Consent Management

Get and update the user’s data processing consent

Both endpoints require a valid JWT Bearer token. See Login to obtain one.

Consent management aligns with LFPDPPP (Ley Federal de Protección de Datos Personales en Posesión de los Particulares — Mexico’s Personal Data Protection Law). Users can revoke consent at any time.

Endpoints

Method	Path	Description
GET	/api/profile/consent	Retrieve the user’s current consent records
PUT	/api/profile/consent	Update the user’s consent

---

GET /api/profile/consent

Returns the current data processing consent records for the authenticated user. The response is an array — one record per consent type.

Response

Returns an array of consent record objects.

id · string · required

UUID of the consent record.

type · string · required

The type of consent this record represents, e.g., "analytics", "accessibility".

granted · boolean · required

Whether the user has granted this consent.

timestamp · string · required

ISO 8601 timestamp of when this consent was last updated.

Example

cURL

curl -X GET http://localhost:5000/api/profile/consent \
  -H "Authorization: Bearer <token>"

---

PUT /api/profile/consent

Updates a consent record for the authenticated user.

Request body

granted · boolean · required

Set to true to grant consent, or false to revoke it.

Response

200 OK

Returns the updated consent record with the same structure as a single item from the GET response array.

Error responses

Status	Description
400 Bad Request	Validation error — granted field is required.
401 Unauthorized	Invalid or expired token.

Example

cURL

curl -X PUT http://localhost:5000/api/profile/consent \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{
    "granted": false
  }'