# Consent Workflow

The consent workflow is a fundamental part of the Account Aggregator (AA) ecosystem. It ensures that Financial Information Users (FIUs) can access user data from Financial Information Providers (FIPs) only after obtaining explicit consent from the user. This workflow is governed by a series of secure and standardized interactions using the ReBIT APIs.

### **Steps Involved in Consent Workflow:**

#### Pre-requisites:

The [Account Discovery & Linking](/no-longer-relevent/buildaathon-2024/network-scenarios/account-discovery-and-linking.md) is handled by the user to execute the Consent workflow.

<figure><img src="/files/OBUojDedpotmdJTjMrFI" alt=""><figcaption><p>Consent Workflow</p></figcaption></figure>

#### **1. FIU Initiates Consent Request:**

The FIU initiates the process by sending a consent request to the Account Aggregator (AA). The request specifies the type of financial data, the duration, and the purpose for which it is being requested. This consent request is made by the FIU to the AA.

***ReBIT API Involved (FIU 2.0.0 Spec): /Consent (POST)**:* The FIU sends the consent request to the AA using this API. The request includes the data access requirements, purpose, and duration for which access is required.

***API (AA Internal Spec): /Consent/create (POST):*** The AA create the consent artefact and stores for future use with pending status.

#### **2. AA Presents Consent to User:**

After receiving the consent request, the AA communicates with the user via its mobile app or web portal, presenting the consent details. The user reviews and either approves or denies the request.

***API (AA Internal Spec): /Consent/read (GET)**:* The AA retrieves the consent artefact details to present to the user for approval.

#### **3. User Grants Consent:**

If the user approves the consent request, the AA generates a consent artefact. This artefact is a formal document containing all the details of the user’s consent, such as the scope, purpose, and validity.

***API (AA Internal Spec): /Consent/accept (POST)**:* The AA update the status and stores the consent artefact after the user grants approval.

#### **4. AA Shares Consent with FIU & FIP:**

Once consent is granted, the AA sends the consent artefact to both the FIU and the relevant FIP. The FIP uses this consent artefact to validate requests for financial data.

***ReBIT API Involved (FIP 2.1.0 Spec): /Consent/Notification (POST)**:* The FIP is notified about the granted consent via this API, allowing it to validate the future data requests from the FIU.

#### **5. Consent Revocation (Optional):**

The user has the ability to revoke consent at any time, cutting off access to their data.

***API  (AA Internal Spec): /Consent/revoke (POST)**:* This API allows the user to revoke previously granted consent.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://developer.sahamati.org.in/no-longer-relevent/buildaathon-2024/network-scenarios/consent-workflow.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.