post/v2/consent

Record an answer to the storage-consent banner

Operation: recordConsent
Authentication: None — public

Appends a consent record for one or more purposes. **No row means no**: a purpose with no recorded answer is not consented, and there is no default.

Unlike the rest of `/v2` this route is **public**, and that is deliberate rather than a relaxation. The wizard has no sign-in — it proxies with a tenant key so somebody can start an application before deciding whether to have an account — and consent has to be recorded before sign-in or it cannot gate anything that loads on the sign-in page.

The caller supplies the subject id, because it is minted by the browser at the moment of the decision and stored in that origin’s own cookie. This endpoint records the evidence behind it; it sets no cookie of its own, since a cookie written by `api.haavisa.com` is not one `haavisa.com` can read.

Request

Body

consent_idstring

The browser’s opaque consent id. Omit on the first visit and the server mints one, returned as `consent_id` for the caller to store.

sourcestringrequired

one of: banner_accept_allbanner_reject_allsettings_toggle

answersobject[]required

localestring

Responses

200The answers recorded, and the subject id the caller should store.

consent_idstringrequired

acceptedintegerrequired

rejectedstring[]

400The request body or query failed validation.

errorobjectrequired

401No key, an unknown key, a revoked key, or a key whose tenant is not active. All four return an identical body on purpose: distinguishing them would let a caller discover which partners we have.

errorobjectrequired

403The key is valid but does not hold the scope this route requires.

errorobjectrequired

404Not found, or not yours. A resource belonging to another tenant answers 404 rather than 403, because 403 would confirm the record exists.

errorobjectrequired

Example

curl

curl -X POST https://api.haavisa.com/v2/consent \
  -H "Content-Type: application/json" \
  -d '{
    "source": "banner_accept_all",
    "answers": []
  }'

Something unclear? The eligibility guide explains the model behind the answers; the errors guide covers the envelope.