Consent Docs
Open console

Accept consent from a Consent Manager

Name a registered Consent Manager, hand it a key, and record the consent and withdrawals people send through it as sealed records.

How-to2 min readFor web, backend and mobile developers

A person may give, review and withdraw consent to you through a Consent Manager registered with the Data Protection Board (DPDP Act, section 6(7)). Set one up here, so its consent lands in your records and its withdrawals reach your systems.

Before you start#

  • The Consent Manager's registration number with the Board. Registration opens on 13 November 2026. Section 6(7) applies from 13 May 2027.
  • A published form whose notice covers the purposes the Consent Manager asks about.
  • The Owner or Privacy officer role in the project.
  1. Open Properties and choose Consent Managers.
  2. Choose Add Consent Manager.
  3. Enter its Name and its Board registration number.
  4. Choose Test to try the integration first, or Live.
  5. Enter its Notification address if it wants to hear about changes made elsewhere.
  6. Choose a Default notice. Tick the purposes it may record as given if you limit them.
  7. Choose Add, then copy the Key and the Signing secret.
  8. Hand both to the Consent Manager over a secure channel.

Both are shown once. The key is stored only as a hash, like a secret SDK key.

It sends each consent artefact from its servers, with the key as a bearer token:

Shell
curl -X POST https://console.dpconsent.com/consent/sdk/v1/consent-managers/consents \
  -H "Authorization: Bearer $CONSENT_MANAGER_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "schemaVersion": "piedap-cm-artefact/1.0",
    "artefactId": "art_01JB7Q4X2M9K",
    "dataPrincipal": {
      "identifierType": "EMAIL",
      "identifier": "priya.sharma@example.in"
    },
    "notice": { "formKey": "kaveri-rewards" },
    "purposes": [
      { "purposeKey": "offers-by-sms", "granted": true },
      { "purposeKey": "offers-by-email", "granted": false }
    ],
    "givenAt": "2026-11-20T10:15:00.000Z",
    "validUntil": "2027-11-20T00:00:00.000Z"
  }'

The identifier is hashed on arrival, as for any write from your server. The answer goes through the same sealed write path as consent on your website. The record shows Collected through: Consent Manager, and its seal carries the Consent Manager and the artefact id.

A withdrawal goes to POST /sdk/v1/consent-managers/withdrawals, by artefact id or by identifier. It is an ordinary withdrawal: your endpoints get consent.withdrawn, your Data Processors get stop tasks, and the consent check answers withdrawn.

When the person changes their mind elsewhere#

If the person changes or withdraws that consent on your website, in the console or by erasure, the Consent Manager is told. A signed notification goes to its address and is retried for about 21 hours. If it still fails, your endpoints get consent_manager.notification_failed, so you can tell it another way.

The notification names the artefact and the answers, never the person.

Suspend or replace#

  • To stop new consent through a Consent Manager, open Edit and choose Suspended. It can still send withdrawals.
  • An entry that records came through cannot be removed. It stays as evidence.
  • To replace a leaked key or secret, open Edit and choose Issue a new key or Issue a new signing secret.

↑↓ to move, Enter to open