Create Consent Request
POST /obp/v7.0.0/consumer/consent-requests
OBPv5.0.0-createConsentRequest No role required ConsentAccount Information Service (AIS)PSD2
Create a Consent Request — the first step of the OBP Consent flow.
The calling application (TPP) authenticates with Client Credentials and posts the consent details (entitlements, account_access, VRP fields, etc.). The User then completes the flow by calling Create Consent By CONSENT_REQUEST_ID.
The Consent Request is recorded against the calling consumer (its creator).
Optional body fields of note:
consumer_id: names the consumer the resulting Consent (created when the User answers this request) is for. Set it when the Consent is intended for a different application than the one creating the request — for example a portal creating a Consent for an agent to use later. Most TPPs should omit it; when omitted, the resulting Consent is pinned to the consumer that created this request. Either way the resulting Consent names exactly one consumer and only that consumer can present it, so an omittedconsumer_idis not a wildcard.email/phone_number: surface in the SCA challenge if the User chooses EMAIL or SMS at answer time.valid_from/time_to_live: control the lifetime of the resulting Consent.
Authentication:
The client needs to authenticate themselves for this request. In case of public client we use client_id and private key to obtain access token; otherwise we use client_id and client_secret. The obtained access token is used in the HTTP Bearer auth header of our request.
Example: Authorization: Bearer eXtneO-THbQtn3zvK_kQtXXfvOZyZFdBCItlPDbR2Bk.dOWqtXCtFX-tqGTVR0YrIjvAolPIVg7GZ-jz83y6nA0
After successfully creating the Consent Request, call Create Consent By CONSENT_REQUEST_ID to finalize.
See Glossary entry "Authentication: Consent OBP Flow Example" for an end-to-end walk-through.
Application Access is Required. The Application must be authenticated.
User Authentication is Optional. The User need not be logged in.
JSON request body fields (15)
- account_access
- account_access
- account_routing
- address
- bank_id
- gh.29.uk
- everything
- role_name
- scheme
- OBP
- view_id
- owner
- bank_id
- gh.29.uk
- consumer_id
- 7uy8a7e4-6d02-40e3-a129-0b2bf89de8uh
- felixsmith@example.com
- entitlements
- phone_number
- time_to_live
- valid_from
- 2020-01-27
JSON response body fields (3)
- consent_request_id
- 8ca8a7e4-6d02-40e3-a129-0b2bf89de9f0
- consumer_id
- 7uy8a7e4-6d02-40e3-a129-0b2bf89de8uh
- payload
- payload
Example request body
{
"everything": false,
"account_access": [
{
"account_routing": {
"scheme": "OBP",
"address": "8ca8a7e4-6d02-40e3-a129-0b2bf89de9f0"
},
"view_id": "owner"
}
],
"entitlements": [
{
"bank_id": "gh.29.uk",
"role_name": "CanGetCustomersAtOneBank"
}
],
"consumer_id": "7uy8a7e4-6d02-40e3-a129-0b2bf89de8uh",
"email": "felixsmith@example.com",
"phone_number": "+44 07972 444 876",
"valid_from": "2026-10-21T01:45:41Z",
"time_to_live": 3600
}Example success response
{
"consent_request_id": "8ca8a7e4-6d02-40e3-a129-0b2bf89de9f0",
"payload": {
"everything": false,
"account_access": [
{
"account_routing": {
"scheme": "OBP",
"address": "8ca8a7e4-6d02-40e3-a129-0b2bf89de9f0"
},
"view_id": "owner"
}
],
"phone_number": "+44 07972 444 876",
"valid_from": "2022-06-14T12:42:00Z",
"time_to_live": 3600
},
"consumer_id": "7uy8a7e4-6d02-40e3-a129-0b2bf89de8uh"
}Possible errors (6)
- OBP-10001: Incorrect json format.
- OBP-35020: You exceeded max value of time to live of consents.
- OBP-20306: PEM Encoded Certificate cannot be found at request header.
- OBP-20300: PEM Encoded Certificate issue.
- OBP-50200: Connector cannot return the data we requested.
- OBP-50000: Unknown Error.