authorization code for that User. It must take the User, the Consent's status and its Consumer from this record, never from parameters on the browser's callback URL, because anyone can edit those. The provider then checks that status is an accepted one, that consent_request_id is the Consent Request it started the flow for, and that client_id is the client it is about to issue the code to.

client_id is the Consumer Key of the Consumer the Consent belongs to; it is absent if that Consumer no longer exists. user_id, username and provider identify the User who gave the Consent.

User Authentication is Required. The User must be logged in. The Application must also be authenticated.

This endpoint supports User OR Application authentication. You can authenticate either as a logged-in User (with Entitlements) or as an Application using a Consumer Key (with Scopes). See here for more information.

URL Parameters:

CONSENT_ID: 9d429899-24f5-42c8-8565-943ffa6a7947

{ "consent_id": "9d429899-24f5-42c8-8565-943ffa6a7945", "status": "ACCEPTED", "consent_request_id": "8ca8a7e4-6d02-40e3-a129-0b2bf89de9f0", "consumer_id": "7uy8a7e4-6d02-40e3-a129-0b2bf89de8uh", "client_id": "abc123def456", "user_id": "9ca9a7e4-6d02-40e3-a129-0b2bf89de9b1", "username": "felixsmith", "provider": "https://my-obp-oidc.example.com" }