---
title: "Retrieve consent history for a user"
method: GET
path: "/consent-history"
tags: ["consent-history"]
---

# Retrieve consent history for a user

`GET /consent-history`

Retrieves the consent history for the authenticated user. Requires **consent_history:read** scope.

## Query parameters

- `userId` string

## Response `200`

Successful Consent History Response

- object
  - `data` ConsentHistoryItem[]
    - `userId` string, required — User ID associated with the consent
    - `bankId` string, required — Provider identifier (32-character hex string matching the id field from GET /all-connections)
    - `consents` object[], required — Array of consent records for this user and provider
      - `authorizationRequestId` string, uuid, nullable, required — The id field from POST /auth-requests (the identity grant ID) that initiated this consent, or null if no corresponding grant exists
      - `consentId` string, required — The provider's consent/intent identifier as returned by the ASPSP when the consent was created. Format varies by provider
      - `consentType` 'accounts' | 'payments' | 'recurring_payments' | 'auto_recurring_payment' | 'standing_orders' | 'reverse_payment' | 'pay_file_consent' | 'pay_file_execution', required — Type of consent granted, determined by the intent type of the authorisation request
      - `consentStatus` 'active' | 'expired' | 'cancelled' | 'errored', required — **active** — consent applies to the user's current bank connection. **expired** — consent is no longer in effect for ongoing access. Typical reasons include a newer authorisation for that provider or the consent period ending; `expiresAt` is often related but **`expired` is not defined solely by comparing the current time with that field**. **cancelled** — consent ended, replaced by a newer one, or never finished (for example the customer abandoned the bank flow). **errored** — consent or connection flow failed.
      - `consentTo` string, date-time, required — Timestamp when consent is valid until
      - `consentFrom` string, date-time, required — Timestamp when consent became valid from
      - `grantedAt` string, date-time, nullable — When the customer completed authorisation with the bank and the consent took effect (including code exchange). Null if that never happened, or if there was an error.
      - `permissions` string[] — Permissions granted with this consent. For accounts consents these follow the Open Banking Read/Write API permission model (e.g. ReadAccountsDetail, ReadBalances). For payment consents these are payment-specific (e.g. CreatePayment). For VRP consents, typically CreateRecurringPayment.
      - `cancelledAt` string, date-time — Timestamp when consent was cancelled (if applicable)
      - `erroredAt` string, date-time — Timestamp when consent encountered an error (if applicable)
      - `revokedAt` string, date-time — Timestamp when consent access was revoked/removed by our platform (for example, connection deletion or VRP revocation). Bank-side revocation may be attempted opportunistically and can fail independently.
      - `createdAt` string, date-time, required — Timestamp when consent was created
      - `expiresAt` string, date-time, required — Timestamp when consent expires
      - `connectionId` string, nullable — Connection identifier (`connections/{id}`) when this consent completed a connection. Null if the flow was abandoned, failed, or cancelled. Multiple items may share the same id after re-authorisation. May still be set when status is **expired** (previous connection that is no longer live).
      - `accountDetails` object[] — Array of account details associated with this consent (for accounts consent type)
        - `schemeName` string, required — Scheme name for the account identification, often following Open Banking naming conventions. Common values are UK.OBIE.SortCodeAccountNumber and UK.OBIE.IBAN.
        - `identification` string, required — Account identification value in the format specified by schemeName. For SortCodeAccountNumber this is a concatenated sort code and account number; for IBAN this is the full IBAN.
        - `accountType` 'cash:current' | 'savings' | 'card' | 'investment' | 'loan' | 'mortgage' | 'mortgage:repayment' | 'mortgage:interestOnly' | 'pension' | 'pension:definedBenefit' | 'pension:definedContribution' | 'asset' | 'properties' | 'properties:residential' | 'properties:buyToLet' | 'crypto' — Account type. Includes all values from the type field on account objects in the Moneyhub Accounts API (GET /accounts).
      - `vrpDetails` object — VRP (Variable Recurring Payment) details associated with this consent (for recurring_payments consent type)
        - `accountTo` string — Account number and sort code for the destination account
        - `accountFrom` string — Account number and sort code for the source account
  - `meta` Meta
    - `limit` integer
    - `offset` integer
    - `total` integer

## Other responses

- `401` — Unsuccessful Response - Not authorised - Missing authorization header - Invalid access Token
- `403` — Unsuccessful Response - Forbidden - Invalid scopes
- `500` — Internal Server Error

---

[API](https://skmtc.net/moneyhubenterprise/apis/moneyhub-identity-service.md) · [All operations](https://skmtc.net/moneyhubenterprise/apis/moneyhub-identity-service/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/moneyhubenterprise/moneyhub-identity-service/revisions/8841721f7aae/schema)