Record end-user consent

Updated
  • Updated on Mar 9, 2026
  • Published on Sep 19, 2024
Prev Next
Post
/v1/sessions/{id}/consents

When to use this endpoint

  • Use this endpoint to record end-user consent when verification features require it.
  • In case you upload multiple consents for a single session (as per sessionId), only latest will be considered binding.
  • Common use cases include:
    • Recording consent for INE Biometric Database Verification (Mexican identity verification)
    • Recording consent for Biometric Information Privacy Act (BIPA) compliance (Illinois, USA)
    • Recording consent for Aadhaar verification (India)

Request body content

  • The request body must contain:

    • type: The verification feature requiring consent (ine, bipa, or aadhaar)
    • approved: Boolean indicating whether end-user approved or declined consent
    • text: The exact consent text shown to the end-user in their language

  • The text field must contain the complete consent statement exactly as displayed to the end-user, including any legal language or disclosure requirements.

Implementation notes

  • Consent must be recorded before submitting the verification session for features that require it.
  • For INE Biometric Database Verification, approved: true is mandatory. Sessions cannot proceed with approved: false.
  • The consent text should match what was displayed to the end-user to ensure legal compliance.
  • Always ensure that you use the correct API URL to send requests. See the API URL section for more info.
  • The order of parameters in the real API response can differ from the order you see in this documentation. This is expected and part of the Backwards compatible changes requirements.
Header parameters
x-auth-client
stringRequired

Your integration's API key (occasionally referred to as the "Token", "API public key" or "Publishable key"). Required for all API requests.

You can find your API key in the Veriff Customer Portal > Settings > API keys.

Exampleyour-api-key
x-hmac-signature
stringRequired

Request body signed with the shared secret key. Required to authenticate the request sender.

Examplef8b5d09c7e4a1234567890abcdef1234567890abcdef1234567890abcdef1234
Content-Type
stringRequired

Media type of the request body

Valid values[ "application/json" ]
Exampleapplication/json
Path parameters
id
string (uuid) Required

Verification session ID.

Exampled69a07cf-4434-4d36-be6c-d22af7dc01fb
Body parameters
ine_consent

INE biometric verification consent (Mexico)

{
  "type": "ine",
  "approved": true,
  "text": "Autorizo a Veriff a realizar la verificación de mis datos biométricos con el INE"
}
bipa_consent

BIPA compliance consent (Illinois, USA)

{
  "type": "bipa",
  "approved": true,
  "text": "I consent to the collection and use of my biometric information for identity verification purposes"
}
aadhaar_consent

Aadhaar verification consent (India)

{
  "type": "aadhaar",
  "approved": true,
  "text": "I consent to verification of my Aadhaar details for identity verification"
}
object
type
string Required

Consent type.

Valid values[ "ine", "bipa", "aadhaar" ]
Exampleine
approved
boolean Required

Indicates if the consent has been approved by the end-user or not.

Exampletrue
text
string Required

Consent text exactly (same language) as shown to the end-user.

ExampleUser agrees to share their INE details
Responses
200

Consent recorded successfully

Headers
Content-Type
string
Response content type.
Valid values[ "application/json" ]
x-auth-client
string
API key echoed back in response.
x-hmac-signature
string
Response body signed with the shared secret key. Required to authenticate the response sender.
ine_consent_recorded

INE consent recorded

{
  "id": "123e4567-e89b-12d3-a456-426614174000",
  "context": "consent",
  "sessionId": "d69a07cf-4434-4d36-be6c-d22af7dc01fb"
}
bipa_consent_recorded

BIPA consent recorded

{
  "id": "987e6543-e21b-10c9-b876-543210987654",
  "context": "consent",
  "sessionId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
}
object
id
string (uuid)

UUID v4 identifying the consent.

Example123e4567-e89b-12d3-a456-426614174000
context
string

Context representing the type of consent.

Valid values[ "consent" ]
Exampleconsent
sessionId
string (uuid)

UUID v4 of the session the consent belongs to.

Exampled69a07cf-4434-4d36-be6c-d22af7dc01fb
400

Bad request

Headers
Content-Type
string
Response content type.
Valid values[ "application/json" ]
x-auth-client
string
API key echoed back in response.
x-hmac-signature
string
Response body signed with the shared secret key. Required to authenticate the response sender.
{
  "status": "fail",
  "code": "1101",
  "message": "Validation failed"
}
object
status
string
Valid values[ "fail" ]
Examplefail
code
string
Example1101
message
string
ExampleValidation failed
401

Unauthorized

Headers
Content-Type
string
Response content type.
Valid values[ "application/json" ]
x-auth-client
string
API key echoed back in response.
{
  "status": "fail",
  "code": "1101",
  "message": "Mandatory X-AUTH-CLIENT header containing the API key is missing from the request."
}
object
status
string
Valid values[ "fail" ]
Examplefail
code
string
Example1101
message
string
ExampleMandatory X-AUTH-CLIENT header containing the API key is missing from the request.
404

Session not found

Headers
Content-Type
string
Response content type.
Valid values[ "application/json" ]
x-auth-client
string
API key echoed back in response.
x-hmac-signature
string
Response body signed with the shared secret key. Required to authenticate the response sender.
{
  "status": "fail",
  "code": "1101",
  "message": "Resource not found"
}
object
status
string
Valid values[ "fail" ]
Examplefail
code
string
Example1101
message
string
ExampleResource not found
500

Internal server error

Headers
Content-Type
string
Response content type.
Valid values[ "application/json" ]
x-auth-client
string
API key echoed back in response.
x-hmac-signature
string
Response body signed with the shared secret key. Required to authenticate the response sender.
{
  "status": "fail",
  "code": "1101",
  "message": "Something went wrong"
}
object
status
string
Valid values[ "fail" ]
Examplefail
code
string
Example1101
message
string
ExampleSomething went wrong



Document Versioning

Changelog

Date

Description

Mar 8, 2026

Documentation updated: parent categories rearranged, intro section expanded, request and response examples added

Oct 2, 2025

vrf- headers removed from response headers

Aug 6, 2025

Response headers added

Mar 12, 2025

Documentation published